Bug 21269 - i386 sigaction sa_restorer handling is wrong
Summary: i386 sigaction sa_restorer handling is wrong
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: dynamic-link (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: 2.28
Assignee: Adhemerval Zanella
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-03-17 21:10 UTC by Andy Lutomirski
Modified: 2023-08-04 22:44 UTC (History)
5 users (show)

See Also:
Host:
Target: i386
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andy Lutomirski 2017-03-17 21:10:26 UTC
glibc does this:

      if (GLRO(dl_sysinfo_dso) == NULL)
        {
          kact.sa_flags |= SA_RESTORER;

          kact.sa_restorer = ((act->sa_flags & SA_SIGINFO)
                              ? &restore_rt : &restore);
        }

This is correct for the vDSO-present case, but it's subtly wrong for the vDSO-not-present case.  For ancient historical reasons, x86_32 Linux (and compat on x86_64) interprets SA_RESTORER clear with nonzero sa_restorer as a request for stack switching if the SS segment is funny.  This means that anything that tries to mix glibc's signal handling with segmentation is randomly broken depending on what garbage lands in sa_restorer.  (Also, it's just bad form to pass uninitialized data into the kernel.)

The fix should be trivial:

    else
      kact.sa_restorer = NULL;

or similar.

I can send a short test case if needed.
Comment 1 Florian Weimer 2017-03-20 09:42:57 UTC
(In reply to Andy Lutomirski from comment #0)
> glibc does this:
> 
>       if (GLRO(dl_sysinfo_dso) == NULL)
>         {
>           kact.sa_flags |= SA_RESTORER;
> 
>           kact.sa_restorer = ((act->sa_flags & SA_SIGINFO)
>                               ? &restore_rt : &restore);
>         }
> 
> This is correct for the vDSO-present case, but it's subtly wrong for the
> vDSO-not-present case.  For ancient historical reasons, x86_32 Linux (and
> compat on x86_64) interprets SA_RESTORER clear with nonzero sa_restorer as a
> request for stack switching if the SS segment is funny.  This means that
> anything that tries to mix glibc's signal handling with segmentation is
> randomly broken depending on what garbage lands in sa_restorer.  (Also, it's
> just bad form to pass uninitialized data into the kernel.)
> 
> The fix should be trivial:
> 
>     else
>       kact.sa_restorer = NULL;
> 
> or similar.

I think I'll take your word for this.  This seems an 

Do you see occasional crashes due to this?  Can they be triggered somehow, or are they spontaneous?

> I can send a short test case if needed.

Do you have a copyright assignment for glibc?  If not, I'd prefer if you could describe what we need to test instead, so that we can write our own test case.  (And yes, we'd very much like to have a test case for this.)
Comment 2 Andy Lutomirski 2017-03-20 15:35:26 UTC
(In reply to Florian Weimer from comment #1)
> (In reply to Andy Lutomirski from comment #0)
> > glibc does this:
> > 
> >       if (GLRO(dl_sysinfo_dso) == NULL)
> >         {
> >           kact.sa_flags |= SA_RESTORER;
> > 
> >           kact.sa_restorer = ((act->sa_flags & SA_SIGINFO)
> >                               ? &restore_rt : &restore);
> >         }
> > 
> > This is correct for the vDSO-present case, but it's subtly wrong for the
> > vDSO-not-present case.  For ancient historical reasons, x86_32 Linux (and
> > compat on x86_64) interprets SA_RESTORER clear with nonzero sa_restorer as a
> > request for stack switching if the SS segment is funny.  This means that
> > anything that tries to mix glibc's signal handling with segmentation is
> > randomly broken depending on what garbage lands in sa_restorer.  (Also, it's
> > just bad form to pass uninitialized data into the kernel.)
> > 
> > The fix should be trivial:
> > 
> >     else
> >       kact.sa_restorer = NULL;
> > 
> > or similar.
> 
> I think I'll take your word for this.  This seems an 

?

> 
> Do you see occasional crashes due to this?  Can they be triggered somehow,
> or are they spontaneous?

I see crashes 100% of the time in tools/testing/selftests/x86/ldt_gdt_32 in Linux (if run on SMP) on Fedora 25.  I didn't before, presumably because of luck.

> 
> > I can send a short test case if needed.
> 
> Do you have a copyright assignment for glibc?  If not, I'd prefer if you
> could describe what we need to test instead, so that we can write our own
> test case.  (And yes, we'd very much like to have a test case for this.)

No copyright assignment.

The most straightforward reproducer I can think of is to set up a struct user_desc that's all zeros except entry_number = -1, limit = 0xfffff, seg_32bit = 1, and limit_in_pages = 1.  Call set_thread_area(2) on it.  Set up a handler for SIGTRAP -- details don't really matter.

Then do (intentionally not valid C so you can't copy it):

mov [(entry_number << 3) | 3], %ss
int3

A successful test will run the signal handler.  A failed test will segfault.

What's going on is that the combination of SA_RESTORER clear, sa_restorer != 0, and nondefault %ss is interpreted as "change my stack pointer to the value in sa_restorer".  The result is a crash.

This obviously won't affect the vast majority of programs that use glibc because, while the first two conditions will be met, the latter condition is rather unlikely.
Comment 3 Florian Weimer 2017-03-20 16:05:03 UTC
(In reply to Andy Lutomirski from comment #2)
> (In reply to Florian Weimer from comment #1)
> > I think I'll take your word for this.  This seems an 
> 
> ?

Sorry, meant to write: This seems an actual problem we should fix.

> The most straightforward reproducer I can think of is to set up a struct
> user_desc that's all zeros except entry_number = -1, limit = 0xfffff,
> seg_32bit = 1, and limit_in_pages = 1.  Call set_thread_area(2) on it.  Set
> up a handler for SIGTRAP -- details don't really matter.
> 
> Then do (intentionally not valid C so you can't copy it):
> 
> mov [(entry_number << 3) | 3], %ss
> int3
> 
> A successful test will run the signal handler.  A failed test will segfault.

Okay, I'll try to turn this into an actual test case.

Any suggestions how to block the vDSO mapping?  I assume that's needed as well before the bug can trigger.
Comment 4 Andy Lutomirski 2017-03-20 16:59:31 UTC
(In reply to Florian Weimer from comment #3)
> (In reply to Andy Lutomirski from comment #2)
> > (In reply to Florian Weimer from comment #1)
> > > I think I'll take your word for this.  This seems an 
> > 
> > ?
> 
> Sorry, meant to write: This seems an actual problem we should fix.
> 
> > The most straightforward reproducer I can think of is to set up a struct
> > user_desc that's all zeros except entry_number = -1, limit = 0xfffff,
> > seg_32bit = 1, and limit_in_pages = 1.  Call set_thread_area(2) on it.  Set
> > up a handler for SIGTRAP -- details don't really matter.
> > 
> > Then do (intentionally not valid C so you can't copy it):
> > 
> > mov [(entry_number << 3) | 3], %ss
> > int3
> > 
> > A successful test will run the signal handler.  A failed test will segfault.
> 
> Okay, I'll try to turn this into an actual test case.

Let me know if you have issues and I can help with the test.  My test here seems to work as expected.  Sigh, copyright assignment.

> 
> Any suggestions how to block the vDSO mapping?  I assume that's needed as
> well before the bug can trigger.

I got it backwards in my original report.  The buggy path runs when the vDSO is present and does not run when the vDSO is absent.  IOW gcc -m32 testcase.c is sufficient.
Comment 5 Andy Lutomirski 2017-08-15 05:39:30 UTC
FWIW, I just tripped over this same bug again: Xen is a bit inconsistent as to which SS value guest user code runs with, which means that guest user code can sometimes inadvertently run with an SS value that Linux considers unusual, which can trigger the legacy stack switching and cause random crashes due to this glibc bug.
Comment 6 Sourceware Commits 2018-03-05 21:10:56 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master-push has been created
        at  5226a81f5517bcbc892679cca792006a6bafc53f (commit)

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5226a81f5517bcbc892679cca792006a6bafc53f

commit 5226a81f5517bcbc892679cca792006a6bafc53f
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Mar 2 13:04:36 2018 -0300

    Define _DIRENT_MATCHES_DIRENT64 regardless
    
    This patch defines _DIRENT_MATCHES_DIRENT64 to either 0 or 1 and adjust its
    usage from checking its definition to its value.
    
    Checked on a build for major Linux abis.
    
    	* bits/dirent.h (__INO_T_MATCHES_INO64_T): Define regardless whether
    	__INO_T_MATCHES_INO64_T is defined.
    	* sysdeps/unix/sysv/linux/bits/dirent.h: Likewise.
    	* dirent/alphasort.c: Check _DIRENT_MATCHES_DIRENT64 value instead
    	of definition.
    	* dirent/alphasort64.c: Likewise.
    	* dirent/scandir.c: Likewise.
    	* dirent/scandir64-tail.c: Likewise.
    	* dirent/scandir64.c: Likewise.
    	* dirent/scandirat.c: Likewise.
    	* dirent/scandirat64.c: Likewise.
    	* dirent/versionsort.c: Likewise.
    	* dirent/versionsort64.c: Likewise.
    	* include/dirent.h: Likewise.

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=fbd01e6c4427b558b63fedb938b7fc5fada8c6b8

commit fbd01e6c4427b558b63fedb938b7fc5fada8c6b8
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Feb 22 15:47:33 2018 -0300

    nptl: Fix tst-cancel4 sendto tests
    
    Now that send might be implemented calling sendto syscall on Linux,
    I am seeing some issue in some kernel configurations where tst-cancel4
    sendto do not block as expected.
    
