Bug 24027 - glibc: realloc() ncopies 32-bit integer overflow
Summary: glibc: realloc() ncopies 32-bit integer overflow
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: malloc (show other bugs)
Version: 2.23
: P2 normal
Target Milestone: 2.29
Assignee: Florian Weimer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-12-22 20:03 UTC by Niklas Hambüchen
Modified: 2019-01-31 17:13 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments
Repro for the overflow (1.36 KB, text/plain)
2018-12-22 20:05 UTC, Niklas Hambüchen
Details
Patch fixing the issue (1.10 KB, patch)
2018-12-22 20:05 UTC, Niklas Hambüchen
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Niklas Hambüchen 2018-12-22 20:03:45 UTC
I found an integer overflow bug in glibc (2002-current) realloc().
Quoting from the attachments (repro and patch):

    The overflow happens when a malloc(>= 32 GiB) is increased via realloc()
    (and M_MMAP_THRESHOLD is set very large or mmap() based allocation
    is disabled entirely by setting M_MMAP_MAX=0).

    Then only the first couple bytes of the buffer are copied,
    potentially leaving the majority of the returned buffer with
    unititialised memory instead of the original malloc()ed buffer's
    contents.
    This may turn into a security problem if you rely on realloc()
    preserving the contents you wrote into the buffer after malloc().

Due to the conditions (large allocation and disabling of mmap()) I expect that only few people are affected by this right now, but it can happen to those with large boxes that use glibc's tuning facilities.

secalert@redhat.com (who responded promptly, nice) agrees that the likelihood of this being exploited currently is low and has consequently lifted the embargo.

I have attached

* a reproduction (realloc-ncopies-overflow.c)
* a patch (malloc-Fix-realloc-integer-overflow.patch)

which contain more details.

The overflow happens at
  https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blob;f=malloc/malloc.c;h=e247c77b7d4de26e0f2fbec16e352889bac3781b;hb=3c03baca37fdcb52c3881e653ca392bba7a99c2b#l4582
which is

    unsigned int ncopies = (size_t) copysize / 8;

To see the non-copying code path taken in the repro, you can insert a debug print in this branch:
  https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blob;f=malloc/malloc.c;h=e247c77b7d4de26e0f2fbec16e352889bac3781b;hb=3c03baca37fdcb52c3881e653ca392bba7a99c2b#l4589

This bug originates in tcmalloc2 from http://malloc.de, from which glibc's current malloc implementation was taken, and tcmalloc2 also continues to have this issue.
I expect that all malloc implementations in the wild that are based on tcmalloc2 have this problem.

Have a nice day,
Niklas


PS:

Personally I'm a bit sad that ~20 years old code we all depend on has so obvious bugs.

I found this issue after finding that all 3 glibc malloc memory use info functions (malloc_stats(), mallinfo() and malloc_info()) are bugged and report completely wrong numbers (bug 24026, bug 21556).

For malloc_stats() it was an integer overflow due to `unsigned int` being used for counting bytes.
It is very well known among programmers for decades that `unsigned int` is not the right type for buffer lengths.
At that point, I just searched for "unsigned int" in malloc.c to see if there are any similar problems, and found this realloc() bug within a minute.

It seems nobody does in practice read the code of fundamental components running on billions of devices.
Comment 1 Niklas Hambüchen 2018-12-22 20:05:21 UTC
Created attachment 11488 [details]
Repro for the overflow
Comment 2 Niklas Hambüchen 2018-12-22 20:05:55 UTC
Created attachment 11489 [details]
Patch fixing the issue
Comment 3 Sourceware Commits 2018-12-31 21:53:06 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84 (commit)
      from  0b9c84906f653978fb8768c7ebd0ee14a47e662e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84

commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84
Author: Florian Weimer <fw@deneb.enyo.de>
Date:   Mon Dec 31 22:04:36 2018 +0100

    malloc: Always call memcpy in _int_realloc [BZ #24027]
    
    This commit removes the custom memcpy implementation from _int_realloc
    for small chunk sizes.  The ncopies variable has the wrong type, and
    an integer wraparound could cause the existing code to copy too few
    elements (leaving the new memory region mostly uninitialized).
    Therefore, removing this code fixes bug 24027.

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog       |    7 +++++++
 malloc/malloc.c |   43 +------------------------------------------
 2 files changed, 8 insertions(+), 42 deletions(-)
Comment 4 jsm-csl@polyomino.org.uk 2018-12-31 23:31:23 UTC
If the commit fixes the bug, please resolve it as FIXED with target 
milestone set.
Comment 5 Sourceware Commits 2019-01-01 09:47:02 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.24/master has been updated
       via  22b7478755c07f4741db85d14fc2b57837078ca6 (commit)
      from  fcd316654a4510281fff32194b3b9f90e3dfab83 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=22b7478755c07f4741db85d14fc2b57837078ca6

commit 22b7478755c07f4741db85d14fc2b57837078ca6
Author: Florian Weimer <fw@deneb.enyo.de>
Date:   Mon Dec 31 22:04:36 2018 +0100

    malloc: Always call memcpy in _int_realloc [BZ #24027]
    
    This commit removes the custom memcpy implementation from _int_realloc
    for small chunk sizes.  The ncopies variable has the wrong type, and
    an integer wraparound could cause the existing code to copy too few
    elements (leaving the new memory region mostly uninitialized).
    Therefore, removing this code fixes bug 24027.
    
    (cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog       |    7 +++++++
 NEWS            |    1 +
 malloc/malloc.c |   43 +------------------------------------------
 3 files changed, 9 insertions(+), 42 deletions(-)
Comment 6 Sourceware Commits 2019-01-01 09:47:43 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.28/master has been updated
       via  8f83d095fabf9e3e9e23023a010e50a21810d918 (commit)
      from  69b914a99e24da875f9f4f2449ec9a6126ac3bc2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8f83d095fabf9e3e9e23023a010e50a21810d918

commit 8f83d095fabf9e3e9e23023a010e50a21810d918
Author: Florian Weimer <fw@deneb.enyo.de>
Date:   Mon Dec 31 22:04:36 2018 +0100

    malloc: Always call memcpy in _int_realloc [BZ #24027]
    
    This commit removes the custom memcpy implementation from _int_realloc
    for small chunk sizes.  The ncopies variable has the wrong type, and
    an integer wraparound could cause the existing code to copy too few
    elements (leaving the new memory region mostly uninitialized).
    Therefore, removing this code fixes bug 24027.
    
