commit fd6a0404c3245451a264751a5b4b988370215c2a (HEAD -> gentoo/2.38, gentoo/gentoo/2.38)
Author:     Arjun Shankar <arjun@redhat.com>
AuthorDate: Mon Jan 15 17:44:45 2024 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Tue Jan 30 19:14:44 2024 +0100

    syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)
    
    __vsyslog_internal calculated a buffer size by adding two integers, but
    did not first check if the addition would overflow.  This commit fixes
    that.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Tested-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit ddf542da94caf97ff43cc2875c88749880b7259b)
    (cherry picked from commit d37c2b20a4787463d192b32041c3406c2bd91de0)

 misc/syslog.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

commit 2b8c1a4b7581822263f6d6498ab82991d16fa4f7
Author:     Arjun Shankar <arjun@redhat.com>
AuthorDate: Mon Jan 15 17:44:44 2024 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Tue Jan 30 19:14:20 2024 +0100

    syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779)
    
    __vsyslog_internal used the return value of snprintf/vsnprintf to
    calculate buffer sizes for memory allocation.  If these functions (for
    any reason) failed and returned -1, the resulting buffer would be too
    small to hold output.  This commit fixes that.
    
    All snprintf/vsnprintf calls are checked for negative return values and
    the function silently returns upon encountering them.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 7e5a0c286da33159d47d0122007aac016f3e02cd)
    (cherry picked from commit d0338312aace5bbfef85e03055e1212dd0e49578)

 misc/syslog.c | 39 ++++++++++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 11 deletions(-)

commit fc928af114154282c402222fad0d5ade87f7a235
Author:     Arjun Shankar <arjun@redhat.com>
AuthorDate: Mon Jan 15 17:44:43 2024 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Tue Jan 30 19:12:59 2024 +0100

    syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246)
    
    __vsyslog_internal did not handle a case where printing a SYSLOG_HEADER
    containing a long program name failed to update the required buffer
    size, leading to the allocation and overflow of a too-small buffer on
    the heap.  This commit fixes that.  It also adds a new regression test
    that uses glibc.malloc.check.
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Tested-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 6bd0e4efcc78f3c0115e5ea9739a1642807450da)
    (cherry picked from commit 23514c72b780f3da097ecf33a793b7ba9c2070d2)

 misc/Makefile                                    |  8 +++-
 misc/syslog.c                                    | 50 +++++++++++++++++-------
 misc/tst-syslog-long-progname.c                  | 39 ++++++++++++++++++
 misc/tst-syslog-long-progname.root/postclean.req |  0
 4 files changed, 82 insertions(+), 15 deletions(-)

commit 33c5167b00c38bb6a4db599f079600eb45b51bd0
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Tue Jan 2 14:36:17 2024 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Tue Jan 30 19:12:43 2024 +0100

    libio: Check remaining buffer size in _IO_wdo_write (bug 31183)
    
    The multibyte character needs to fit into the remaining buffer space,
    not the already-written buffer space.  Without the fix, we were never
    moving the write pointer from the start of the buffer, always using
    the single-character fallback buffer.
    
    Fixes commit 04b76b5aa8b2d1d19066e42dd1 ("Don't error out writing
    a multibyte character to an unbuffered stream (bug 17522)").
    
    (cherry picked from commit ecc7c3deb9f347649c2078fcc0f94d4cedf92d60)
    (cherry picked from commit cfe121910013a46e2477562282c56ae8062089aa)

 NEWS             | 1 +
 libio/wfileops.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

commit 67f31cb19badf11997a11c8b42ca45e3c3bd1bfc
Author:     Andreas Schwab <schwab@suse.de>
AuthorDate: Wed Dec 6 14:48:22 2023 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Tue Jan 30 19:12:17 2024 +0100

    getaddrinfo: translate ENOMEM to EAI_MEMORY (bug 31163)
    
    When __resolv_context_get returns NULL due to out of memory, translate it
    to a return value of EAI_MEMORY.
    