    The socket used to force the syscall blocking is used with default
    system configuration for buffer sending size, which might not be
    suffice to force blocking.  This patch fixes it by explicit setting
    buffer socket lower than the buffer size used.  It also enables sendto
    cancellation tests to work in both ways (since internally send is
    implemented routing to sendto on Linux kernel).
    
    The patch also removes unrequired make rules on some archictures
    for send/recv. The generic nptl Makefile already set the compiler flags
    required on some architectures for correct unwinding and libc object
    are not strictly required to support unwind (since pthread_cancel
    requires linking against libpthread).
    
    Checked on aarch64-linux-gnu and x86_64-linux-gnu. I also did a
    sniff test with tst-cancel{4,5} on a simulated mips64-linux-gnu.
    
    	* nptl/tst-cancel4-common.h (set_socket_buffer): New function.
    	* nptl/tst-cancel4-common.c (do_test): Call set_socket_buffer
    	for socketpair endpoint.
    	* nptl/tst-cancel4.c (tf_send): Call set_socket_buffer and use
    	WRITE_BUFFER_SIZE as buffer size for sending socket.
    	(tf_sendto): Use SOCK_STREAM instead of SOCK_DGRAM and fix an
    	issue on system where send is implemented with sendto syscall.
    	* sysdeps/unix/sysv/linux/mips/mips64/Makefile [$(subdir) = socket]
    	(CFLAGS-recv.c, CFLAGS-send.c): Remove rules.
    	[$(subdir) = nptl] (CFLAGS-recv.c, CFLAGS-send.c): Likewise.
    	* sysdeps/unix/sysv/linux/riscv/rv64/Makefile: Remove file.

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=68448be208ee06e76665918b37b0a57e3e00c8b4

commit 68448be208ee06e76665918b37b0a57e3e00c8b4
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Nov 17 16:04:29 2017 -0200

    i386: Fix i386 sigaction sa_restorer initialization (BZ#21269)
    
    This patch fixes the i386 sa_restorer field initialization for sigaction
    syscall for kernel with vDSO.  As described in bug report, i386 Linux
    (and compat on x86_64) interprets SA_RESTORER clear with nonzero
    sa_restorer as a request for stack switching if the SS segment is 'funny'.
    This means that anything that tries to mix glibc's signal handling with
    segmentation (for instance through modify_ldt syscall) is randomly broken
    depending on what values lands in sa_restorer.
    
    The testcase added  is based on Linux test tools/testing/selftests/x86/ldt_gdt.c,
    more specifically in do_multicpu_tests function.  The main changes are:
    
      - C11 atomics instead of plain access.
    
      - Remove x86_64 support which simplifies the syscall handling and fallbacks.
    
      - Replicate only the test required to trigger the issue.
    
    Checked on i686-linux-gnu.
    
    	[BZ #21269]
    	* sysdeps/unix/sysv/linux/i386/Makefile (tests): Add tst-bz21269.
    	* sysdeps/unix/sysv/linux/i386/sigaction.c (SET_SA_RESTORER): Clear
    	sa_restorer for vDSO case.
    	* sysdeps/unix/sysv/linux/i386/tst-bz21269.c: New file.

-----------------------------------------------------------------------
Comment 7 Sourceware Commits 2018-03-05 21:11:42 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  5226a81f5517bcbc892679cca792006a6bafc53f (commit)
       via  fbd01e6c4427b558b63fedb938b7fc5fada8c6b8 (commit)
       via  68448be208ee06e76665918b37b0a57e3e00c8b4 (commit)
      from  8d965cde7a2bc18a010325607f6f526db86cdaf0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5226a81f5517bcbc892679cca792006a6bafc53f

commit 5226a81f5517bcbc892679cca792006a6bafc53f
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Mar 2 13:04:36 2018 -0300

    Define _DIRENT_MATCHES_DIRENT64 regardless
    
    This patch defines _DIRENT_MATCHES_DIRENT64 to either 0 or 1 and adjust its
    usage from checking its definition to its value.
    
    Checked on a build for major Linux abis.
    
    	* bits/dirent.h (__INO_T_MATCHES_INO64_T): Define regardless whether
    	__INO_T_MATCHES_INO64_T is defined.
    	* sysdeps/unix/sysv/linux/bits/dirent.h: Likewise.
    	* dirent/alphasort.c: Check _DIRENT_MATCHES_DIRENT64 value instead
    	of definition.
    	* dirent/alphasort64.c: Likewise.
    	* dirent/scandir.c: Likewise.
    	* dirent/scandir64-tail.c: Likewise.
    	* dirent/scandir64.c: Likewise.
    	* dirent/scandirat.c: Likewise.
    	* dirent/scandirat64.c: Likewise.
    	* dirent/versionsort.c: Likewise.
    	* dirent/versionsort64.c: Likewise.
    	* include/dirent.h: Likewise.

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=fbd01e6c4427b558b63fedb938b7fc5fada8c6b8

commit fbd01e6c4427b558b63fedb938b7fc5fada8c6b8
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Feb 22 15:47:33 2018 -0300

    nptl: Fix tst-cancel4 sendto tests
    
    Now that send might be implemented calling sendto syscall on Linux,
    I am seeing some issue in some kernel configurations where tst-cancel4
    sendto do not block as expected.
    
    The socket used to force the syscall blocking is used with default
    system configuration for buffer sending size, which might not be
    suffice to force blocking.  This patch fixes it by explicit setting
    buffer socket lower than the buffer size used.  It also enables sendto
    cancellation tests to work in both ways (since internally send is
    implemented routing to sendto on Linux kernel).
    
    The patch also removes unrequired make rules on some archictures
    for send/recv. The generic nptl Makefile already set the compiler flags
    required on some architectures for correct unwinding and libc object
    are not strictly required to support unwind (since pthread_cancel
    requires linking against libpthread).
    
    Checked on aarch64-linux-gnu and x86_64-linux-gnu. I also did a
    sniff test with tst-cancel{4,5} on a simulated mips64-linux-gnu.
    
    	* nptl/tst-cancel4-common.h (set_socket_buffer): New function.
    	* nptl/tst-cancel4-common.c (do_test): Call set_socket_buffer
    	for socketpair endpoint.
    	* nptl/tst-cancel4.c (tf_send): Call set_socket_buffer and use
    	WRITE_BUFFER_SIZE as buffer size for sending socket.
    	(tf_sendto): Use SOCK_STREAM instead of SOCK_DGRAM and fix an
    	issue on system where send is implemented with sendto syscall.
    	* sysdeps/unix/sysv/linux/mips/mips64/Makefile [$(subdir) = socket]
    	(CFLAGS-recv.c, CFLAGS-send.c): Remove rules.
    	[$(subdir) = nptl] (CFLAGS-recv.c, CFLAGS-send.c): Likewise.
    	* sysdeps/unix/sysv/linux/riscv/rv64/Makefile: Remove file.

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=68448be208ee06e76665918b37b0a57e3e00c8b4

commit 68448be208ee06e76665918b37b0a57e3e00c8b4
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Nov 17 16:04:29 2017 -0200

    i386: Fix i386 sigaction sa_restorer initialization (BZ#21269)
    
    This patch fixes the i386 sa_restorer field initialization for sigaction
    syscall for kernel with vDSO.  As described in bug report, i386 Linux
    (and compat on x86_64) interprets SA_RESTORER clear with nonzero
    sa_restorer as a request for stack switching if the SS segment is 'funny'.
    This means that anything that tries to mix glibc's signal handling with
    segmentation (for instance through modify_ldt syscall) is randomly broken
    depending on what values lands in sa_restorer.
    
    The testcase added  is based on Linux test tools/testing/selftests/x86/ldt_gdt.c,
    more specifically in do_multicpu_tests function.  The main changes are:
    
      - C11 atomics instead of plain access.
    
      - Remove x86_64 support which simplifies the syscall handling and fallbacks.
    
      - Replicate only the test required to trigger the issue.
    
    Checked on i686-linux-gnu.
    
    	[BZ #21269]
    	* sysdeps/unix/sysv/linux/i386/Makefile (tests): Add tst-bz21269.
    	* sysdeps/unix/sysv/linux/i386/sigaction.c (SET_SA_RESTORER): Clear
    	sa_restorer for vDSO case.
    	* sysdeps/unix/sysv/linux/i386/tst-bz21269.c: New file.