    (cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog       |    7 +++++++
 NEWS            |    1 +
 malloc/malloc.c |   43 +------------------------------------------
 3 files changed, 9 insertions(+), 42 deletions(-)
Comment 7 Sourceware Commits 2019-01-01 10:06:23 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.25/master has been updated
       via  6b95c49d8e2b0bea8b2edcf13827e37e477fb19e (commit)
      from  7118ba34931d27f538c71c1cd355866f8db83f4e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6b95c49d8e2b0bea8b2edcf13827e37e477fb19e

commit 6b95c49d8e2b0bea8b2edcf13827e37e477fb19e
Author: Florian Weimer <fw@deneb.enyo.de>
Date:   Mon Dec 31 22:04:36 2018 +0100

    malloc: Always call memcpy in _int_realloc [BZ #24027]
    
    This commit removes the custom memcpy implementation from _int_realloc
    for small chunk sizes.  The ncopies variable has the wrong type, and
    an integer wraparound could cause the existing code to copy too few
    elements (leaving the new memory region mostly uninitialized).
    Therefore, removing this code fixes bug 24027.
    
    (cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog       |    7 +++++++
 NEWS            |    1 +
 malloc/malloc.c |   43 +------------------------------------------
 3 files changed, 9 insertions(+), 42 deletions(-)
Comment 8 Sourceware Commits 2019-01-01 10:07:09 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.27/master has been updated
       via  3981fc3453641368d2edbe480e7089dc9abf6555 (commit)
      from  f6d0e8c36f02b387d33f2cc58c7cb204f201d92e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3981fc3453641368d2edbe480e7089dc9abf6555

commit 3981fc3453641368d2edbe480e7089dc9abf6555
Author: Florian Weimer <fw@deneb.enyo.de>
Date:   Mon Dec 31 22:04:36 2018 +0100

    malloc: Always call memcpy in _int_realloc [BZ #24027]
    
    This commit removes the custom memcpy implementation from _int_realloc
    for small chunk sizes.  The ncopies variable has the wrong type, and
    an integer wraparound could cause the existing code to copy too few
    elements (leaving the new memory region mostly uninitialized).
    Therefore, removing this code fixes bug 24027.
    
    (cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog       |    7 +++++++
 NEWS            |    1 +
 malloc/malloc.c |   43 +------------------------------------------
 3 files changed, 9 insertions(+), 42 deletions(-)
Comment 9 Sourceware Commits 2019-01-01 10:22:27 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.26/master has been updated
       via  94417f6c26d6e6a2f0728b8e2cdacfb939689bce (commit)
      from  a0bc5dd3bed4b04814047265b3bcead7ab973b87 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=94417f6c26d6e6a2f0728b8e2cdacfb939689bce

commit 94417f6c26d6e6a2f0728b8e2cdacfb939689bce
Author: Florian Weimer <fw@deneb.enyo.de>
Date:   Mon Dec 31 22:04:36 2018 +0100

    malloc: Always call memcpy in _int_realloc [BZ #24027]
    
    This commit removes the custom memcpy implementation from _int_realloc
    for small chunk sizes.  The ncopies variable has the wrong type, and
    an integer wraparound could cause the existing code to copy too few
    elements (leaving the new memory region mostly uninitialized).
    Therefore, removing this code fixes bug 24027.
    
    (cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog       |    7 +++++++
 NEWS            |    1 +
 malloc/malloc.c |   43 +------------------------------------------
 3 files changed, 9 insertions(+), 42 deletions(-)
Comment 10 Florian Weimer 2019-01-02 07:34:42 UTC
Fixed in glibc 2.29.

Flagging as security-, per the discussion in <https://sourceware.org/ml/libc-alpha/2018-12/msg01085.html>.
Comment 11 Sourceware Commits 2019-01-31 17:13:45 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The annotated tag, glibc-2.29 has been created
        at  e7c9e41bb2407b0150997b382b49a5f3bb579bf9 (tag)
   tagging  56c86f5dd516284558e106d04b92875d5b623b7a (commit)
  replaces  glibc-2.28.9000
 tagged by  Siddhesh Poyarekar
        on  Thu Jan 31 22:24:07 2019 +0530

- Log -----------------------------------------------------------------
The GNU C Library
=================

The GNU C Library version 2.29 is now available.

The GNU C Library is used as *the* C library in the GNU system and
in GNU/Linux systems, as well as many other systems that use Linux
as the kernel.

The GNU C Library is primarily designed to be a portable
and high performance C library.  It follows all relevant
standards including ISO C11 and POSIX.1-2008.  It is also
internationalized and has one of the most complete
internationalization interfaces known.

The GNU C Library webpage is at http://www.gnu.org/software/libc/

Packages for the 2.29 release may be downloaded from:
        http://ftpmirror.gnu.org/libc/
        http://ftp.gnu.org/gnu/libc/

The mirror list is at http://www.gnu.org/order/ftp.html

NEWS for version 2.29
====================

* The getcpu wrapper function has been added, which returns the currently
  used CPU and NUMA node.  This function is Linux-specific.

* A new convenience target has been added for distribution maintainers
  to build and install all locales as directories with files.  The new
  target is run by issuing the following command in your build tree:
  'make localedata/install-locale-files', with an optional DESTDIR
  to set the install root if you wish to install into a non-default
  configured location.

* Optimized generic exp, exp2, log, log2, pow, sinf, cosf, sincosf and tanf.

* The reallocarray function is now declared under _DEFAULT_SOURCE, not just
  for _GNU_SOURCE, to match BSD environments.

* For powercp64le ABI, Transactional Lock Elision is now enabled iff kernel
  indicates that it will abort the transaction prior to entering the kernel
  (PPC_FEATURE2_HTM_NOSC on hwcap2).  On older kernels the transaction is
  suspended, and this caused some undefined side-effects issues by aborting
  transactions manually.  Glibc avoided it by abort transactions manually on
  each syscall, but it lead to performance issues on newer kernels where the
  HTM state is saved and restore lazily (the state being saved even when the
  process actually does not use HTM).

* The functions posix_spawn_file_actions_addchdir_np and
  posix_spawn_file_actions_addfchdir_np have been added, enabling
  posix_spawn and posix_spawnp to run the new process in a different
  directory.  These functions are GNU extensions.  The function
  posix_spawn_file_actions_addchdir_np is similar to the Solaris function
  of the same name.

* The popen and system do not run atfork handlers anymore (BZ#17490).
  Although it is a possible POSIX violation, the POSIX rationale in
  pthread_atfork documentation regarding atfork handlers is to handle
  inconsistent mutex state after a fork call in a multi-threaded process.
  In both popen and system there is no direct access to user-defined mutexes.

* Support for the C-SKY ABIV2 running on Linux has been added.  This port
  requires at least binutils-2.32, gcc-9.0, and linux-4.20.  Two ABIs are
  supported:
    - C-SKY ABIV2 soft-float little-endian
    - C-SKY ABIV2 hard-float little-endian

* strftime's default formatting of a locale's alternative year (%Ey)
  has been changed to zero-pad the year to a minimum of two digits,
  like "%y".  This improves the display of Japanese era years during
  the first nine years of a new era, and is expected to be harmless
  for all other locales (only Japanese locales regularly have
  alternative year numbers less than 10).  Zero-padding can be
  overridden with the '_' or '-' flags (which are GNU extensions).