    (cherry picked from commit 5eabdb6a6ac1599d23dd5966a37417215950245f)
    (cherry picked from commit ae1e5217021e43e1f2de443d26e87ea3adfb221c)

 sysdeps/posix/getaddrinfo.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

commit d63e3913e62114f4fc71862f2d57b454a5746a24 (tag: gentoo/glibc-2.38-9)
Author:     Andreas K. Hüttel <dilfridge@gentoo.org>
AuthorDate: Sat Dec 23 22:56:11 2023 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 22:56:11 2023 +0100

    Gentoo: Disable valgrind-based tests, too unreliable
    
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 elf/Makefile | 4 ----
 1 file changed, 4 deletions(-)

commit 4e63cde2006aa3a2587a3504ba6eb23818b96e17 (tag: gentoo/glibc-2.38-8)
Author:     H.J. Lu <hjl.tools@gmail.com>
AuthorDate: Sat Dec 23 06:27:50 2023 -0800
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 16:24:44 2023 +0100

    NEWS: Mention bug fixes for 30745/30843
    
    (cherry picked from commit 27339a3eb8f987eebae72b854af80256c1588ebd)

 NEWS | 2 ++
 1 file changed, 2 insertions(+)

commit 8acd4548a73c47dc0f9a43749792e75719e1d361
Author:     H.J. Lu <hjl.tools@gmail.com>
AuthorDate: Sat Dec 23 06:24:41 2023 -0800
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 16:24:29 2023 +0100

    NEWS: Mention bug fixes for 29039/30694/30709/30721
    
    (cherry picked from commit d25e2c8d5cb0778ae87ad43b1f4c301abe5a932b)

 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

commit 7bffa27ca9bd890b0b6df5f489e8f14789f5542b
Author:     H.J. Lu <hjl.tools@gmail.com>
AuthorDate: Wed Dec 20 19:42:12 2023 -0800
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 16:24:12 2023 +0100

    x86-64: Fix the tcb field load for x32 [BZ #31185]
    
    _dl_tlsdesc_undefweak and _dl_tlsdesc_dynamic access the thread pointer
    via the tcb field in TCB:
    
    _dl_tlsdesc_undefweak:
            _CET_ENDBR
            movq    8(%rax), %rax
            subq    %fs:0, %rax
            ret
    
    _dl_tlsdesc_dynamic:
            ...
            subq    %fs:0, %rax
            movq    -8(%rsp), %rdi
            ret
    
    Since the tcb field in TCB is a pointer, %fs:0 is a 32-bit location,
    not 64-bit. It should use "sub %fs:0, %RAX_LP" instead.  Since
    _dl_tlsdesc_undefweak returns ptrdiff_t and _dl_make_tlsdesc_dynamic
    returns void *, RAX_LP is appropriate here for x32 and x86-64.  This
    fixes BZ #31185.
    
    (cherry picked from commit 81be2a61dafc168327c1639e97b6dae128c7ccf3)
    (cherry picked from commit 968c983d43bc51f719f3e7a0fcb1bb8669b5f7c4)

 NEWS                        | 1 +
 sysdeps/x86_64/dl-tlsdesc.S | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

commit 285f121e8bd1f95676908306b66b7f4a65087508
Author:     H.J. Lu <hjl.tools@gmail.com>
AuthorDate: Wed Dec 20 16:31:43 2023 -0800
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 16:23:53 2023 +0100

    x86-64: Fix the dtv field load for x32 [BZ #31184]
    
    On x32, I got
    
    FAIL: elf/tst-tlsgap
    
    $ gdb elf/tst-tlsgap
    ...
    open tst-tlsgap-mod1.so
    
    Thread 2 "tst-tlsgap" received signal SIGSEGV, Segmentation fault.
    [Switching to LWP 2268754]
    _dl_tlsdesc_dynamic () at ../sysdeps/x86_64/dl-tlsdesc.S:108
    108             movq    (%rsi), %rax
    (gdb) p/x $rsi
    $4 = 0xf7dbf9005655fb18
    (gdb)
    
    This is caused by
    
    _dl_tlsdesc_dynamic:
            _CET_ENDBR
            /* Preserve call-clobbered registers that we modify.
               We need two scratch regs anyway.  */
            movq    %rsi, -16(%rsp)
            movq    %fs:DTV_OFFSET, %rsi
    
    Since the dtv field in TCB is a pointer, %fs:DTV_OFFSET is a 32-bit
    location, not 64-bit.  Load the dtv field to RSI_LP instead of rsi.
    This fixes BZ #31184.
    