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                    |   35 ++++
 bits/dirent.h                                |    2 +
 dirent/alphasort.c                           |    2 +-
 dirent/alphasort64.c                         |    2 +-
 dirent/scandir.c                             |    2 +-
 dirent/scandir64-tail.c                      |    2 +-
 dirent/scandir64.c                           |    2 +-
 dirent/scandirat.c                           |    2 +-
 dirent/scandirat64.c                         |    2 +-
 dirent/versionsort.c                         |    2 +-
 dirent/versionsort64.c                       |    2 +-
 include/dirent.h                             |    2 +-
 nptl/tst-cancel4-common.c                    |   18 +--
 nptl/tst-cancel4-common.h                    |   14 ++
 nptl/tst-cancel4.c                           |   37 +++--
 sysdeps/unix/sysv/linux/bits/dirent.h        |    2 +
 sysdeps/unix/sysv/linux/i386/Makefile        |    3 +
 sysdeps/unix/sysv/linux/i386/sigaction.c     |    3 +-
 sysdeps/unix/sysv/linux/i386/tst-bz21269.c   |  233 ++++++++++++++++++++++++++
 sysdeps/unix/sysv/linux/mips/mips64/Makefile |   10 -
 sysdeps/unix/sysv/linux/riscv/rv64/Makefile  |    4 -
 21 files changed, 322 insertions(+), 59 deletions(-)
 create mode 100644 sysdeps/unix/sysv/linux/i386/tst-bz21269.c
 delete mode 100644 sysdeps/unix/sysv/linux/riscv/rv64/Makefile
Comment 8 Adhemerval Zanella 2018-03-05 21:12:22 UTC
Fixed by 68448be208ee06e76665918b37b0a57e3e00c8b4
Comment 9 Sourceware Commits 2018-03-13 01:19:32 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.27/master has been updated
       via  1e52d8e65a58c49a48549053a1b89c06240e0c6c (commit)
      from  78a90c2f74a2012dd3eff302189e47ff6779a757 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1e52d8e65a58c49a48549053a1b89c06240e0c6c

commit 1e52d8e65a58c49a48549053a1b89c06240e0c6c
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Nov 17 16:04:29 2017 -0200

    i386: Fix i386 sigaction sa_restorer initialization (BZ#21269)
    
    This patch fixes the i386 sa_restorer field initialization for sigaction
    syscall for kernel with vDSO.  As described in bug report, i386 Linux
    (and compat on x86_64) interprets SA_RESTORER clear with nonzero
    sa_restorer as a request for stack switching if the SS segment is 'funny'.
    This means that anything that tries to mix glibc's signal handling with
    segmentation (for instance through modify_ldt syscall) is randomly broken
    depending on what values lands in sa_restorer.
    
    The testcase added  is based on Linux test tools/testing/selftests/x86/ldt_gdt.c,
    more specifically in do_multicpu_tests function.  The main changes are:
    
      - C11 atomics instead of plain access.
    
      - Remove x86_64 support which simplifies the syscall handling and fallbacks.
    
      - Replicate only the test required to trigger the issue.
    
    Checked on i686-linux-gnu.
    
    	[BZ #21269]
    	* sysdeps/unix/sysv/linux/i386/Makefile (tests): Add tst-bz21269.
    	* sysdeps/unix/sysv/linux/i386/sigaction.c (SET_SA_RESTORER): Clear
    	sa_restorer for vDSO case.
    	* sysdeps/unix/sysv/linux/i386/tst-bz21269.c: New file.
    
    (cherry picked from commit 68448be208ee06e76665918b37b0a57e3e00c8b4)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                  |    8 +
 NEWS                                       |    1 +
 sysdeps/unix/sysv/linux/i386/Makefile      |    3 +
 sysdeps/unix/sysv/linux/i386/sigaction.c   |    3 +-
 sysdeps/unix/sysv/linux/i386/tst-bz21269.c |  233 ++++++++++++++++++++++++++++
 5 files changed, 247 insertions(+), 1 deletions(-)
 create mode 100644 sysdeps/unix/sysv/linux/i386/tst-bz21269.c
Comment 10 Sourceware Commits 2018-05-17 12:43:17 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.26/master has been updated
       via  3241353ab20b4cc8798088d456ffa9aace1514de (commit)
      from  677e6d13e0d59b35720b4d71af4a8d9038aedc6a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3241353ab20b4cc8798088d456ffa9aace1514de

commit 3241353ab20b4cc8798088d456ffa9aace1514de
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Nov 17 16:04:29 2017 -0200

    i386: Fix i386 sigaction sa_restorer initialization (BZ#21269)
    
    This patch fixes the i386 sa_restorer field initialization for sigaction
    syscall for kernel with vDSO.  As described in bug report, i386 Linux
    (and compat on x86_64) interprets SA_RESTORER clear with nonzero
    sa_restorer as a request for stack switching if the SS segment is 'funny'.
    This means that anything that tries to mix glibc's signal handling with
    segmentation (for instance through modify_ldt syscall) is randomly broken
    depending on what values lands in sa_restorer.
    
    The testcase added  is based on Linux test tools/testing/selftests/x86/ldt_gdt.c,
    more specifically in do_multicpu_tests function.  The main changes are:
    
      - C11 atomics instead of plain access.
    
      - Remove x86_64 support which simplifies the syscall handling and fallbacks.
    
      - Replicate only the test required to trigger the issue.
    
    Checked on i686-linux-gnu.
    
    	[BZ #21269]
    	* sysdeps/unix/sysv/linux/i386/Makefile (tests): Add tst-bz21269.
    	* sysdeps/unix/sysv/linux/i386/sigaction.c (SET_SA_RESTORER): Clear
    	sa_restorer for vDSO case.
    	* sysdeps/unix/sysv/linux/i386/tst-bz21269.c: New file.
    
    (cherry picked from commit 68448be208ee06e76665918b37b0a57e3e00c8b4)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                  |    8 +
 NEWS                                       |    1 +
 sysdeps/unix/sysv/linux/i386/Makefile      |    3 +
 sysdeps/unix/sysv/linux/i386/sigaction.c   |    3 +-
 sysdeps/unix/sysv/linux/i386/tst-bz21269.c |  233 ++++++++++++++++++++++++++++
 5 files changed, 247 insertions(+), 1 deletions(-)
 create mode 100644 sysdeps/unix/sysv/linux/i386/tst-bz21269.c
Comment 11 Sourceware Commits 2018-06-01 16:50:21 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, google/grte/v5-2.27/master has been updated
       via  58285b4cc9d07c71a9ce7b1f93d35a2369c63055 (commit)
       via  e97bf39fb5423b93a8a4790a01177eb2ffccbf39 (commit)
       via  4220a967def932bd946c33a1734ff6a554b3570f (commit)
       via  f079ef9e9336190685ec311eb3fd44a8a5370c2a (commit)
       via  7b28a36636a16769aa36981eeba4036436d36c10 (commit)
       via  5993d874500e0f8d717c6533713b277fade7a233 (commit)
       via  66f687a7a610e834866eeab1a6cc9e396a096b41 (commit)
       via  0904223cec6cddac5ea7e88b1836b7d52b86d5b2 (commit)
       via  80fc8dd4937ec2d3c175217e09e69e2125a9f5d8 (commit)
       via  34672a317613f76101f37e7dddcf7d793115e2a1 (commit)
       via  a6bc03771e48ae9cc5ef2bcc7e632291d8e11138 (commit)
       via  06f7d0f59b7c3a60109d655532f0c1e1dcb88557 (commit)
       via  5507e2bee631494bcc6c020630b15d49eb88b77a (commit)
       via  d587be985e976eda954201a45704172ce283174e (commit)
       via  0d1e9400204e4f7e5329f4a83f7bb0ebafd74d94 (commit)
       via  9a623f013e029b6166656bb6782d10187c7e1306 (commit)
       via  91bbc2d059052bd127619bcf58e287809fcb5e87 (commit)
       via  570e56dd2016da6f905018319562b609d3a4988a (commit)
       via  388a08e4e05ba8e709ec31eb17f34d6286e873df (commit)
       via  d0980fb402121d53ecaa8ebf02b3ed5a1aa4092b (commit)
       via  11834e2985afaf724e4dc264c945e29fab8db27a (commit)
       via  04ddad91260fbad4c0db9c005056d2d280d9353f (commit)
       via  5c51e08fc2be944c592216d127ba4d09af17aba7 (commit)
       via  d630d6ca1878ce62596e6b5dc69ce66ca698a9f5 (commit)
       via  7e99a36233bb1f07bf0739ce737885c6e6327455 (commit)
       via  deaa1650c3d9843e622fa8ac37e7c7adc5f54a17 (commit)
       via  b692351d53711c5d913304ebbd17b6cfa70d5dae (commit)
       via  111b25997956d561e056dd44aec5e08b89121a41 (commit)
       via  c50dad5e2e3b7c0cf1e388d47f692ee26803b20b (commit)
       via  7f161d38c0d2044f2f73184f023d9af4b52921e9 (commit)
       via  5a245488c51d9e524a0dc9590dc634ed350333bc (commit)
       via  faa8fc12a7d97cf69fe85405957f3c5448840e2b (commit)
       via  de736b2c5b3658049a4b78a34441b915431c0993 (commit)
       via  727e0f42a5ede3d31ad46fd40529845e186ac5e0 (commit)
       via  115693040b3e6a342bd2eac31aa469cbc1764c76 (commit)
       via  75c302f5fabd722c1c1d5c7d8b2174f1554f6159 (commit)
       via  d6a002b866533c3a04cdcf71e1e9e8d340369a24 (commit)
       via  147d851e7771e5629c5bd4ba1c9faaa67382aaad (commit)
       via  c05e47a2a96536fa21b65f5bf89cb8aea5329e9f (commit)
       via  9508cd18693431441cbe3cc81aff70bca36d5252 (commit)
       via  50955ed038f2b360b2376099cb08c1f6479cf7e0 (commit)
       via  9df5f71202294d36825efb8dbd8f14f56b6cdd3d (commit)
       via  3373d567d8778c182a087769a49644d600c49dd7 (commit)
       via  3e95a3edfc573c5be815e4ca043d667b8a2d3d51 (commit)
       via  1641c5840fcbb10be1aa4e22d93e813c1f955571 (commit)
       via  c87a0f31c7d992aa1a95cb3f10e3e6e7d6f30279 (commit)
       via  e633191c3faa6505ba540a530ceedc72d8742f5d (commit)
       via  cbd879419016a46326585f7e71b8358c4e2bd01a (commit)
       via  95cd1f5ef1eb88bce454249ada22a69abfb1509e (commit)
       via  d56ea9f2dcbe99517477d821639fc233c158288c (commit)
       via  071630d89e28b427158334f0f0a115f32b4fa728 (commit)
       via  82c4b147b782db578a5fe0e928c35869e196ddcc (commit)
      from  1d6a2a10c0d3636165a01980953c7cf227ecd9ea (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=58285b4cc9d07c71a9ce7b1f93d35a2369c63055

commit 58285b4cc9d07c71a9ce7b1f93d35a2369c63055
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu May 24 15:50:29 2018 +0200

    NEWS: Move security-lated changes before bug list
    
    This matches the practice for previous releases.