* As a GNU extension, the '_' and '-' flags can now be applied to
  "%EY" to control how the year number is formatted; they have the
  same effect that they would on "%Ey".

Deprecated and removed features, and other changes affecting compatibility:

* The glibc.tune tunable namespace has been renamed to glibc.cpu and the
  tunable glibc.tune.cpu has been renamed to glibc.cpu.name.

* The type of the pr_uid and pr_gid members of struct elf_prpsinfo, defined
  in <sys/procfs.h>, has been corrected to match the type actually used by
  the Linux kernel.  This affects the size and layout of that structure on
  MicroBlaze, MIPS (n64 ABI only), Nios II and RISC-V.

* For the MIPS n32 ABI, the type of the pr_sigpend and pr_sighold members of
  struct elf_prstatus, and the pr_flag member of struct elf_prpsinfo,
  defined in <sys/procfs.h>, has been corrected to match the type actually
  used by the Linux kernel.  This affects the size and layout of those
  structures.

* An archaic GNU extension to scanf, under which '%as', '%aS', and '%a[...]'
  meant to scan a string and allocate space for it with malloc, is now
  restricted to programs compiled in C89 or C++98 mode with _GNU_SOURCE
  defined.  This extension conflicts with C99's use of '%a' to scan a
  hexadecimal floating-point number, which is now available to programs
  compiled as C99 or C++11 or higher, regardless of _GNU_SOURCE.

  POSIX.1-2008 includes the feature of allocating a buffer for string input
  with malloc, using the modifier letter 'm' instead.  Programs using
  '%as', '%aS', or '%a[...]' with the old GNU meaning should change to
  '%ms', '%mS', or '%m[...]' respectively.  Programs that wish to use the
  C99 '%a' no longer need to avoid _GNU_SOURCE.

  GCC's -Wformat warnings can detect most uses of this extension, as long
  as all functions that call vscanf, vfscanf, or vsscanf are annotated with
  __attribute__ ((format (scanf, ...))).

Changes to build and runtime requirements:

* Python 3.4 or later is required to build the GNU C Library.

* On most architectures, GCC 5 or later is required to build the GNU C
  Library.  (On powerpc64le, GCC 6.2 or later is still required, as before.)

  Older GCC versions and non-GNU compilers are still supported when
  compiling programs that use the GNU C Library.

Security related changes:

  CVE-2018-19591: A file descriptor leak in if_nametoindex can lead to a
  denial of service due to resource exhaustion when processing getaddrinfo
  calls with crafted host names.  Reported by Guido Vranken.

  CVE-2019-6488: On x32, the size_t parameter may be passed in the lower
  32 bits of a 64-bit register with with non-zero upper 32 bit.  When it
  happened, accessing the 32-bit size_t value as the full 64-bit register
  in the assembly string/memory functions would cause a buffer overflow.
  Reported by H.J. Lu.

  CVE-2016-10739: The getaddrinfo function could successfully parse IPv4
  addresses with arbitrary trailing characters, potentially leading to data
  or command injection issues in applications.

Release Notes
=============

https://sourceware.org/glibc/wiki/Release/2.29

Contributors
============

This release was made possible by the contributions of many people.
The maintainers are grateful to everyone who has contributed
changes or bug reports.  These include:

Adhemerval Zanella
Albert ARIBAUD (3ADEV)
Alexandra Hájková
Andreas K. Hüttel
Andreas Schwab
Anton Youdkevitch
Arjun Shankar
Assaf Gordon
Aurelien Jarno
Carlos O'Donell
Charles-Antoine Couret
DJ Delorie
Darius Rad
David S. Miller
Dmitry V. Levin
Florian Weimer
Fredrik Noring
Gabriel F. T. Gomes
H.J. Lu
Ilya Leoshkevich
Ilya Yu. Malakhov
Istvan Kurucsai
Jim Wilson
Joseph Myers
Justus Winter
Kemi Wang
Leonardo Sandoval
Mao Han
Martin Jansa
Martin Kuchta
Martin Sebor
Mingli Yu
Moritz Eckert
PanderMusubi
Paul Clarke
Paul Eggert
Paul Pluzhnikov
Pochang Chen
Rafael Avila de Espindola
Rafael Ávila de Espíndola
Rafal Luzynski
Rajalakshmi Srinivasaraghavan
Rogerio Alves
Samuel Thibault
Sergi Almacellas Abellana
Siddhesh Poyarekar
Stefan Liebler
Steve Ellcey
Szabolcs Nagy
TAMUKI Shoichi
Tobias Klauser
Tulio Magno Quites Machado Filho
Uroš Bizjak
Wilco Dijkstra
Zack Weinberg
Zong Li
-----BEGIN PGP SIGNATURE-----

iQEcBAABAgAGBQJcUyg2AAoJEHnEPfvxzyGHauAIAJmbTi6IHhY18D0NwFH002a/
Z/4L4jTd9/I8kaR+qYMGDi1tO+cTWtxO3jdlIU7/1VRdnL1h+HnlYTJlc64DVP9t
3W4lhSJRbK8HWlV0emmNHnBCgV6SxOMaMPN286WKLDTYI3OrOs16qkKneDqhWEoG
BS1rvxdkd27hOds3CY4xsgCFgeyo/aS+sqV2nMNdcpGBb1ZLNET3O3AkP155BwOF
utMl2xbQ5Ue17mOrw1TiOUJqvvf6FhNHFLT1dgBmgAVP+sXhjgL00co4sHh5xu5x
vJ1ju3KgzIYtxbiAIUTppia/nRFX4K8z+VL7f4aDeUm6cxuikECcpCVgH7if4gc=
=Fcnu
-----END PGP SIGNATURE-----

Adhemerval Zanella (43):
      powerpc: Only enable TLE with PPC_FEATURE2_HTM_NOSC
      Use libsupport for tst-spawn.c
      Fix ifunc support with DT_TEXTREL segments (BZ#20480)
      Fix misreported errno on preadv2/pwritev2 (BZ#23579)
      libio: Flush stream at freopen (BZ#21037)
      Fix build from commit 0b727ed
      x86: Fix Haswell strong flags (BZ#23709)
      Fix tst-preadvwritev2 build failure on HURD
      posix: Add internal symbols for posix_spawn interface
      support: Fix printf format for TEST_COMPARE_STRING
      posix: Use posix_spawn on popen
      posix: Use posix_spawn on system
      Fix ChangeLog date from previous commit
      posix: Fix segfault in maybe_script_execute
      m68k: Fix sigaction kernel definition (BZ #23960)
      alpha: Use Linux generic sigaction implementation
      hppa: Remove kernel_sigaction.h
      ia64: Remove kernel_sigaction.h
      s390: Use generic kernel_sigaction.h
      Fix BZ number for 43a45c2d82
      Replace check_mul_overflow_size_t with __builtin_mul_overflow
      termios: Define TIOCSER_TEMT with __USE_MISC (BZ#17783)
      termios: Consolidate struct termios
      termios: Consolidate termios c_cc symbolic constants
      termios: Consolidate Input Modes definitions.
      termios: Consolidate Output Modes definitions
      termios: Consolidate Baud Rate Selection definitions (BZ#23783)
      termios: Consolidate control mode definitions
      termios: Consolidate local mode definitions
      termios: Consolidate tcflow symbolic constants
      termios: Remove Linux _IOT_termios
      termios: Add powerpc termios-misc
      termios: Consolidate termios.h
      posix: Clear close-on-exec for posix_spawn adddup2 (BZ#23640)
      nptl: Remove tst-cancel-wrappers test and related macros
      nptl: Fix testcases for new pthread cancellation mechanism
      x86_64: Remove wrong THREAD_ATOMIC_* macros
      i386: Remove bogus THREAD_ATOMIC_* macros
      nptl: Cleanup cancellation macros
      posix: Fix tst-spawn.c issue from commit 805334b26c
      elf: Fix LD_AUDIT for modules with invalid version (BZ#24122)
      hurd: Fix libsupport xsigstack build
      [elf] Revert 8e889c5da3 (BZ#24122)