    (cherry picked from commit 3502440397bbb840e2f7223734aa5cc2cc0e29b6)
    (cherry picked from commit 35ea7549751d4f13a28c732e6ad68204f5e60a06)

 NEWS                        | 1 +
 sysdeps/x86_64/dl-tlsdesc.S | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

commit 37b1196f03be1875ebe64c51857134c1e9c3746a
Author:     Szabolcs Nagy <szabolcs.nagy@arm.com>
AuthorDate: Wed Nov 29 11:31:37 2023 +0000
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 16:23:30 2023 +0100

    elf: Add TLS modid reuse test for bug 29039
    
    This is a minimal regression test for bug 29039 which only affects
    targets with TLSDESC and a reproducer requires that
    
    1) Have modid gaps (closed modules) with old generation.
    2) Update a DTV to a newer generation (needs a newer dlopen).
    3) But do not update the closed gap entry in that DTV.
    4) Reuse the modid gap for a new module (another dlopen).
    5) Use dynamic TLSDESC in that new module with old generation (bug).
    6) Access TLS via this TLSDESC and the now outdated DTV.
    
    However step (3) in practice rarely happens: during DTV update the
    entries for closed modids are initialized to "unallocated" and then
    dynamic TLSDESC calls __tls_get_addr independently of its generation.
    The only exception to this is DTV setup at thread creation (gaps are
    initialized to NULL instead of unallocated) or DTV resize where the
    gap entries are outside the previous DTV array (again NULL instead
    of unallocated, and this requires loading > DTV_SURPLUS modules).
    
    So the bug can only cause NULL (+ offset) dereference, not use after
    free. And the easiest way to get (3) is via thread creation.
    
    Note that step (5) requires that the newly loaded module has larger
    TLS than the remaining optional static TLS. And for (6) there cannot
    be other TLS access or dlopen in the thread that updates the DTV.
    
    Tested on aarch64-linux-gnu.
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    (cherry picked from commit 980450f12685326729d63ff72e93a996113bf073)
    (cherry picked from commit 0de9082ed8d8f149ca87d569a73692046e236c18)

 elf/Makefile          | 15 +++++++++
 elf/tst-tlsgap-mod0.c |  2 ++
 elf/tst-tlsgap-mod1.c |  2 ++
 elf/tst-tlsgap-mod2.c |  2 ++
 elf/tst-tlsgap.c      | 92 +++++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 113 insertions(+)

commit 4a52cba5dec955ca8a41534dfcfc8904b985935c
Author:     Hector Martin <marcan@marcan.st>
AuthorDate: Tue Nov 28 15:23:07 2023 +0900
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 16:23:08 2023 +0100

    elf: Fix TLS modid reuse generation assignment (BZ 29039)
    
    _dl_assign_tls_modid() assigns a slotinfo entry for a new module, but
    does *not* do anything to the generation counter. The first time this
    happens, the generation is zero and map_generation() returns the current
    generation to be used during relocation processing. However, if
    a slotinfo entry is later reused, it will already have a generation
    assigned. If this generation has fallen behind the current global max
    generation, then this causes an obsolete generation to be assigned
    during relocation processing, as map_generation() returns this
    generation if nonzero. _dl_add_to_slotinfo() eventually resets the
    generation, but by then it is too late. This causes DTV updates to be
    skipped, leading to NULL or broken TLS slot pointers and segfaults.
    
    Fix this by resetting the generation to zero in _dl_assign_tls_modid(),
    so it behaves the same as the first time a slot is assigned.
    _dl_add_to_slotinfo() will still assign the correct static generation
    later during module load, but relocation processing will no longer use
    an obsolete generation.
    