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e97bf39fb5423b93a8a4790a01177eb2ffccbf39

commit e97bf39fb5423b93a8a4790a01177eb2ffccbf39
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu May 24 14:41:57 2018 +0200

    Add references to CVE-2018-11236, CVE-2017-18269

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4220a967def932bd946c33a1734ff6a554b3570f

commit 4220a967def932bd946c33a1734ff6a554b3570f
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed May 23 03:59:56 2018 -0700

    Add a test case for [BZ #23196]
    
    	[BZ #23196]
    	* string/test-memcpy.c (do_test1): New function.
    	(test_main): Call it.
    
    (cherry picked from commit ed983107bbc62245b06b99f02e69acf36a0baa3e)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=f079ef9e9336190685ec311eb3fd44a8a5370c2a

commit f079ef9e9336190685ec311eb3fd44a8a5370c2a
Author: Andreas Schwab <schwab@suse.de>
Date:   Thu May 24 14:39:18 2018 +0200

    Don't write beyond destination in __mempcpy_avx512_no_vzeroupper (bug 23196)
    
    When compiled as mempcpy, the return value is the end of the destination
    buffer, thus it cannot be used to refer to the start of it.
    
    (cherry picked from commit 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7b28a36636a16769aa36981eeba4036436d36c10

commit 7b28a36636a16769aa36981eeba4036436d36c10
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue May 15 08:21:11 2018 +0200

    sunrpc: Remove stray exports without --enable-obsolete-rpc [BZ #23166]
    
    This is needed to avoid a warning when linking against libtirpc:
    
    /lib64/libc.so.6: warning: common of `rpc_createerr@@TIRPC_0.3.0' overridden by definition
    /usr/lib64/libtirpc.so: warning: defined here
    
    This ld warning is not enabled by default; -Wl,--warn-common enables it.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    
    (cherry picked from commit 89aacb513eb77549a29df2638913a0f8178cf3f5)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5993d874500e0f8d717c6533713b277fade7a233

commit 5993d874500e0f8d717c6533713b277fade7a233
Author: Rafal Luzynski <digitalfreak@lingonborough.com>
Date:   Wed May 9 03:06:32 2018 +0200

    gd_GB: Fix typo in abbreviated "May" (bug 23152).
    
    	[BZ #23152]
    	* localedata/locales/gd_GB (abmon): Fix typo in May:
    	"Mhàrt" -> "Cèit".  Adjust the comment according to the change.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit bb066cb806dfe55511cf2fb59bf013751152608f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=66f687a7a610e834866eeab1a6cc9e396a096b41

commit 66f687a7a610e834866eeab1a6cc9e396a096b41
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Thu May 10 10:56:25 2018 +0000

    NEWS: add entries for bugs 17343, 20419, 22644, 22786, 22884, 22947, 23005, 23037, 23069, 23137

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0904223cec6cddac5ea7e88b1836b7d52b86d5b2

commit 0904223cec6cddac5ea7e88b1836b7d52b86d5b2
Author: Paul Pluzhnikov <ppluzhnikov@google.com>
Date:   Tue May 8 18:12:41 2018 -0700

    Fix path length overflow in realpath [BZ #22786]
    
    Integer addition overflow may cause stack buffer overflow
    when realpath() input length is close to SSIZE_MAX.
    
    2018-05-09  Paul Pluzhnikov  <ppluzhnikov@google.com>
    
    	[BZ #22786]
    	* stdlib/canonicalize.c (__realpath): Fix overflow in path length
    	computation.
    	* stdlib/Makefile (test-bz22786): New test.
    	* stdlib/test-bz22786.c: New test.
    
    (cherry picked from commit 5460617d1567657621107d895ee2dd83bc1f88f2)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=80fc8dd4937ec2d3c175217e09e69e2125a9f5d8

commit 80fc8dd4937ec2d3c175217e09e69e2125a9f5d8
Author: Paul Pluzhnikov <ppluzhnikov@google.com>
Date:   Sat May 5 18:08:27 2018 -0700

    Fix stack overflow with huge PT_NOTE segment [BZ #20419]
    
    A PT_NOTE in a binary could be arbitratily large, so using alloca
    for it may cause stack overflow.  If the note is larger than
    __MAX_ALLOCA_CUTOFF, use dynamically allocated memory to read it in.
    
    2018-05-05  Paul Pluzhnikov  <ppluzhnikov@google.com>
    
    	[BZ #20419]
    	* elf/dl-load.c (open_verify): Fix stack overflow.
    	* elf/Makefile (tst-big-note): New test.
    	* elf/tst-big-note-lib.S: New.
    	* elf/tst-big-note.c: New.
    
    (cherry picked from commit 0065aaaaae51cd60210ec3a7e13dddd8e01ffe2c)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=34672a317613f76101f37e7dddcf7d793115e2a1

commit 34672a317613f76101f37e7dddcf7d793115e2a1
Author: Stefan Liebler <stli@linux.vnet.ibm.com>
Date:   Fri May 4 10:00:59 2018 +0200

    Fix blocking pthread_join. [BZ #23137]
    
    On s390 (31bit) if glibc is build with -Os, pthread_join sometimes
    blocks indefinitely. This is e.g. observable with
    testcase intl/tst-gettext6.
    
    pthread_join is calling lll_wait_tid(tid), which performs the futex-wait
    syscall in a loop as long as tid != 0 (thread is alive).
    
    On s390 (and build with -Os), tid is loaded from memory before
    comparing against zero and then the tid is loaded a second time
    in order to pass it to the futex-wait-syscall.
    If the thread exits in between, then the futex-wait-syscall is
    called with the value zero and it waits until a futex-wake occurs.
    As the thread is already exited, there won't be a futex-wake.
    
    In lll_wait_tid, the tid is stored to the local variable __tid,
    which is then used as argument for the futex-wait-syscall.
    But unfortunately the compiler is allowed to reload the value
    from memory.
    
    With this patch, the tid is loaded with atomic_load_acquire.
    Then the compiler is not allowed to reload the value for __tid from memory.
    
    ChangeLog:
    
    	[BZ #23137]
    	* sysdeps/nptl/lowlevellock.h (lll_wait_tid):
    	Use atomic_load_acquire to load __tid.
    
    (cherry picked from commit 1660901840dfc9fde6c5720a32f901af6f08f00a)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a6bc03771e48ae9cc5ef2bcc7e632291d8e11138

commit a6bc03771e48ae9cc5ef2bcc7e632291d8e11138
Author: Joseph Myers <joseph@codesourcery.com>
Date:   Tue Apr 24 12:11:35 2018 +0000

    Add PTRACE_SECCOMP_GET_METADATA from Linux 4.16 to sys/ptrace.h.
    
    This patch adds the PTRACE_SECCOMP_GET_METADATA constant from Linux
    4.16 to all relevant sys/ptrace.h files.  A type struct
    __ptrace_seccomp_metadata, analogous to other such types, is also
    added.
    
    Tested for x86_64, and with build-many-glibcs.py.
    
    	* sysdeps/unix/sysv/linux/sys/ptrace.h
    	(PTRACE_SECCOMP_GET_METADATA): New enum value and macro.
    	* sysdeps/unix/sysv/linux/bits/ptrace-shared.h
    	(struct __ptrace_seccomp_metadata): New type.
    	* sysdeps/unix/sysv/linux/aarch64/sys/ptrace.h
    	(PTRACE_SECCOMP_GET_METADATA): Likewise.
    	* sysdeps/unix/sysv/linux/arm/sys/ptrace.h
    	(PTRACE_SECCOMP_GET_METADATA): Likewise.
    	* sysdeps/unix/sysv/linux/ia64/sys/ptrace.h
    	(PTRACE_SECCOMP_GET_METADATA): Likewise.
    	* sysdeps/unix/sysv/linux/powerpc/sys/ptrace.h
    	(PTRACE_SECCOMP_GET_METADATA): Likewise.
    	* sysdeps/unix/sysv/linux/s390/sys/ptrace.h
    	(PTRACE_SECCOMP_GET_METADATA): Likewise.
    	* sysdeps/unix/sysv/linux/sparc/sys/ptrace.h
    	(PTRACE_SECCOMP_GET_METADATA): Likewise.
    	* sysdeps/unix/sysv/linux/tile/sys/ptrace.h
    	(PTRACE_SECCOMP_GET_METADATA): Likewise.
    	* sysdeps/unix/sysv/linux/x86/sys/ptrace.h
    	(PTRACE_SECCOMP_GET_METADATA): Likewise.
    