Albert ARIBAUD (3ADEV) (12):
      Y2038: provide size of default time_t for target architecture
      Fix date typo in ChangeLog
      Y2038: Add 64-bit time for all architectures
      Y2038: make __tz_convert compatible with 64-bit-time
      Y2038: add function __localtime64
      Fix __TIMERSIZE and @theglibcadj typos
      Y2038: add function __localtime64_r
      Y2038: add function __gmtime64
      Y2038: add function __gmtime64_r
      Y2038: add function __ctime64
      Y2038: add function __ctime64_r
      Y2038: make __difftime compatible with 64-bit time

Alexandra Hájková (1):
      Add an additional test to resolv/tst-resolv-network.c

Andreas K. Hüttel (1):
      resolv: IDNA tests: AAAA (28) is valid, no fallthrough to default

Andreas Schwab (16):
      RISC-V: Don't use ps_get_thread_area in libthread_db (bug 23402)
      Don't build libnsl for new ABIs
      Remove leading space from testrun.sh
      Add missing unwind information to ld.so on powerpc32 (bug 23707)
      Fix stack overflow in tst-setcontext9 (bug 23717)
      Don't reduce test timeout to less than default
      Don't use PSEUDO_END for non-PSEUDO function
      Add more checks for valid ld.so.cache file (bug 18093)
      RISC-V: properly terminate call chain (bug 23125)
      libanl: properly cleanup if first helper thread creation failed (bug 22927)
      RISC-V: don't assume PI mutexes and robust futexes before 4.20 (bug 23864)
      Move *-le.abilist to le/*.abilist
      Remove support for abilist-pattern
      Reindent nptl/pthread_rwlock_common.c
      Fix rwlock stall with PREFER_WRITER_NONRECURSIVE_NP (bug 23861)
      nscd: avoid assertion failure during persistent db check

Anton Youdkevitch (1):
      aarch64: optimized memcpy implementation for thunderx2

Arjun Shankar (3):
      Clean up iconv/gconv_int.h for unnecessary declarations
      Remove unnecessary locking when reading iconv configuration [BZ #22062]
      Unconditionally call __gconv_get_path when reading iconv configuration

Assaf Gordon (1):
      regex: fix heap-use-after-free error

Aurelien Jarno (4):
      Update Alpha libm-test-ulps
      ARM: fix kernel assisted atomics with GCC 8 (bug 24034)
      en_US: define date_fmt (bug 24046)
      Only build libm with -fno-math-errno (bug 24024)

Carlos O'Donell (11):
      Add version.h, and NEWS update to ChangeLog.
      Add convenience target 'install-locale-files'.
      Fix ChangeLog date.
      Update be translations.
      Update be translations.
      Update translations for be.
      Fix test failure with -DNDEBUG.
      Fix tst-setcontext9 for optimized small stacks.
      abilist.awk: Treat .tdata like .tbss and reject unknown combinations.
      Add --no-hard-links option to localedef (bug 23923)
      x86: Add Hygon Dhyana support.

Charles-Antoine Couret (1):
      argp: do not call _IO_fwide() if _LIBC is not defined

DJ Delorie (10):
      RISC-V: Fix rounding save/restore bug.
      Regen RISC-V rvd ULPs
      Improve ChangeLog message.
      Add test-in-container infrastructure.
      Fix IA64 links-dso-program link.
      links-dso-program: Fix build-programs=no build case.
      malloc: tcache double free check
      test-container: add "su" command to run test as root, add unshare hints
      malloc: Add another test for tcache double free check.
      test-container: move postclean outside of namespace changes

Darius Rad (1):
      RISC-V: Update nofpu ULPs

David S. Miller (2):
      Regenerate sparc ulps.
      Add VDSO support to sparc.

Dmitry V. Levin (1):
      Fix a few typos in comments

Florian Weimer (61):
      Linux: Rewrite __old_getdents64 [BZ #23497]
      mbstowcs: Remove outdated comment
      error, error_at_line: Add missing va_end calls
      nscd: Deallocate existing user names in file parser
      nss_files: Fix file stream leak in aliases lookup [BZ #23521]
      error, warn, warnx: Use __fxprintf for wide printing [BZ #23519]
      Fix attribution of previous change in ChangeLog
      Makeconfig (ASFLAGS): Always append required assembler flags
      Add --with-nonshared-cflags option to configure
      math: Regenerate s390 ulps
      malloc: Add ChangeLog for accidentally committed change
      __readlink_chk: Assume HAVE_INLINED_SYSCALLS
      __readlink_chk: Remove micro-optimization
      Makeconfig: Do not sort and deduplicate +cflags [BZ # 17248]
      Avoid running some tests if the file system does not support holes
      nscd: Fix use-after-free in addgetnetgrentX [BZ #23520]
      test-container: EPERM from unshare is UNSUPPORTED
      regex: Add test tst-regcomp-truncated [BZ #23578]
      reallocarray: Declare under _DEFAULT_SOURCE
      misc: New test misc/tst-gethostid
      resource: Update struct rusage comments [BZ #23689]
      time/tst-mktime2: Improve test error reporting
      conform: XFAIL siginfo_t si_band test on sparc64
      stdlib/test-bz22786: Avoid spurious test failures using alias mappings
      stdlib/tst-strtod-overflow: Switch to support_blob_repeat
      support_blob_repeat: Call mkstemp directory for the backing file
      stdlib/test-bz22786: Avoid memory leaks in the test itself
      support/test-container.c: Include <libc-pointer-arith.h>
      support/shell-container.c: Use support_copy_file_range
      posix: New function posix_spawn_file_actions_addchdir_np [BZ #17405]
      support: Implement TEST_COMPARE_STRING
      malloc: Convert the unlink macro to the unlink_chunk function
      malloc: Use current (C11-style) atomics for fastbin access
      support: Print timestamps in timeout handler
      malloc: tcache: Validate tc_idx before checking for double-frees [BZ #23907]
      CVE-2018-19591: if_nametoindex: Fix descriptor for overlong name [BZ #23927]
      support: Implement support_quote_string
      support_quote_string: Do not use str parameter name
      support: Add signal support to support_capture_subprocess_check
      posix: Do not include testcases.h, ptestcases.h in source tree
      scripts/abilist.awk: Handle special _end symbol for Hurd
      support: Close original descriptors in support_capture_subprocess
      support: Implement <support/descriptors.h> to track file descriptors
      inet/tst-if_index-long: New test case for CVE-2018-19591 [BZ #23927]
      posix: New function posix_spawn_file_actions_addfchdir_np [BZ #17405]
      compat getdents64: Use correct offset for retry [BZ #23972]
      timespec_get (posix): Fix copyright header
      manual: Document thread/task IDs for Linux
      support: Do not require overflow builtin in support/blob_repeat.c
      localedata: Remove executable bit from localedata/locales/bi_VU [BZ #23995]
      locale: Rewrite locale/gen-translit.pl in Python
      malloc: Always call memcpy in _int_realloc [BZ #24027]
      nptl/tst-audit-threads: Switch to <support/test-driver.c>
      intl: Do not return NULL on asprintf failure in gettext [BZ #24018]
      Fix ChangeLog entry
      Linux: Improve handling of resource limits in misc/tst-ttyname
      manual: Use @code{errno} instead of @var{errno} [BZ #24063]
      malloc: Revert fastbins to old-style atomics
      resolv: Reformat inet_addr, inet_aton to GNU style
      resolv: Do not send queries for non-host-names in nss_dns [BZ #24112]
      CVE-2016-10739: getaddrinfo: Fully parse IPv4 address strings [BZ #20018]