    Note that slotinfo entry (aka modid) reuse typically happens after a
    dlclose and only TLS access via dynamic tlsdesc is affected. Because
    tlsdesc is optimized to use the optional part of static TLS, dynamic
    tlsdesc can be avoided by increasing the glibc.rtld.optional_static_tls
    tunable to a large enough value, or by LD_PRELOAD-ing the affected
    modules.
    
    Fixes bug 29039.
    
    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
    (cherry picked from commit 3921c5b40f293c57cb326f58713c924b0662ef59)
    (cherry picked from commit ccdc4cba07684fe1397e1f5f134a0a827af98c04)

 elf/dl-tls.c | 1 +
 1 file changed, 1 insertion(+)

commit fb2e7343399bb51c3f173006e80077762695747a
Author:     caiyinyu <caiyinyu@loongson.cn>
AuthorDate: Thu Oct 26 17:27:21 2023 +0800
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 16:22:44 2023 +0100

    LoongArch: Delete excessively allocated memory.
    
    Backported from glibc 2.39 development.
    
    (cherry picked from commit 44f757a6364a546359809d48c76b3debd26e77d4)

 sysdeps/loongarch/dl-trampoline.h | 68 +++++++++++++++++++--------------------
 1 file changed, 34 insertions(+), 34 deletions(-)

commit 391a0d5ef89c0f7b252e7ece218a93da476d3b5c
Author:     Adhemerval Zanella <adhemerval.zanella@linaro.org>
AuthorDate: Thu Dec 7 11:17:35 2023 -0300
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 16:22:23 2023 +0100

    elf: Fix wrong break removal from 8ee878592c
    
    Reported-by: Alexander Monakov <amonakov@ispras.ru>
    (cherry picked from commit 546a1ba664626603660b595662249d524e429013)
    (cherry picked from commit bf5aa419cbf545d2cd09dc097e518033d6e4df5e)

 elf/readelflib.c | 1 +
 1 file changed, 1 insertion(+)

commit 6551218a6ec42db70ebe0e62e9b79bc9e7a65155
Author:     Sergio Durigan Junior <sergiodj@sergiodj.net>
AuthorDate: Wed Nov 1 18:15:23 2023 -0400
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Dec 23 16:22:00 2023 +0100

    sysdeps: sem_open: Clear O_CREAT when semaphore file is expected to exist [BZ #30789]
    
    When invoking sem_open with O_CREAT as one of its flags, we'll end up
    in the second part of sem_open's "if ((oflag & O_CREAT) == 0 || (oflag
    & O_EXCL) == 0)", which means that we don't expect the semaphore file
    to exist.
    
    In that part, open_flags is initialized as "O_RDWR | O_CREAT | O_EXCL
    | O_CLOEXEC" and there's an attempt to open(2) the file, which will
    likely fail because it won't exist.  After that first (expected)
    failure, some cleanup is done and we go back to the label "try_again",
    which lives in the first part of the aforementioned "if".
    
    The problem is that, in that part of the code, we expect the semaphore
    file to exist, and as such O_CREAT (this time the flag we pass to
    open(2)) needs to be cleaned from open_flags, otherwise we'll see
    another failure (this time unexpected) when trying to open the file,
    which will lead the call to sem_open to fail as well.
    
    This can cause very strange bugs, especially with OpenMPI, which makes
    extensive use of semaphores.
    
    Fix the bug by simplifying the logic when choosing open(2) flags and
    making sure O_CREAT is not set when the semaphore file is expected to
    exist.
    
    A regression test for this issue would require a complex and cpu time
    consuming logic, since to trigger the wrong code path is not
    straightforward due the racy condition.  There is a somewhat reliable
    reproducer in the bug, but it requires using OpenMPI.
    
    This resolves BZ #30789.
    