    (cherry picked from commit 9320ca88a197d3620d3553ccc2d9402d981d7e23)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=06f7d0f59b7c3a60109d655532f0c1e1dcb88557

commit 06f7d0f59b7c3a60109d655532f0c1e1dcb88557
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Apr 9 10:08:07 2018 +0200

    resolv: Fully initialize struct mmsghdr in send_dg [BZ #23037]
    
    (cherry picked from commit 583a27d525ae189bdfaa6784021b92a9a1dae12e)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5507e2bee631494bcc6c020630b15d49eb88b77a

commit 5507e2bee631494bcc6c020630b15d49eb88b77a
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Apr 5 12:52:19 2018 +0200

    manual: Various fixes to the mbstouwcs example, and mbrtowc update
    
    The example did not work because the null byte was not converted, and
    mbrtowc was called with a zero-length input string.  This results in a
    (size_t) -2 return value, so the function always returns NULL.
    
    The size computation for the heap allocation of the result was
    incorrect because it did not deal with integer overflow.
    
    Error checking was missing, and the allocated memory was not freed on
    error paths.  All error returns now set errno.  (Note that there is an
    assumption that free does not clobber errno.)
    
    The slightly unportable comparision against (size_t) -2 to catch both
    (size_t) -1 and (size_t) -2 return values is gone as well.
    
    A null wide character needs to be stored in the result explicitly, to
    terminate it.
    
    The description in the manual is updated to deal with these finer
    points.  The (size_t) -2 behavior (consuming the input bytes) matches
    what is specified in ISO C11.
    
    (cherry picked from commit cf138b0c83b3210990b29772e2af5982fb0e3c26)
    (cherry picked from commit 690c3475f1417c99cb0fc69f35d77560c24c1d69)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d587be985e976eda954201a45704172ce283174e

commit d587be985e976eda954201a45704172ce283174e
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Apr 5 12:50:58 2018 +0200

    manual: Move mbstouwcs to an example C file
    
    (cherry picked from commit 0f339252697e6dcfc9e00be6cd8272d4260b90d2)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0d1e9400204e4f7e5329f4a83f7bb0ebafd74d94

commit 0d1e9400204e4f7e5329f4a83f7bb0ebafd74d94
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Tue Apr 3 12:19:20 2018 -0700

    Update RWF_SUPPORTED for Linux kernel 4.16 [BZ #22947]
    
    Add RWF_APPEND to RWF_SUPPORTED to support Linux kernel 4.16.
    
    	[BZ #22947]
    	* bits/uio-ext.h (RWF_APPEND): New.
    	* sysdeps/unix/sysv/linux/bits/uio-ext.h (RWF_APPEND): Likewise.
    	* manual/llio.texi: Document RWF_APPEND.
    	* misc/tst-preadvwritev2-common.c (RWF_APPEND): New.
    	(RWF_SUPPORTED): Add RWF_APPEND.
    
    (cherry picked from commit f2652643d7234c08205b75f527191c2e2b35251f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=9a623f013e029b6166656bb6782d10187c7e1306

commit 9a623f013e029b6166656bb6782d10187c7e1306
Author: Jesse Hathaway <jesse@mbuki-mvuki.org>
Date:   Tue Mar 27 21:17:59 2018 +0000

    getlogin_r: return early when linux sentinel value is set
    
    When there is no login uid Linux sets /proc/self/loginid to the sentinel
    value of, (uid_t) -1. If this is set we can return early and avoid
    needlessly looking up the sentinel value in any configured nss
    databases.
    
    Checked on aarch64-linux-gnu.
    
    	* sysdeps/unix/sysv/linux/getlogin_r.c (__getlogin_r_loginuid): Return
    	early when linux sentinel value is set.
    
    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
    (cherry picked from commit cc8a1620eb97ccddd337d157263c13c57b39ab71)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=91bbc2d059052bd127619bcf58e287809fcb5e87

commit 91bbc2d059052bd127619bcf58e287809fcb5e87
Author: Andreas Schwab <schwab@suse.de>
Date:   Tue Mar 27 12:16:11 2018 +0200

    Fix crash in resolver on memory allocation failure (bug 23005)
    
    (cherry picked from commit f178e59fa5eefbbd37fde040ae8334aa5c857ee1)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=570e56dd2016da6f905018319562b609d3a4988a

commit 570e56dd2016da6f905018319562b609d3a4988a
Author: Joseph Myers <joseph@codesourcery.com>
Date:   Tue Mar 20 18:25:24 2018 +0000

    Fix signed integer overflow in random_r (bug 17343).
    
    Bug 17343 reports that stdlib/random_r.c has code with undefined
    behavior because of signed integer overflow on int32_t.  This patch
    changes the code so that the possibly overflowing computations use
    unsigned arithmetic instead.
    
    Note that the bug report refers to "Most code" in that file.  The
    places changed in this patch are the only ones I found where I think
    such overflow can occur.
    
    Tested for x86_64 and x86.
    
    	[BZ #17343]
    	* stdlib/random_r.c (__random_r): Use unsigned arithmetic for
    	possibly overflowing computations.
    
    (cherry picked from commit 8a07b0c43c46a480da070efd53a2720195e2256f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=388a08e4e05ba8e709ec31eb17f34d6286e873df

commit 388a08e4e05ba8e709ec31eb17f34d6286e873df
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Thu Apr 26 22:21:13 2018 +0200

    Add tst-sigaction.c to test BZ #23069
    
    This simple test uses sigaction to define a signal handler. It then
    uses sigaction again to fetch the information about the same signal
    handler, and check that they are consistent. This is enough to detect
    mismatches between struct kernel_sigaction and the kernel version of
    struct sigaction, like in BZ #23069.
    
    Changelog:
           * signal/tst-sigaction.c: New file to test BZ #23069.
           * signal/Makefile (tests): Fix indentation. Add tst-sigaction.
    
    (cherry picked from commit 7a6f74787132aca8e3809cae8d9e7bc7bfd55ce1)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d0980fb402121d53ecaa8ebf02b3ed5a1aa4092b

commit d0980fb402121d53ecaa8ebf02b3ed5a1aa4092b
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Sat Apr 28 13:13:43 2018 +0200

    RISC-V: fix struct kernel_sigaction to match the kernel version [BZ #23069]
    
    The RISC-V kernel doesn't define SA_RESTORER, hence the kernel version
    of struct sigaction doesn't have the sa_restorer field. The default
    kernel_sigaction.h therefore can't be used.
    
    This patch adds a RISC-V specific version of kernel_sigaction.h to fix
    the issue. This fixes for example the libnih testsuite.
    
    Note that this patch is not needed in master as the bug has been fixed
    by commit b4a5d26d8835 ("linux: Consolidate sigaction implementation").

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=11834e2985afaf724e4dc264c945e29fab8db27a

commit 11834e2985afaf724e4dc264c945e29fab8db27a
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Mar 29 11:42:24 2018 +0200

    Linux i386: tst-bz21269 triggers SIGBUS on some kernels
    
    In addition to SIGSEGV and SIGILL, SIGBUS is also a possible signal
    generated by the kernel.
    
    (cherry picked from commit 4d76d3e59d31aa690f148fc0c95cc0c581aed3e8)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=04ddad91260fbad4c0db9c005056d2d280d9353f

commit 04ddad91260fbad4c0db9c005056d2d280d9353f
Author: Andrew Senkevich <andrew.n.senkevich@gmail.com>
Date:   Fri Mar 23 16:19:45 2018 +0100

    Fix i386 memmove issue (bug 22644).
    
    	[BZ #22644]
    	* sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S: Fixed
    	branch conditions.
    	* string/test-memmove.c (do_test2): New testcase.
    
    (cherry picked from commit cd66c0e584c6d692bc8347b5e72723d02b8a8ada)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5c51e08fc2be944c592216d127ba4d09af17aba7

commit 5c51e08fc2be944c592216d127ba4d09af17aba7
Author: DJ Delorie <dj@redhat.com>
Date:   Fri Feb 23 16:08:08 2018 -0500

    Update ChangeLog for BZ 22884 - riscv fmax/fmin
    
    (cherry picked from commit 7e04eb2932d3126c721ee2bc0d664a5bbea2f41f)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d630d6ca1878ce62596e6b5dc69ce66ca698a9f5

commit d630d6ca1878ce62596e6b5dc69ce66ca698a9f5
Author: Andrew Waterman <andrew@sifive.com>
Date:   Thu Feb 22 14:31:54 2018 -0500

    RISC-V: fmax/fmin: Handle signalling NaNs correctly.
    
    RISC-V's fmax(sNAN,4) returns 4 but glibc expects it to return qNAN.
    
    	* sysdeps/riscv/rvd/s_fmax.c (__fmax): Handle sNaNs correctly.
    	* sysdeps/riscv/rvd/s_fmin.c (__fmin): Likewise.
    	* sysdeps/riscv/rvf/s_fmaxf.c (__fmaxf): Likewise.
    	* sysdeps/riscv/rvf/s_fminf.c (__fminf): Likewise.
    
    (cherry picked from commit fdcc625376505eacb1125a6aeba57501407a30ec)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7e99a36233bb1f07bf0739ce737885c6e6327455

commit 7e99a36233bb1f07bf0739ce737885c6e6327455
Author: DJ Delorie <dj@redhat.com>
Date:   Thu Feb 22 14:28:47 2018 -0500

    RISC-V: Do not initialize $gp in TLS macros.
    