Fredrik Noring (1):
      MIPS: Use `.set mips2' to emulate LL/SC for the R5900 too

Gabriel F. T. Gomes (11):
      Fix typo in the documentation of gcvt
      Add tests for argp_error and argp_failure with floating-point parameters
      Add test for warn, warnx, vwarn, and vwarnx with floating-point parameters
      Add tests with floating-point arguments for err* and verr* functions
      Use TEST_COMPARE_STRING in recently added test
      Convert tst-efgcvt to the new test framework
      Prepare vfscanf to use __strtof128_internal
      Remove redirection of _IO_vfprintf
      Add *-ldbl.h headers to include/bits
      Add tests for the long double version of ecvt and fcvt
      Set behavior of sprintf-like functions with overlapping source and destination

H.J. Lu (34):
      x86: Rename get_common_indeces to get_common_indices
      x86: Cleanup cpu-features-offsets.sym
      x86: Don't include <init-arch.h> in assembly codes
      x86: Move STATE_SAVE_OFFSET/STATE_SAVE_MASK to sysdep.h
      test-container: Use xcopy_file_range for cross-device copy [BZ #23597]
      i386: Use ENTRY and END in start.S [BZ #23606]
      i386: Use _dl_runtime_[resolve|profile]_shstk for SHSTK [BZ #23716]
      x86: Use RTM intrinsics in pthread mutex lock elision
      x86: Use _rdtsc intrinsic for HP_TIMING_NOW
      x86: Don't include <x86intrin.h>
      x86: Support RDTSCP for benchtests
      Check multiple NT_GNU_PROPERTY_TYPE_0 notes [BZ #23509]
      x86/CET: Add a re-exec test with legacy bitmap
      _dl_exception_create_format: Support %x/%lx/%zx
      elf/dl-exception.c: Include <_itoa.h> for _itoa prototype
      x86: Extend CPUID support in struct cpu_features
      Add getcpu
      Don't use __typeof__ (getcpu)
      x86: Merge i386/x86_64 atomic-machine.h
      manual/examples: Remove redundant "if not"
      x86-64: Vectorize sincosf_poly and update s_sincosf-fma.c
      Regenerate sysdeps/x86_64/fpu/libm-test-ulps
      x86-64: Remove s_sincosf-sse2.S
      riscv: Use __has_include__ to include <asm/syscalls.h> [BZ #24022]
      soft-fp: Properly check _FP_W_TYPE_SIZE [BZ #24066]
      Disable lazy binding on tests for minimal signal handler
      x86-64 memchr/wmemchr: Properly handle the length parameter [BZ# 24097]
      x86-64 memcmp/wmemcmp: Properly handle the length parameter [BZ# 24097]
      x86-64 memcpy: Properly handle the length parameter [BZ# 24097]
      x86-64 memrchr: Properly handle the length parameter [BZ# 24097]
      x86-64 memset/wmemset: Properly handle the length parameter [BZ# 24097]
      x86-64 strncmp family: Properly handle the length parameter [BZ# 24097]
      x86-64 strncpy: Properly handle the length parameter [BZ# 24097]
      x86-64 strnlen/wcsnlen: Properly handle the length parameter [BZ# 24097]

Ilya Leoshkevich (12):
      S390: Use symbolic offsets for stack variables in 32-bit _dl_runtime_resolve
      S390: Use symbolic offsets for stack variables in 32-bit _dl_runtime_profile
      S390: Use symbolic offsets for stack variables in 64-bit _dl_runtime_resolve
      S390: Use symbolic offsets for stack variables in 64-bit _dl_runtime_profile
      S390: Do not clobber R0 in 32-bit _dl_runtime_resolve
      S390: Do not clobber R0 in 32-bit _dl_runtime_profile
      S390: Do not clobber R0 in 64-bit _dl_runtime_resolve
      S390: Do not clobber R0 in 64-bit _dl_runtime_profile
      S390: Test that lazy binding does not clobber R0
      Move __fentry__ version definition to sysdeps/{i386,x86_64}
      S390: Implement 64-bit __fentry__
      S390: Fix unwind in 32-bit _mcount

Ilya Yu. Malakhov (1):
      signal: Use correct type for si_band in siginfo_t [BZ #23562]

Istvan Kurucsai (3):
      malloc: Additional checks for unsorted bin integrity I.
      malloc: Add more integrity checks to mremap_chunk.
      malloc: Check the alignment of mmapped chunks before unmapping.

Jim Wilson (1):
      RISC-V: Update LP64D libm-test-ulps.

