1. 22 Mar, 2019 2 commits
  2. 21 Mar, 2019 1 commit
    • Rich Felker's avatar
      fix data race choosing next key slot in pthread_key_create · 59f88d76
      Rich Felker authored
      commit 84d061d5 wrongly moved the
      access to the global next_key outside of the scope of the lock. the
      error manifested as spurious failure to find an available key slot
      under concurrent calls to pthread_key_create, since the stopping
      condition could be met after only a small number of slots were
  3. 15 Mar, 2019 1 commit
    • Rich Felker's avatar
      fix crash/out-of-bound read in sscanf · 8f12c4e1
      Rich Felker authored
      commit d6c855ca caused this
      "regression", though the behavior was undefined before, overlooking
      that f->shend=0 was being used as a sentinel for "EOF" status (actual
      EOF or hitting the scanf field width) of the stream helper (shgetc)
      obviously the shgetc macro could be adjusted to check for a null
      pointer in addition to the != comparison, but it's the hot path, and
      adding extra code/branches to it begins to defeat the purpose.
      so instead of setting shend to a null pointer to block further reads,
      which no longer works, set it to the current position (rpos). this
      makes the shgetc macro work with no change, but it breaks shunget,
      which can no longer look at the value of shend to determine whether to
      back up. Szabolcs Nagy suggested a solution which I'm using here:
      setting shlim to a negative value is inexpensive to test at shunget
      time, and automatically re-trips the cnt>=shlim stop condition in
      __shgetc no matter what the original limit was.
  4. 14 Mar, 2019 1 commit
  5. 13 Mar, 2019 24 commits
  6. 12 Mar, 2019 2 commits
    • A. Wilcox's avatar
      setvbuf: return failure if mode is invalid · 00d3d577
      A. Wilcox authored
      POSIX requires setvbuf to return non-zero if `mode` is not one of _IONBF,
      _IOLBF, or _IOFBF.
    • Rich Felker's avatar
      make FILE a complete type for pre-C11 standard profiles · f368d9fd
      Rich Felker authored
      C11 removed the requirement that FILE be a complete type, which was
      deemed erroneous, as part of the changes introduced by N1439 regarding
      completeness of types (see footnote 6 for specific mention of FILE).
      however the current version of POSIX is still based on C99 and
      incorporates the old requirement that FILE be a complete type.
      expose an arbitrary, useless complete type definition because the
      actual object used to represent FILE streams cannot be public/ABI.
      thanks to commit 13d1afa4, we now have
      a framework for suppressing the public complete-type definition of FILE
      when stdio.h is included internally, so that a different internal
      definition can be provided. this is perfectly well-defined, since the
      same struct tag can refer to different types in different translation
      units. it would be a problem if the implementation were accessing the
      application's FILE objects or vice versa, but either would be
      undefined behavior.
  7. 10 Mar, 2019 1 commit
    • Rich Felker's avatar
      fix invalid-/double-/use-after-free in new dlopen ctor execution · 50cd0238
      Rich Felker authored
      this affected the error path where dlopen successfully found and
      loaded the requested dso and all its dependencies, but failed to
      resolve one or more relocations, causing the operation to fail after
      storage for the ctor queue was allocated.
      commit 188759bb wrongly put the free
      for the ctor_queue array in the error path inside a loop over each
      loaded dso that needed to be backed-out, rather than just doing it
      once. in addition, the exit path also observed the ctor_queue pointer
      still being nonzero, and would attempt to call ctors on the backed-out
      dsos unless the double-free crashed the process first.
  8. 05 Mar, 2019 1 commit
    • Rich Felker's avatar
      don't reject unknown/future flags in sigaltstack, allow SS_AUTODISARM · 4918b7fb
      Rich Felker authored
      historically, and likely accidentally, sigaltstack was specified to
      fail with EINVAL if any flag bit other than SS_DISABLE was set. the
      resolution of Austin Group issue 1187 fixes this so that the
      requirement is only to fail for SS_ONSTACK (which cannot be set) or
      "invalid" flags.
      Linux fails on the kernel side for invalid flags, but historically
      accepts SS_ONSTACK as a no-op, so it needs to be rejected in userspace
      with this change, the Linux-specific SS_AUTODISARM, provided since
      commit 9680e1d0 but unusable due to
      rejection at runtime, is now usable.