    See also: https://bugs.launchpad.net/ubuntu/+source/h5py/+bug/2031912
    
    Signed-off-by: Sergio Durigan Junior <sergiodj@sergiodj.net>
    Co-Authored-By: Simon Chopin <simon.chopin@canonical.com>
    Co-Authored-By: Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>
    Fixes: 533deafbdf189f5fbb280c28562dd43ace2f4b0f ("Use O_CLOEXEC in more places (BZ #15722)")
    (cherry picked from commit f957f47df75b9fab995754011491edebc6feb147)
    (cherry picked from commit 63dbbc5c52f9823f86270f32fce20d1e91cdf484)

 NEWS                       |  2 ++
 sysdeps/pthread/sem_open.c | 10 ++++------
 2 files changed, 6 insertions(+), 6 deletions(-)

commit b83465a8ca0c6705e7a48e3286261d989bb9c3ea (tag: gentoo/glibc-2.38-7)
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Thu Oct 19 09:17:38 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Thu Oct 26 22:39:52 2023 +0200

    Revert "elf: Move l_init_called_next to old place of l_text_end in link map"
    
    This reverts commit d3ba6c1333b10680ce5900a628108507d9d4b844.
    
    Reason: Preserve internal ABI.
    (cherry picked from commit 1e04dcec491bd8f48b5b74ce3e8414132578a645)

 include/link.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

commit 0071d694f2cf3f1e79a1364b081d204ef7bebcb8 (tag: gentoo/glibc-2.38-6)
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Wed Oct 18 14:25:46 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Oct 18 21:00:04 2023 +0200

    Revert "elf: Always call destructors in reverse constructor order (bug 30785)"
    
    This reverts commit a3189f66a5f2fe86568286fa025fa153be04c6c0.
    
    Reason for revert: Incompatibility with existing applications.
    
    (cherry picked from commit 719866ab2ff0e6d514a04fb47e507d92e70ef7ee)

 NEWS                       |   1 -
 elf/dl-close.c             | 113 ++++++++++++---------------------
 elf/dl-fini.c              | 152 +++++++++++++++++++++++++++++----------------
 elf/dl-init.c              |  16 -----
 elf/dso-sort-tests-1.def   |  19 ++++--
 elf/tst-audit23.c          |  44 ++++++-------
 sysdeps/generic/ldsodefs.h |   4 --
 7 files changed, 173 insertions(+), 176 deletions(-)

commit f23d121596d5c48b5acc80a07988c64b0214d43b
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Wed Oct 18 14:22:59 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Oct 18 20:59:39 2023 +0200

    Revert "elf: Remove unused l_text_end field from struct link_map"
    
    This reverts commit 750f19526ae71aac801c77a3f7ef5374890c09b7.
    
    Reason for revert: Restore ABI after revert of commit a3189f66a5f.
    
    (cherry picked from commit e0b6c9706c91a642c781918eea52588ee8dc9f09)

 elf/dl-load.c    | 2 +-
 elf/dl-load.h    | 7 +++++--
 elf/rtld.c       | 6 ++++++
 elf/setup-vdso.h | 4 ++++
 include/link.h   | 2 ++
 5 files changed, 18 insertions(+), 3 deletions(-)

commit 01242dfdcaa473f865d6826b7d731755be518928
Author:     Gleb Fotengauer-Malinovskiy <glebfm@altlinux.org>
AuthorDate: Wed Sep 20 05:00:00 2023 +0000
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Thu Oct 5 10:21:22 2023 +0200

    elf/dl-tunables.c: avoid processing of tunables in AT_SECURE executables
    
    Complements: owl-alt-sanitize-env

 elf/dl-tunables.c | 3 +++
 1 file changed, 3 insertions(+)

commit 63348f40c0e27de7898b8c19a4730c90e6139311 (tag: gentoo/glibc-2.38-5)
Author:     Siddhesh Poyarekar <siddhesh@sourceware.org>
AuthorDate: Tue Sep 19 18:39:32 2023 -0400
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Tue Oct 3 20:08:56 2023 +0200

    tunables: Terminate if end of input is reached (CVE-2023-4911)
    
    The string parsing routine may end up writing beyond bounds of tunestr
    if the input tunable string is malformed, of the form name=name=val.
    This gets processed twice, first as name=name=val and next as name=val,
    resulting in tunestr being name=name=val:name=val, thus overflowing
    tunestr.
    