Joseph Myers (123):
      Move SNAN_TESTS_TYPE_CAST out of math-tests.h.
      Move SNAN_TESTS_PRESERVE_PAYLOAD out of math-tests.h.
      Fix math/test-misc.c for undefined fenv.h macros.
      Do not define various fenv.h macros for MIPS soft-float (bug 23479).
      Consistently terminate libm-test-*.inc TEST lines with commas.
      Move comment from libm-test-nextdown.inc to libm-test-nexttoward.inc.
      Replace gen-libm-test.pl with gen-libm-test.py.
      Move SNAN_TESTS_* out of math-tests.h.
      Use Linux 4.18 in build-many-glibcs.py.
      Update install.texi documentation of uses of Perl and Python.
      Update syscall-names.list for Linux 4.18.
      Add NT_VMCOREDD, AT_MINSIGSTKSZ from Linux 4.18 to elf.h.
      Update struct signalfd_siginfo from Linux 4.18.
      Update netinet/tcp.h from Linux 4.18.
      Move ROUNDING_TESTS_* out of math-tests.h.
      Don't redefine ROUNDING_TESTS_* in math/test-*-vlen*.h.
      Move EXCEPTION_TESTS_* out of math-tests.h
      Move EXCEPTION_ENABLE_SUPPORTED out of math-tests.h.
      Update netinet/udp.h from Linux 4.18.
      Move EXCEPTION_SET_FORCES_TRAP out of math-tests.h.
      Split fenv_private.h out of math_private.h more consistently.
      Make gen-libm-test.py treat plus_oflow and minus_oflow as non-finite.
      Replace conform/list-header-symbols.pl with a Python script.
      Do not include fenv_private.h in math_private.h.
      Move fenv.h soft-float inlines from fenv_private.h to include/fenv.h.
      Move float128 inlines from sysdeps/generic/math_private.h to include/math.h.
      Remove alpha math_private.h.
      Add build-many-glibcs.py --enable-obsolete-* configs.
      Add build-many-glibcs.py support for building more GCC libraries.
      Remove x86_64 math_private.h asms.
      Include most of elf/ modules-names in modules-names-tests.
      Use floor functions not __floor functions in glibc libm.
      Use rint functions not __rint functions in glibc libm.
      Fix sys/procfs.h pr_uid, pr_gid type (bug 23649).
      Fix MIPS n32 pr_sigpend, pr_sighold, pr_flag type (bug 23656).
      Update siginfo constants from Linux kernel (bug 21286).
      Use ceil functions not __ceil functions in glibc libm.
      Fix ldbl-128ibm ceill, floorl inlining of ceil, floor.
      Unify many bits/mman.h headers.
      Invert sense of list of i686-class processors in sysdeps/x86/cpu-features.h.
      Use trunc functions not __trunc functions in glibc libm.
      Unify some sys/procfs.h headers.
      Unify more sys/procfs.h headers.
      Complete sys/procfs.h unification.
      Share MAP_* flags between more architectures.
      Use round functions not __round functions in glibc libm.
      Use copysign functions not __copysign functions in glibc libm.
      Remove unnecessary math_private.h includes.
      Move MREMAP_* to bits/mman-shared.h.
      Add more fma tests.
      Fix libnldbl_nonshared.a references to internal libm symbols (bug 23735).
      Use bits/mman-linux.h for hppa.
      Use common bits/msq.h for more architectures.
      Use common bits/sem.h for more architectures.
      Use common bits/shm.h for more architectures.
      Use single bits/msq.h for all architectures.
      Use single bits/sem.h for all architectures.
      Move SHMLBA to its own header.
      Use single bits/shm.h for all architectures.
      Do not allow divide-by-zero exception for pow(+/- 0, -Inf).
      Handle surrogate pairs in c16rtomb (bug 23794, DR#488, C2X).
      Stop c32rtomb and mbrtoc32 aliasing wcrtomb and mbrtowc (bug 23793).
      Use Linux 4.19 in build-many-glibcs.py.
      Update kernel version in syscall-names.list to 4.19.
      Use gen-libm-test.py to generate ulps table for manual.
      Add new ELF note types from Linux 4.19 to elf.h.
      Add IN_MASK_CREATE from Linux 4.19 to sys/inotify.h.
      Remove pre-Python-3.4 compatibility from build-many-glibcs.py.
      Patch to require Python 3.4 or later to build glibc.
      Use tempfile.TemporaryDirectory in conform/glibcconform.py.
      Convert linknamespace tests from Perl to Python.
      Update and correct SPARC configuration for supported socket syscalls (bug 23848).
      Disable -Wformat-overflow= warnings for some printf tests.
      Avoid printf ("%s", NULL) in posix/bug-regex22.c.
      Correct SH kernel-features.h undefines (bug 23862).
      Fix __ASSUME_MLOCK2 for ARM, MicroBlaze (bug 23867).
      Remove __ASSUME_SOCKETCALL.
      Replace conformtest.pl with conformtest.py.
      Update conform/Makefile mkdir commands.
      Remove redundant macro definitions from ia64 sfp-machine.h.
      Fix i686 build with GCC 9.
      Fix armv7 build with GCC 9.
      Fix sparc64 build with GCC 9.
      Add hidden_tls_def macros, fix powerpc-soft build with GCC 9.
      Fix mips build with GCC 9.
      Use unique identifiers in conformtest.
      Separate conformtest subtest generation and execution.
      Combine more conformtest tests into single execution of the compiler.
      Fix Arm __ASSUME_COPY_FILE_RANGE (bug 23915).
      Touch more glibc source files in build-many-glibcs.py.
      Fix Hurd build with read-only source directory.
      Do not copy glibc sources in build-many-glibcs.py.
      Replace gen-as-const.awk by gen-as-const.py.
      Make gen-as-const.py handle '--' consistently with awk script.
      Stop test-in-container trying to run other-OS binaries.
      Update miscellaneous files from upstream sources.
      Update timezone code from tzcode 2018g.
      Move tst-signal-numbers to Python.
      Use gen-as-const.py to process .pysym files.
      Remove x86 mathinline.h hypot inline.
      Do not clobber sp in _hurd_stack_setup.
      Remove x86 mathinline.h asinh, acosh, atanh inlines.
      Add test that MAP_* constants agree with kernel.
      Do not clobber r12 for ia64 syscalls.
      Remove __ASSUME_ST_INO_64_BIT.
      Remove x86 mathinline.h sinh, cosh, tanh inlines.
      Remove x86 mathinline.h.
      Require GCC 5 or later to build glibc (bug 23993).
      Update longlong.h.
      Update nios2, sparc32 localplt.data for difftime changes (bug 24023).
      Use Linux 4.20 in build-many-glibcs.py.
      Update timezone code from tzcode 2018i.
      Update copyright dates with scripts/update-copyrights.
      Update copyright dates not handled by scripts/update-copyrights.
      Update miscellaneous files from upstream sources.
      Update syscall-names.list for Linux 4.20.
      Add HWCAP_SSBS from Linux 4.20 to AArch64 bits/hwcap.h.
      Add PACKET_IGNORE_OUTGOING from Linux 4.20 to netpacket/packet.h.
      Add IPV6_MULTICAST_ALL from Linux 4.20 to bits/in.h.
      Update MIPS libm-test-ulps.
      Update Linux kernel version in tst-mman-consts.py.
      Update powerpc-nofpu libm-test-ulps.
      Use binutils 2.32 branch in build-many-glibcs.py.