    RISC-V TLS doesn't require GP to be initialized, and doing so breaks
    TLS in a shared object.
    
    (cherry picked from commit 8090720a87e42fddc31396f6126112d4b8014d8e)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=deaa1650c3d9843e622fa8ac37e7c7adc5f54a17

commit deaa1650c3d9843e622fa8ac37e7c7adc5f54a17
Author: Rafal Luzynski <digitalfreak@lingonborough.com>
Date:   Thu Mar 15 03:29:07 2018 +0100

    NEWS: Add entries for bugs: 22848, 22932, 22937, 22963.
    
    Alternative (nominative/genitive) month names have been added to the
    Catalan and Czech locale data and the abbreviated alternative names to
    Catalan and Greek.
    
    (cherry picked from commit c553cd6f7e939ae4ef62b52b3c55fbe76dddecee)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b692351d53711c5d913304ebbd17b6cfa70d5dae

commit b692351d53711c5d913304ebbd17b6cfa70d5dae
Author: Rafal Luzynski <digitalfreak@lingonborough.com>
Date:   Mon Oct 17 22:06:11 2016 +0200

    cs_CZ locale: Add alternative month names (bug 22963).
    
    Add alternative month names, primary month names are genitive now.
    
    	[BZ #22963]
    	* localedata/locales/cs_CZ (mon): Rename to...
    	(alt_mon): This.
    	(mon): Import from CLDR (genitive case).
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 807fee29d2c967e24e3fe05e2182ba53e96e9178)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=111b25997956d561e056dd44aec5e08b89121a41

commit 111b25997956d561e056dd44aec5e08b89121a41
Author: Rafal Luzynski <digitalfreak@lingonborough.com>
Date:   Thu Mar 8 00:45:04 2018 +0100

    Greek (el_CY, el_GR) locales: Introduce ab_alt_mon (bug 22937).
    
    As spotted by GNOME translation team, Greek language has the actually
    visible difference between the abbreviated nominative and the abbreviated
    genitive case for some month names.  Examples:
    
    May:
    
    abbreviated nominative: "Μάι" -> abbreviated genitive: "Μαΐ"
    
    July:
    
    abbreviated nominative: "Ιούν" -> abbreviated genitive: "Ιουλ"
    
    and more month names with similar differences.
    
    Original discussion: https://bugzilla.gnome.org/show_bug.cgi?id=793645#c21
    
    	[BZ #22937]
    	* localedata/locales/el_CY (abmon): Rename to...
    	(ab_alt_mon): This.
    	(abmon): Import from CLDR (abbreviated genitive case).
    	* localedata/locales/el_GR (abmon): Rename to...
    	(ab_alt_mon): This.
    	(abmon): Import from CLDR (abbreviated genitive case).
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit e7155a28ef61f240da156e1cea410b61afca14ad)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c50dad5e2e3b7c0cf1e388d47f692ee26803b20b

commit c50dad5e2e3b7c0cf1e388d47f692ee26803b20b
Author: Rafal Luzynski <digitalfreak@lingonborough.com>
Date:   Thu Mar 8 00:38:18 2018 +0100

    lt_LT locale: Update abbreviated month names (bug 22932).
    
    A GNOME translator asked to use the same abbreviated month names
    as provided by CLDR.  This sounds reasonable.  See the discussion:
    https://bugzilla.gnome.org/show_bug.cgi?id=793645#c27
    
    	[BZ #22932]
    	* localedata/locales/lt_LT (abmon): Synchronize with CLDR.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 71d7b121686f6d91cd5a630dcfb72197b5d8284a)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7f161d38c0d2044f2f73184f023d9af4b52921e9

commit 7f161d38c0d2044f2f73184f023d9af4b52921e9
Author: Robert Buj <robert.buj@gmail.com>
Date:   Tue Mar 6 22:51:29 2018 +0100

    ca_ES locale: Update LC_TIME (bug 22848).
    
    Add/fix alternative month names, long & short formats, am_pm,
    abday settings, and improve indentation for Catalan.
    
    	[BZ #22848]
    	* localedata/locales/ca_ES (abmon): Rename to...
    	(ab_alt_mon): This, then synchronize with CLDR (nominative case).
    	(mon): Rename to...
    	(alt_mon): This.
    	(abmon): Import from CLDR (genitive case, month names preceded by
    	"de" or "d’").
    	(mon): Likewise.
    	(abday): Synchronize with CLDR.
    	(d_t_fmt): Likewise.
    	(d_fmt): Likewise.
    	(am_pm): Likewise.
    
    	(LC_TIME): Improve indentation.
    	(LC_TELEPHONE): Likewise.
    	(LC_NAME): Likewise.
    	(LC_ADDRESS): Likewise.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit a00bffe8b531693d3b26c1e87afe4b9eac84474c)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5a245488c51d9e524a0dc9590dc634ed350333bc

commit 5a245488c51d9e524a0dc9590dc634ed350333bc
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Mon Mar 12 13:24:46 2018 +0000

    Update translations from the Translation Project
    
    * po/pt_BR.po: Update translations.
    
    (cherry picked from commit 778f1974863d63e858b6d0105e41d6f0c30732d3)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=faa8fc12a7d97cf69fe85405957f3c5448840e2b

commit faa8fc12a7d97cf69fe85405957f3c5448840e2b
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Nov 17 16:04:29 2017 -0200

    i386: Fix i386 sigaction sa_restorer initialization (BZ#21269)
    
    This patch fixes the i386 sa_restorer field initialization for sigaction
    syscall for kernel with vDSO.  As described in bug report, i386 Linux
    (and compat on x86_64) interprets SA_RESTORER clear with nonzero
    sa_restorer as a request for stack switching if the SS segment is 'funny'.
    This means that anything that tries to mix glibc's signal handling with
    segmentation (for instance through modify_ldt syscall) is randomly broken
    depending on what values lands in sa_restorer.
    
    The testcase added  is based on Linux test tools/testing/selftests/x86/ldt_gdt.c,
    more specifically in do_multicpu_tests function.  The main changes are:
    
      - C11 atomics instead of plain access.
    
      - Remove x86_64 support which simplifies the syscall handling and fallbacks.
    
      - Replicate only the test required to trigger the issue.
    
    Checked on i686-linux-gnu.
    
    	[BZ #21269]
    	* sysdeps/unix/sysv/linux/i386/Makefile (tests): Add tst-bz21269.
    	* sysdeps/unix/sysv/linux/i386/sigaction.c (SET_SA_RESTORER): Clear
    	sa_restorer for vDSO case.
    	* sysdeps/unix/sysv/linux/i386/tst-bz21269.c: New file.
    
    (cherry picked from commit 68448be208ee06e76665918b37b0a57e3e00c8b4)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=de736b2c5b3658049a4b78a34441b915431c0993

commit de736b2c5b3658049a4b78a34441b915431c0993
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Fri Mar 2 23:07:14 2018 +0100

    Fix multiple definitions of __nss_*_database (bug 22918)
    
    (cherry picked from commit eaf6753f8aac33a36deb98c1031d1bad7b593d2d)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=727e0f42a5ede3d31ad46fd40529845e186ac5e0

commit 727e0f42a5ede3d31ad46fd40529845e186ac5e0
Author: DJ Delorie <dj@redhat.com>
Date:   Thu Mar 1 23:20:45 2018 -0500

    [BZ #22342] Fix netgroup cache keys.
    
    Unlike other nscd caches, the netgroup cache contains two types of
    records - those for "iterate through a netgroup" (i.e. setnetgrent())
    and those for "is this user in this netgroup" (i.e. innetgr()),
    i.e. full and partial records.  The timeout code assumes these records
    have the same key for the group name, so that the collection of records
    that is "this netgroup" can be expired as a unit.
    
    However, the keys are not the same, as the in-netgroup key is generated
    by nscd rather than being passed to it from elsewhere, and is generated
    without the trailing NUL.  All other keys have the trailing NUL, and as
    noted in the linked BZ, debug statements confirm that two keys for the
    same netgroup are added to the cache with two different lengths.
    
    The result of this is that as records in the cache expire, the purge
    code only cleans out one of the two types of entries, resulting in
    stale, possibly incorrect, and possibly inconsistent cache data.
    
    The patch simply includes the existing NUL in the computation for the
    key length ('key' points to the char after the NUL, and 'group' to the
    first char of the group, so 'key-group' includes the first char to the
    NUL, inclusive).
    
    	[BZ #22342]
    	* nscd/netgroupcache.c (addinnetgrX): Include trailing NUL in
    	key value.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 1c81d55fc4b07b51adf68558ba74ce975153e580)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=115693040b3e6a342bd2eac31aa469cbc1764c76

commit 115693040b3e6a342bd2eac31aa469cbc1764c76
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Sat Feb 10 23:19:32 2018 +0000

    linux/powerpc: sync sys/ptrace.h with Linux 4.15 [BZ #22433, #22807]
    
    Tested with strace.
    
    * sysdeps/unix/sysv/linux/powerpc/sys/ptrace.h (__ptrace_request): Add
    PTRACE_GETREGS, PTRACE_SETREGS, PTRACE_GETFPREGS, PTRACE_SETFPREGS,
    PTRACE_GETVRREGS, PTRACE_SETVRREGS, PTRACE_GETEVRREGS,
    PTRACE_SETEVRREGS, PTRACE_GETREGS64, PTRACE_SETREGS64,
    PTRACE_GET_DEBUGREG, PTRACE_SET_DEBUGREG, PTRACE_GETVSRREGS,
    PTRACE_SETVSRREGS, and PTRACE_SINGLEBLOCK.
    