    Terminate the parsing loop at the first instance itself so that tunestr
    does not overflow.
    
    This also fixes up tst-env-setuid-tunables to actually handle failures
    correct and add new tests to validate the fix for this CVE.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa)
    (cherry picked from commit 750a45a783906a19591fb8ff6b7841470f1f5701)

 NEWS                          |  5 +++++
 elf/dl-tunables.c             | 17 ++++++++++-------
 elf/tst-env-setuid-tunables.c | 37 +++++++++++++++++++++++++++++--------
 3 files changed, 44 insertions(+), 15 deletions(-)

commit f239c2e9664d4693d62ac081cdbfa7fa65b44f4a
Author:     Siddhesh Poyarekar <siddhesh@sourceware.org>
AuthorDate: Tue Sep 19 13:25:40 2023 -0400
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Tue Oct 3 20:08:28 2023 +0200

    Propagate GLIBC_TUNABLES in setxid binaries
    
    GLIBC_TUNABLES scrubbing happens earlier than envvar scrubbing and some
    tunables are required to propagate past setxid boundary, like their
    env_alias.  Rely on tunable scrubbing to clean out GLIBC_TUNABLES like
    before, restoring behaviour in glibc 2.37 and earlier.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 0d5f9ea97f1b39f2a855756078771673a68497e1)
    (cherry picked from commit 73e3fcd1a552783e66ff1f65c5f322e2f17a81d1)

 sysdeps/generic/unsecvars.h | 1 -
 1 file changed, 1 deletion(-)

commit 5687086280183623d143816a27e640b6675b89d9 (tag: gentoo/glibc-2.38-4)
Author:     Siddhesh Poyarekar <siddhesh@sourceware.org>
AuthorDate: Tue Sep 26 07:38:07 2023 -0400
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Sep 27 11:30:31 2023 +0200

    Document CVE-2023-4806 and CVE-2023-5156 in NEWS
    
    These are tracked in BZ #30884 and BZ #30843.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit fd134feba35fa839018965733b34d28a09a075dd)
    (cherry picked from commit f6445dc94da185b3d1ee283f0ca0a34c4e1986cc)

 NEWS | 9 +++++++++
 1 file changed, 9 insertions(+)

commit 4239cf689516ca2bab013994feed150cffc9e4fa
Author:     Romain Geissler <romain.geissler@amadeus.com>
AuthorDate: Mon Sep 25 01:21:51 2023 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Sep 27 11:30:05 2023 +0200

    Fix leak in getaddrinfo introduced by the fix for CVE-2023-4806 [BZ #30843]
    
    This patch fixes a very recently added leak in getaddrinfo.
    
    This was assigned CVE-2023-5156.
    
    Resolves: BZ #30884
    Related: BZ #30842
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit ec6b95c3303c700eb89eebeda2d7264cc184a796)
    (cherry picked from commit 5ee59ca371b99984232d7584fe2b1a758b4421d3)

 nss/Makefile                    | 20 ++++++++++++++++++++
 nss/tst-nss-gai-hv2-canonname.c |  3 +++
 sysdeps/posix/getaddrinfo.c     |  4 +---
 3 files changed, 24 insertions(+), 3 deletions(-)

commit f307c5e962056bdfed8db4d160e2413b76a03c55 (tag: gentoo/glibc-2.38-3)
Author:     Mark Wielaard <mark@klomp.org>
AuthorDate: Thu Aug 24 21:36:34 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Sep 16 00:05:33 2023 +0200

    manual/jobs.texi: Add missing @item EPERM for getpgid
    
    The missing @item makes it look like errno will be set to ESRCH
    if a cross-session getpgid is not permitted.
    
    Found by ulfvonbelow on irc.
    