Justus Winter (1):
      hurd: Handle "pid" magical lookup retry

Kemi Wang (1):
      Mutex: Add pthread mutex tunables

Leonardo Sandoval (5):
      benchtests: Set float type on --threshold argument
      benchtests: keep comparing even if function timings do not match
      benchtests: include --stats parameter
      benchtests: send non-consumable data to stderr
      x86-64: Optimize strcat/strncat, strcpy/strncpy and stpcpy/stpncpy with AVX2

Mao Han (4):
      Update config.guess and config.sub to current versions.
      C-SKY: Add dynamic relocations to elf.h
      Add statx conditionals for wordsize-32 *xstat.c
      Add C-SKY port

Martin Jansa (2):
      sysdeps/ieee754/soft-fp: ignore maybe-uninitialized with -O [BZ #19444]
      sysdeps/ieee754: prevent maybe-uninitialized errors with -O [BZ #19444]

Martin Kuchta (1):
      pthread_cond_broadcast: Fix waiters-after-spinning case [BZ #23538]

Martin Sebor (1):
      Add support for GCC 9 attribute copy.

Mingli Yu (1):
      Linux gethostid: Check for NULL value from gethostbyname_r [BZ #23679]

Moritz Eckert (1):
      malloc: Mitigate null-byte overflow attacks

PanderMusubi (1):
      bs_BA: Fix a small typo in comment (bug 24011).

Paul Clarke (1):
      powerpc: Fix tiny bug in strncmp.c

Paul Eggert (21):
      regex: fix memory leak in Gnulib
      regex: Gnulib unibyte RRI uses bytes not chars
      regex: port Gnulib code to z/OS POSIX environment
      regex: fix uninitialized memory access
      Fix tzfile low-memory assertion failure
      Simplify tzfile fstat failure code
      Merge mktime, timegm from upstream Gnulib
      Fix mktime localtime offset confusion
      mktime fix for Gnulib + coreutils
      regex: __builtin_expect → __glibc_unlikely
      regex: simplify by using intprops.h
      mktime: fix EOVERFLOW bug
      mktime: new test for mktime failure
      mktime: simplify offset guess
      mktime: make more room for overflow
      mktime: fix bug with Y2038 DST transition
      mktime: fix non-EOVERFLOW errno handling
      mktime: DEBUG_MKTIME cleanup
      regex: fix storage-exhaustion error
      regex: simplify Gnulib port
      regex: improve Gnulib port to AIX

Paul Pluzhnikov (4):
      Fix BZ#23400 (creating temporary files in source tree), and undefined behavior in test.
      [BZ #20271] Add newlines in __libc_fatal calls.
      stdlib: assert on NULL function pointer in atexit etc. [BZ #20544]
      Fix potential stack overflow [BZ #23490]

Pochang Chen (1):
      malloc: Verify size of top chunk.

Rafael Avila de Espindola (1):
      Simplify an #if #else #endif

Rafael Ávila de Espíndola (6):
      Enable VDSO on x86_64 statically linked programs [BZ #19767]
      Enable VDSO on powerpc statically linked programs (bug 19767)
      Enable VDSO for static linking on aarch64
      Enable VDSO on i386 statically linked programs
      Enable VDSO for static linking on arm
      Enable VDSO for static linking on mips

Rafal Luzynski (12):
      ChangeLog: Fix an obvious typo.
      en_IN: Set the correct date format for "%x" (bug 17426).
      Indian and similar locales: Set the correct date format (bug 17426).
      Italian and Swiss locales: Use the correct separators (bug 10797).
      it_CH/it_IT locales: Correct some LC_TIME formats (bug 10425).
      kl_GL: Fix spelling of Sunday, should be "sapaat" (bug 20209).
      kl_GL: Update the month names and date formats (bug 23740).
      NEWS: Fix a minor typo ("incosistent" -> "inconsistent").
      NEWS: Fix another typo ("multithread..." -> "multi-threaded...").
      sq_AL: Use the correct date and time formats (bug 10496, 23724).
      Multiple locales: Use the correct 12-hour time formats (bug 10496).
      ChangeLog: Fix an obvious typo in the previous commit.

Rajalakshmi Srinivasaraghavan (3):
      powerpc: Rearrange little endian specific files
      powerpc: Remove powerpc specific sinf and cosf optimization
      Speedup first memmem match

Rogerio Alves (2):
      powerpc: Fix VSCR position in ucontext (bug 24088)
      powerpc: fix tst-ucontext-ppc64-vscr test for POWER 5/6.

Samuel Thibault (36):
      hurd: Add missing symbols for proper libc_get/setspecific
      hurd: Avoid PLTs for __pthread_get/setspecific
      hurd: XFAIL absence of C11 threads implementation
      hurd: set interrupt timeout to 1 minute
      hurd: Return EIO on non-responding interrupted servers
      hurd: Fix race between calling RPC and handling a signal
      hurd: Fix cancellation just before RPC call
      hurd: Fix race between calling RPC and handling a signal
      hurd: return EIEIO instead of EIO
      hurd: Document how to translate EIEIO error message
      hurd: Fix build
      Merge branch 'master' of git://sourceware.org/git/glibc
      hurd: Fix errno* generation
      Merge branch 'master' into errno
      hurd: Add pci RPC stubs
      hurd: Support msync
      hurd: Fix last-minute refactoring
      Hurd: Implement chdir support in posix_spawn
      Hurd: Fix ulinks in fd table reallocation
      Hurd: export _hurd_port_move
      hurd: Document dtable_cloexec size convention.
      hurd: Fix spawni's user_link reallocation
      hurd: Fix build with GCC 9
      hurd: Fix F_*LK* fcntl with __USE_FILE_OFFSET64
      hurd: Support lockf at offset 0 with size 0 or 1.
      hurd: Fix returning value for fcntl(F_*LK*)
      htl: Fix comparing attr with default values
      Fix test-as-const-jmp_buf-ssp.c generation on gnu-i386
      hurd: Implement support for posix_spawn_file_actions_addfchdir_np
      hurd: Fix linknamespace of spawni
      hurd: Fix 64bit fcntl lock implementation
      hurd: advertise *_setpshared as not supported
      hurd: Check at_flags passed to faccessat
      hurd: Support AT_EMPTY_PATH
      hurd: Fix initial sigaltstack state
      hurd: Fix initial sigaltstack state

Sergi Almacellas Abellana (1):
      Currency symbol should not preceed amount for [BZ #23791]

Siddhesh Poyarekar (14):
      Rename the glibc.tune namespace to glibc.cpu
      Add ChangeLog for the last commit
      [benchtests] Fix compare_strings.py for python2
      benchtests: Clean up the alloc_bufs
      [aarch64] Fix value of MIN_PAGE_SIZE for testing
      [benchtests] Add mandatory attributes to workload tests
      [benchtests] Add workload test properties to schema
      [aarch64] Add an ASIMD variant of strlen for falkor
      Print strlen benchmark output in json
      Reallocate buffers for every run in strlen
      Update libc.pot
      Update translations
      Prepare for 2.29 release
      Tag 2.29 release