    (cherry picked from commit f5f473a9d0e8fdbede858fa1ef0d01d12142367b)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=75c302f5fabd722c1c1d5c7d8b2174f1554f6159

commit 75c302f5fabd722c1c1d5c7d8b2174f1554f6159
Author: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com>
Date:   Mon Feb 26 10:40:17 2018 -0300

    powerpc: Undefine Linux ptrace macros that conflict with __ptrace_request
    
    Linux ptrace headers define macros whose tokens conflict with the
    constants of enum __ptrace_request causing build errors when
    asm/ptrace.h or linux/ptrace.h are included before sys/ptrace.h.
    
    	* sysdeps/unix/sysv/linux/powerpc/sys/ptrace.h: Undefine Linux
    	macros used in __ptrace_request.
    
    Signed-off-by: Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com>
    (cherry picked from commit 398c6fddafcee2dc4c2b2574417a2d0cfccaeec1)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d6a002b866533c3a04cdcf71e1e9e8d340369a24

commit d6a002b866533c3a04cdcf71e1e9e8d340369a24
Author: Mike FABIAN <mfabian@redhat.com>
Date:   Mon Feb 19 21:59:30 2018 +0100

    Add missing “reorder-end” in LC_COLLATE of et_EE [BZ #22517]
    
    	[BZ #22517]
    	* localedata/locales/et_EE (LC_COLLATE): add missing “reorder-end”
    
    (cherry picked from commit 7ec5f9465e732e668d0dc94ac078ba68056d6d0a)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=147d851e7771e5629c5bd4ba1c9faaa67382aaad

commit 147d851e7771e5629c5bd4ba1c9faaa67382aaad
Author: Rical Jasan <ricaljasan@pacific.net>
Date:   Wed Feb 21 04:00:03 2018 -0800

    Fix a typo in a comment.
    
    	* io/fcntl.h: Fix a typo in a comment.
    
    (cherry picked from commit 0d217f4082473e5fdca87831df928dd525a02f72)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c05e47a2a96536fa21b65f5bf89cb8aea5329e9f

commit c05e47a2a96536fa21b65f5bf89cb8aea5329e9f
Author: Rical Jasan <ricaljasan@pacific.net>
Date:   Mon Feb 19 04:32:35 2018 -0800

    manual: Update the _ISOC99_SOURCE description.
    
    The current description refers to ISO C99 not being widely adopted,
    which it is believed to be now.
    
    	* manual/creature.texi (_ISOC99_SOURCE): Update the dated
    	description.
    
    (cherry picked from commit e8d190b9ed81a1b342f0969bc2b5505403183bce)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=9508cd18693431441cbe3cc81aff70bca36d5252

commit 9508cd18693431441cbe3cc81aff70bca36d5252
Author: Rical Jasan <ricaljasan@pacific.net>
Date:   Mon Feb 19 03:30:06 2018 -0800

    manual: Document missing feature test macros.
    
    Several feature test macros are documented in features.h but absent in
    the manual, and some documented macros accept undocumented values.
    This commit updates the manual to mention all the accepted macros,
    along with any values that hold special meaning.
    
    	* manual/creature.texi (_POSIX_C_SOURCE): Document special
    	values of 199606L, 200112L, and 200809L.
    	(_XOPEN_SOURCE): Document special values of 600 and 700.
    	(_ISOC11_SOURCE): Document macro.
    	(_ATFILE_SOURCE): Likewise.
    	(_FORTIFY_SOURCE): Likewise.
    
    (cherry picked from commit 6a3962c4a408e8cbc305d2433711196107374e89)
    (cherry picked from commit da81ae645d8ee89052f109c814a68a9489f562e6)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=50955ed038f2b360b2376099cb08c1f6479cf7e0

commit 50955ed038f2b360b2376099cb08c1f6479cf7e0
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Thu Mar 8 23:30:56 2018 +0000

    NEWS: add entries for bugs 22919 and 22926

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=9df5f71202294d36825efb8dbd8f14f56b6cdd3d

commit 9df5f71202294d36825efb8dbd8f14f56b6cdd3d
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Fri Mar 9 00:14:27 2018 +0100

    sparc32: Add nop before __startcontext to stop unwinding [BZ #22919]
    
    On sparc32 tst-makecontext fails, as backtrace called within a context
    created by makecontext to yield infinite backtrace.
    
    Fix that the same way than nios2 by adding a nop just before
    __startcontext. This is needed as otherwise FDE lookup just repeatedly
    finds __setcontext's FDE in an infinite loop, due to the convention of
    using 'address - 1' for FDE lookup.
    
    Changelog:
    	[BZ #22919]
    	* sysdeps/unix/sysv/linux/sparc/sparc32/setcontext.S (__startcontext):
    	Add nop before __startcontext, add explaining comments.
    
    (cherry picked from commit 9aa5c222b9e0409143410a02b6364a3b25dbf028)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3373d567d8778c182a087769a49644d600c49dd7

commit 3373d567d8778c182a087769a49644d600c49dd7
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Mon Mar 5 14:46:24 2018 -0300

    powerpc: Fix TLE build for SPE (BZ #22926)
    
    Some SPE opcodes clashes with some recent PowerISA opcodes and
    until recently gas did not complain about it.  However binutils
    recently changed it and now VLE configured gas does not support to
    assembler some instruction that might class with VLE (HTM for
    instance).  It also does not help that glibc build hardware lock
    elision support as default (regardless of assembler support).
    
    Although runtime will not actually enables TLE on SPE hardware
    (since kernel will not advertise it), I see little advantage on
    adding HTM support on SPE built glibc.  SPE uses an incompatible
    ABI which does not allow share the same build with default
    powerpc and HTM code slows down SPE without any benefict.
    
    This patch fixes it by only building HTM when SPE configuration
    is not used.
    
    Checked with a powerpc-linux-gnuspe build. I also did some sniff
    tests on a e500 hardware without any issue.
    
    	[BZ #22926]
    	* sysdeps/powerpc/powerpc32/sysdep.h (ABORT_TRANSACTION_IMPL): Define
    	empty for __SPE__.
    	* sysdeps/powerpc/sysdep.h (ABORT_TRANSACTION): Likewise.
    	* sysdeps/unix/sysv/linux/powerpc/elision-lock.c (__lll_lock_elision):
    	Do not build hardware transactional code for __SPE__.
    	* sysdeps/unix/sysv/linux/powerpc/elision-trylock.c
    	(__lll_trylock_elision): Likewise.
    	* sysdeps/unix/sysv/linux/powerpc/elision-unlock.c
    	(__lll_unlock_elision): Likewise.
    
    Cherry-pick from e921c89e01389161c036ec09112da6e18aeaa688.

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3e95a3edfc573c5be815e4ca043d667b8a2d3d51

commit 3e95a3edfc573c5be815e4ca043d667b8a2d3d51
Author: Rical Jasan <ricaljasan@pacific.net>
Date:   Fri Feb 16 08:47:20 2018 -0800

    manual: Improve documentation of get_current_dir_name. [BZ #6889]
    
    This is a minor rewording to clarify the behaviour of
    get_current_dir_name.  Additionally, the @vindex is moved above the
    @deftypefun so that following links give a better result with regard
    to context.
    
    	[BZ #6889]
    	* manual/filesys.texi (get_current_dir_name): Clarify
    	behaviour.
    
    (cherry picked from commit 7d15ef84f50a80cb170f8ce3457010f59e221cb8)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1641c5840fcbb10be1aa4e22d93e813c1f955571

commit 1641c5840fcbb10be1aa4e22d93e813c1f955571
Author: Rical Jasan <ricaljasan@pacific.net>
Date:   Fri Feb 16 08:21:47 2018 -0800

    manual: Fix a syntax error.
    
    The opening parenthesis for function arguments in an @deftypefun need
    to be separated from the function name.  This isn't just a matter of
    the GNU coding style---it causes the "(void" (in this case) to be
    rendered as a part of the function name, causing a visual defect, and
    also results in a warning to the following effect during `make pdf':
    
      Warning: unbalanced parentheses in @def...)
    
    	* manual/platform.texi (__riscv_flush_icache): Fix @deftypefun
    	syntax.
    
    (cherry picked from commit 16efad5171ac1ac2c8728405f2703045f08c494b)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c87a0f31c7d992aa1a95cb3f10e3e6e7d6f30279

commit c87a0f31c7d992aa1a95cb3f10e3e6e7d6f30279
Author: Rical Jasan <ricaljasan@pacific.net>
Date:   Wed Jan 24 01:03:38 2018 -0800

    manual: Fix Texinfo warnings about improper node names.
    
    A number of cross-references to the GCC info manual cause Texinfo
    warnings; e.g.:
    
      ./creature.texi:11: warning: @xref node name should not contain `.'
    
    This is due to "gcc.info" being used in the INFO-FILE-NAME (fourth)
    argument.  Changing it to "gcc" removes these warnings.  (Manually
    confirmed equivalent behaviour for make info, html, and pdf.)
    
    	* manual/creature.texi: Convert references to gcc.info to gcc.
    	* manual/stdio.texi: Likewise.
    	* manual/string.texi: Likewise.
    