  9. 03 Mar, 2019 6 commits
    • Rich Felker's avatar
      avoid malloc of ctor queue for programs with no external deps · 43e7efb4
      Rich Felker authored
      together with the previous two commits, this completes restoration of
      the property that dynamic-linked apps with no external deps and no tls
      have no failure paths before entry.
    • Rich Felker's avatar
      avoid malloc of deps arrays for ldso and vdso · f034f145
      Rich Felker authored
      neither has or can have any dependencies, but since commit
      40355569, gratuitous zero-length deps
      arrays were being allocated for them. use a dummy array instead.
    • Rich Felker's avatar
      avoid malloc of deps array for programs with no external deps · e612d094
      Rich Felker authored
      traditionally, we've provided a guarantee that dynamic-linked
      applications with no external dependencies (nothing but libc) and no
      thread-local storage have no failure paths before the entry point.
      normally, thanks to reclaim_gaps, such a malloc will not require a
      syscall anyway, but if segment alignment is unlucky, it might. use a
      builtin array for this common special case.
    • Rich Felker's avatar
      fix malloc misuse for startup ctor queue, breakage on fdpic archs · 2f1f51ae
      Rich Felker authored
      in the case where malloc is being replaced, it's not valid to call
      malloc between final relocations and main app's crt1 entry point; on
      fdpic archs the main app's entry point will not yet have performed the
      self-fixups necessary to call its code.
      to fix, reorder queue_ctors before final relocations. an alternative
      solution would be doing the allocation from __libc_start_init, after
      the entry point but before any ctors run. this is less desirable,
      since it would leave a call to malloc that might be provided by the
      application happening at startup when doing so can be easily avoided.
    • Rich Felker's avatar
      synchronize shared library dtor exec against concurrent loads/ctors · 8e43b561
      Rich Felker authored
      previously, going way back, there was simply no synchronization here.
      a call to exit concurrent with ctor execution from dlopen could cause
      a dtor to execute concurrently with its corresponding ctor, or could
      cause dtors for newly-constructed libraries to be skipped.
      introduce a shutting_down state that blocks further ctor execution,
      producing the quiescence the dtor execution loop needs to ensure any
      kind of consistency, and that blocks further calls to dlopen so that a
      call into dlopen from a dtor cannot deadlock.
      better approaches to some of this may be possible, but the changes
      here at least make things safe.
    • Rich Felker's avatar
      overhaul shared library ctor execution for dependency order, concurrency · 188759bb
      Rich Felker authored
      previously, shared library constructors at program start and dlopen
      time were executed in reverse load order. some libraries, however,
      rely on a depth-first dependency order, which most other dynamic
      linker implementations provide. this is a much more reasonable, less
      arbitrary order, and it turns out to have much better properties with
      regard to how slow-running ctors affect multi-threaded programs, and
      how recursive dlopen behaves.
      this commit builds on previous work tracking direct dependencies of
      each dso (commit 40355569), and
      performs a topological sort on the dependency graph at load time while
      the main ldso lock is held and before success is committed, producing
      a queue of constructors needed by the newly-loaded dso (or main
      application). in the case of circular dependencies, the dependency
      chain is simply broken at points where it becomes circular.
      when the ctor queue is run, the init_fini_lock is held only for
      iteration purposes; it's released during execution of each ctor, so
      that arbitrarily-long-running application code no longer runs with a
      lock held in the caller. this prevents a dlopen with slow ctors in one
      thread from arbitrarily delaying other threads that call dlopen.
      fully-independent ctors can run concurrently; when multiple threads
      call dlopen with a shared dependency, one will end up executing the
      ctor while the other waits on a condvar for it to finish.
      another corner case improved by these changes is recursive dlopen
      (call from a ctor). previously, recursive calls to dlopen could cause
      a ctor for a library to be executed before the ctor for its
      dependency, even when there was no relation between the calling
      library and the library it was loading, simply due to the naive
      reverse-load-order traversal. now, we can guarantee that recursive
      dlopen in non-circular-dependency usage preserves the desired ctor
      execution order properties, and that even in circular usage, at worst
      the libraries whose ctors call dlopen will fail to have completed
      construction when ctors that depend on them run.
      init_fini_lock is changed to a normal, non-recursive mutex, since it
      is no longer held while calling back into application code.
  10. 02 Mar, 2019 1 commit