Stefan Liebler (63):
      Test stdlib/test-bz22786 exits now with unsupported if malloc fails.
      Fix segfault in maybe_script_execute.
      S390: Regenerate ULPs.
      Adjust name of ld.so in test-container.c.
      Fix race in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP [BZ #23275]
      S390: Regenerate ULPs.
      Add missing libnss_testX.so requirement for tst-nss-test3.
      S390: Add configure check to detect z10 as mininum architecture level set.
      S390: Use hwcap instead of dl_hwcap in ifunc-resolvers.
      S390: Unify 31/64bit memset.
      S390: Refactor memset ifunc handling.
      S390: Implement bzero with memset.
      S390: Unify 31/64bit memcmp.
      S390: Refactor memcmp ifunc handling.
      S390: Unify 31/64bit memcpy.
      S390: Refactor memcpy/mempcpy ifunc handling.
      S390: Remove s390 specific implementation of bcopy.
      S390: Use memcpy for forward cases in memmove.
      S390: Add configure check to detect z13 as mininum architecture level set.
      S390: Add z13 memmove ifunc variant.
      S390: Add z13 strstr ifunc variant.
      S390: Add z13 memmem ifunc variant.
      S390: Refactor strlen ifunc handling.
      S390: Refactor strnlen ifunc handling.
      S390: Refactor strcpy ifunc handling.
      S390: Refactor stpcpy ifunc handling.
      S390: Refactor strncpy ifunc handling.
      S390: Refactor stpncpy ifunc handling.
      S390: Refactor strcat ifunc handling.
      S390: Refactor strncat ifunc handling.
      S390: Refactor strcmp ifunc handling.
      S390: Refactor strncmp ifunc handling.
      S390: Refactor strchr ifunc handling.
      S390: Refactor strchrnul ifunc handling.
      S390: Refactor strrchr ifunc handling.
      S390: Refactor strspn ifunc handling.
      S390: Refactor strpbrk ifunc handling.
      S390: Refactor strcspn ifunc handling.
      S390: Refactor memchr ifunc handling.
      S390: Refactor rawmemchr ifunc handling.
      S390: Refactor memccpy ifunc handling.
      S390: Refactor memrchr ifunc handling.
      S390: Refactor wcslen ifunc handling.
      S390: Refactor wcsnlen ifunc handling.
      S390: Refactor wcscpy ifunc handling.
      S390: Refactor wcpcpy ifunc handling.
      S390: Refactor wcsncpy ifunc handling.
      S390: Refactor wcpncpy ifunc handling.
      S390: Refactor wcscat ifunc handling.
      S390: Refactor wcsncat ifunc handling.
      S390: Refactor wcscmp ifunc handling.
      S390: Refactor wcsncmp ifunc handling.
      S390: Refactor wcschr ifunc handling.
      S390: Refactor wcschrnul ifunc handling.
      S390: Refactor wcsrchr ifunc handling.
      S390: Refactor wcsspn ifunc handling.
      S390: Refactor wcspbrk ifunc handling.
      S390: Refactor wcscspn ifunc handling.
      S390: Refactor wmemchr ifunc handling.
      S390: Refactor wmemset ifunc handling.
      S390: Refactor wmemcmp ifunc handling.
      S390: Refactor gconv_simple ifunc handling.
      S390: Cleanup ifunc-resolve.h.

Steve Ellcey (1):
      Remove extra space at end of line.

Szabolcs Nagy (17):
      Clean up converttoint handling and document the semantics
      Add new exp and exp2 implementations
      Missed ChangeLog
      Add new log implementation
      Add new log2 implementation
      Add new pow implementation
      Fix the documentation comment of checkint in powf
      Increase timeout of libio/tst-readline
      Increase timeout of nss/tst-nss-files-hosts-multi
      i64: fix missing exp2f, log2f and powf symbols in libm.a [BZ #23822]
      Remove the error handling wrapper from exp and exp2
      Remove the error handling wrapper from log
      Remove the error handling wrapper from log2
      Remove the error handling wrapper from pow
      Fix powf overflow handling in non-nearest rounding mode [BZ #23961]
      AArch64: Update dl-procinfo.c with new HWCAP
      Fix the manual for old texinfo

TAMUKI Shoichi (4):
      strftime: Consequently use the "L_" macro with character literals
      manual: Fix the wording to "alternative" rather than "alternate"
      strftime: Set the default width of "%Ey" to 2 [BZ #23758]
      strftime: Pass the additional flags from "%EY" to "%Ey" [BZ #24096]

Tobias Klauser (1):
      Add PF_XDP, AF_XDP and SOL_XDP from Linux 4.18 to bits/socket.h.

Tulio Magno Quites Machado Filho (4):
      Fix _dl_profile_fixup data-dependency issue (Bug 23690)
      powerpc: Add missing CFI register information (bug #23614)
      Print cache size and geometry auxv types on LD_SHOW_AUXV=1
      Add XFAIL_ROUNDING_IBM128_LIBGCC to more fma() tests

Uroš Bizjak (1):
      alpha: Fix __remqu corrupting $f3 register

Wilco Dijkstra (13):
      Simplify and speedup strstr/strcasestr first match
      Improve performance of sincosf
      Improve performance of sinf and cosf
      Fix spaces in x86_64 ULP file
      Use generic sinf/cosf in lgammaf_r
      Speedup tanf range reduction
      Update NEWS for sinf improvements
      Remove unused math files
      Fix strstr bug with huge needles (bug 23637)
      [AArch64] Adjust writeback in non-zero memset
      Refactor string benchtests
      Improve bench-strlen
      [AArch64] Add ifunc support for Ares

Zack Weinberg (11):
      [manual] Job control is no longer optional.
      Use STRFMON_LDBL_IS_DBL instead of __ldbl_is_dbl.
      Add __vfscanf_internal and __vfwscanf_internal with flags arguments.
      Use SCANF_ISOC99_A instead of _IO_FLAGS2_SCANF_STD.
      Use SCANF_LDBL_IS_DBL instead of __ldbl_is_dbl.
      Add __v*printf_internal with flags arguments
      Add __vsyslog_internal, with same flags as __v*printf_internal.
      Use PRINTF_FORTIFY instead of _IO_FLAGS2_FORTIFY (bug 11319)
      Use PRINTF_LDBL_IS_DBL instead of __ldbl_is_dbl.
      Use C99-compliant scanf under _GNU_SOURCE with modern compilers.
      Tests for minimal signal handler functionality in MINSIGSTKSZ space.

Zong Li (3):
      elf: Fix the ld flags not be applied to tst-execstack-mod.so
      soft-fp: Use temporary variable in FP_FRAC_SUB_3/FP_FRAC_SUB_4
      soft-fp: Add implementation for 128 bit self-contained

-----------------------------------------------------------------------