    (cherry picked from commit 1f6676d7da1b7c864e9a5d59fe9162a88bd21952)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e633191c3faa6505ba540a530ceedc72d8742f5d

commit e633191c3faa6505ba540a530ceedc72d8742f5d
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Sun Feb 18 18:23:14 2018 +0100

    Fix posix/tst-glob_lstat_compat on alpha [BZ #22818]
    
    The tst-glob_lstat_compat test needs to run tests on the previous
    version of glob. On alpha, there are three versions of glob, GLIBC_2.0,
    GLIBC_2.1 and GLIBC_2.27, while on other architectures there are only
    the GLIBC_2.0 and GLIBC_2.27 version. Therefore on alpha the previous
    version is GLIBC_2.1 and not GLIBC_2.0.
    
    Changelog:
    	[BZ #22818]
    	* posix/tst-glob_lstat_compat.c [__alpha__] (glob): Access
    	the GLIBC_2.1 version.
    
    (cherry picked from commit f8d79582896c52cc2b50bdd030a3ec27ef23b587)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=cbd879419016a46326585f7e71b8358c4e2bd01a

commit cbd879419016a46326585f7e71b8358c4e2bd01a
Author: Sean McKean <smckean83@gmail.com>
Date:   Fri Feb 2 11:59:31 2018 +0100

    time: Reference CLOCKS_PER_SEC in clock comment [BZ #22735]
    
    (cherry picked from commit 09e56b9e18f987105e39768f907db800e9330930)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=95cd1f5ef1eb88bce454249ada22a69abfb1509e

commit 95cd1f5ef1eb88bce454249ada22a69abfb1509e
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Fri Dec 29 23:19:32 2017 +0000

    linux/aarch64: sync sys/ptrace.h with Linux 4.15 [BZ #22433]
    
    Remove compat-specific constants that were never exported by kernel
    headers under these names.  Before linux commit v3.7-rc1~16^2~1 they
    were exported with COMPAT_ prefix, and since that commit they are not
    exported at all.
    
    * sysdeps/unix/sysv/linux/aarch64/sys/ptrace.h (__ptrace_request):
    Remove arm-specific PTRACE_GET_THREAD_AREA, PTRACE_GETHBPREGS,
    and PTRACE_SETHBPREGS.
    
    (cherry picked from commit 2fd4bbaa1446f1be700e10c526cf585a796c4991)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d56ea9f2dcbe99517477d821639fc233c158288c

commit d56ea9f2dcbe99517477d821639fc233c158288c
Author: Dmitry V. Levin <ldv@altlinux.org>
Date:   Tue Feb 6 09:31:30 2018 +0000

    NEWS: add an entry for bug 22827

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=071630d89e28b427158334f0f0a115f32b4fa728

commit 071630d89e28b427158334f0f0a115f32b4fa728
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Wed Feb 14 14:03:13 2018 -0200

    Update SH libm-tests-ulps
    
    	* sysdeps/sh/libm-test-ulps: Update.
    
    Signed-off-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=82c4b147b782db578a5fe0e928c35869e196ddcc

commit 82c4b147b782db578a5fe0e928c35869e196ddcc
Author: DJ Delorie <dj@redhat.com>
Date:   Fri Feb 9 18:37:15 2018 -0500

    [RISC-V] Fix parsing flags in ELF64 files.
    
    When ldconfig reads Elf64 files to determine the ABI, it used the
    Elf32 type, so read the wrong location, and stored the wrong ABI
    type in the cache, making the cache useless.  This patch uses
    an Elf64 type for Elf64 objects instead.
    
    Note that pre-patch caches might need to be manually removed and
    regenerated to get the correct ABIs stored.
    
    	[BZ #22827]
    	* sysdeps/unix/sysv/linux/riscv/readelflib.c (process_elf_file): Use
    	64-bit ELF type for 64-bit ELF objects.
    
    (cherry picked from commit 6a1ff640dcec04905d8518983ad6252d38b7a733)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                          |  338 +
 NEWS                                               |   50 +
 bits/uio-ext.h                                     |    1 +
 elf/Makefile                                       |    9 +-
 elf/dl-load.c                                      |   21 +-
 elf/tst-big-note-lib.S                             |   26 +
 elf/tst-big-note.c                                 |   26 +
 include/rpc/clnt.h                                 |    1 +
 include/rpc/svc.h                                  |    4 +
 io/fcntl.h                                         |    2 +-
 localedata/locales/ca_ES                           |  111 +-
 localedata/locales/cs_CZ                           |   15 +-
 localedata/locales/el_CY                           |    8 +-
 localedata/locales/el_GR                           |    8 +-
 localedata/locales/et_EE                           |    2 +
 localedata/locales/gd_GB                           |    4 +-
 localedata/locales/lt_LT                           |   12 +-
 manual/charset.texi                                |   94 +-
 manual/creature.texi                               |   48 +-
 manual/examples/mbstouwcs.c                        |   53 +
 manual/filesys.texi                                |   17 +-
 manual/llio.texi                                   |    3 +
 manual/platform.texi                               |    2 +-
 manual/stdio.texi                                  |    8 +-
 manual/string.texi                                 |    2 +-
 misc/tst-preadvwritev2-common.c                    |    6 +-
 nscd/gai.c                                         |    3 +
 nscd/netgroupcache.c                               |    2 +-
 nss/nsswitch.c                                     |    2 +-
 nss/nsswitch.h                                     |    8 +-
 po/pt_BR.po                                        | 9194 +++++++++++++-------
 posix/tst-glob_lstat_compat.c                      |    7 +
 posix/tst-rfc3484-2.c                              |    1 +
 posix/tst-rfc3484-3.c                              |    1 +
 posix/tst-rfc3484.c                                |    1 +
 resolv/res_send.c                                  |   45 +-
 signal/Makefile                                    |    2 +-
 signal/tst-sigaction.c                             |   56 +
 stdlib/Makefile                                    |    2 +-
 stdlib/canonicalize.c                              |    2 +-
 stdlib/random_r.c                                  |    9 +-
 stdlib/test-bz22786.c                              |   90 +
 string/test-memcpy.c                               |   47 +
 string/test-memmove.c                              |   58 +
 string/test-mempcpy.c                              |    1 +
 sunrpc/rpc_common.c                                |   15 +-
 sunrpc/svcauth_des.c                               |   13 +-
 .../i386/i686/multiarch/memcpy-sse2-unaligned.S    |   12 +-
 sysdeps/nptl/lowlevellock.h                        |   13 +-
 sysdeps/powerpc/powerpc32/sysdep.h                 |    2 +-
 sysdeps/powerpc/sysdep.h                           |    2 +-
 sysdeps/riscv/rvd/s_fmax.c                         |   11 +-
 sysdeps/riscv/rvd/s_fmin.c                         |   11 +-
 sysdeps/riscv/rvf/s_fmaxf.c                        |   11 +-
 sysdeps/riscv/rvf/s_fminf.c                        |   11 +-
 sysdeps/riscv/tls-macros.h                         |   20 +-
 sysdeps/sh/libm-test-ulps                          |  493 +-
 sysdeps/unix/sysv/linux/aarch64/sys/ptrace.h       |   14 +-
 sysdeps/unix/sysv/linux/arm/sys/ptrace.h           |    6 +-
 sysdeps/unix/sysv/linux/bits/ptrace-shared.h       |    7 +
 sysdeps/unix/sysv/linux/bits/uio-ext.h             |    1 +
 sysdeps/unix/sysv/linux/getlogin_r.c               |    9 +
 sysdeps/unix/sysv/linux/i386/Makefile              |    3 +
 sysdeps/unix/sysv/linux/i386/sigaction.c           |    3 +-
 sysdeps/unix/sysv/linux/i386/tst-bz21269.c         |  235 +
 sysdeps/unix/sysv/linux/ia64/sys/ptrace.h          |    6 +-
 sysdeps/unix/sysv/linux/powerpc/elision-lock.c     |    2 +
 sysdeps/unix/sysv/linux/powerpc/elision-trylock.c  |    2 +
 sysdeps/unix/sysv/linux/powerpc/elision-unlock.c   |    4 +
 sysdeps/unix/sysv/linux/powerpc/sys/ptrace.h       |  112 +-
 sysdeps/unix/sysv/linux/riscv/kernel_sigaction.h   |    7 +
 sysdeps/unix/sysv/linux/riscv/readelflib.c         |    3 +-
 sysdeps/unix/sysv/linux/s390/sys/ptrace.h          |    5 +
 sysdeps/unix/sysv/linux/sparc/sparc32/setcontext.S |   13 +
 sysdeps/unix/sysv/linux/sparc/sys/ptrace.h         |    6 +-
 sysdeps/unix/sysv/linux/sys/ptrace.h               |    6 +-
 sysdeps/unix/sysv/linux/tile/sys/ptrace.h          |    6 +-
 sysdeps/unix/sysv/linux/x86/sys/ptrace.h           |    6 +-
 .../multiarch/memmove-avx512-no-vzeroupper.S       |    5 +-
 time/time.h                                        |    2 +-
 80 files changed, 8068 insertions(+), 3411 deletions(-)
 create mode 100644 elf/tst-big-note-lib.S
 create mode 100644 elf/tst-big-note.c
 create mode 100644 manual/examples/mbstouwcs.c
 create mode 100644 signal/tst-sigaction.c
 create mode 100644 stdlib/test-bz22786.c
 create mode 100644 sysdeps/unix/sysv/linux/i386/tst-bz21269.c
 create mode 100644 sysdeps/unix/sysv/linux/riscv/kernel_sigaction.h