    (cherry picked from commit 5a21cefd5abab1b99eda1fbf84204a9bf41662ab)
    (cherry picked from commit 0e1ef6779a90bc0f8a05bc367796df2793deecaa)

 manual/job.texi | 1 +
 1 file changed, 1 insertion(+)

commit 0a06af9fee4c56fe06bb475caf6bfbf9fb2895ce
Author:     Mahesh Bodapati <bmahi496@linux.ibm.com>
AuthorDate: Fri Aug 11 10:38:25 2023 -0500
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Sep 16 00:05:20 2023 +0200

    string: Fix tester build with fortify enable with gcc < 12
    
    When building with fortify enabled, GCC < 12 issues a warning on the
    fortify strncat wrapper might overflow the destination buffer (the
    failure is tied to -Werror).
    
    Checked on ppc64 and x86_64.
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    
    (cherry picked from commit f1c7ed0859a45929136836341741c7cd70f428cb)
    (cherry picked from commit d94461bb86ba176b9390c0015bb612a528e22d95)

 string/tester.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

commit 73be767721621ee49cce82948f2433f74e2c04bb
Author:     Andreas Schwab <schwab@suse.de>
AuthorDate: Tue Aug 1 17:01:37 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Sat Sep 16 00:05:04 2023 +0200

    iconv: restore verbosity with unrecognized encoding names (bug 30694)
    
    Commit 91927b7c76 ("Rewrite iconv option parsing [BZ #19519]") changed the
    iconv program to call __gconv_open directly instead of the iconv_open
    wrapper, but the former does not set errno.  Update the caller to
    interpret the return codes like iconv_open does.
    
    (cherry picked from commit fc72b6d7d818ab2868920af956d1542d03342a4d)
    (cherry picked from commit 63250e9c571314b6daa2c949ea0af335ee766751)

 iconv/iconv_prog.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 3cba58595df08e263b43b4a2cc19f660133d891e
Author:     Siddhesh Poyarekar <siddhesh@sourceware.org>
AuthorDate: Fri Sep 15 13:51:12 2023 -0400
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:46:34 2023 +0200

    getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
    
    When an NSS plugin only implements the _gethostbyname2_r and
    _getcanonname_r callbacks, getaddrinfo could use memory that was freed
    during tmpbuf resizing, through h_name in a previous query response.
    
    The backing store for res->at->name when doing a query with
    gethostbyname3_r or gethostbyname2_r is tmpbuf, which is reallocated in
    gethosts during the query.  For AF_INET6 lookup with AI_ALL |
    AI_V4MAPPED, gethosts gets called twice, once for a v6 lookup and second
    for a v4 lookup.  In this case, if the first call reallocates tmpbuf
    enough number of times, resulting in a malloc, th->h_name (that
    res->at->name refers to) ends up on a heap allocated storage in tmpbuf.
    Now if the second call to gethosts also causes the plugin callback to
    return NSS_STATUS_TRYAGAIN, tmpbuf will get freed, resulting in a UAF
    reference in res->at->name.  This then gets dereferenced in the
    getcanonname_r plugin call, resulting in the use after free.
    
    Fix this by copying h_name over and freeing it at the end.  This
    resolves BZ #30843, which is assigned CVE-2023-4806.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 973fe93a5675c42798b2161c6f29c01b0e243994)
    (cherry picked from commit 00ae4f10b504bc4564e9f22f00907093f1ab9338)

 nss/Makefile                                       | 15 +++++-
 nss/nss_test_gai_hv2_canonname.c                   | 56 +++++++++++++++++++
 nss/tst-nss-gai-hv2-canonname.c                    | 63 ++++++++++++++++++++++
 nss/tst-nss-gai-hv2-canonname.h                    |  1 +
 nss/tst-nss-gai-hv2-canonname.root/postclean.req   |  0
 .../tst-nss-gai-hv2-canonname.script               |  2 +
 sysdeps/posix/getaddrinfo.c                        | 25 ++++++---
 7 files changed, 152 insertions(+), 10 deletions(-)

commit 30e278f7b43f07b7b5fabf8232cb0482c79399b6
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Wed Sep 13 14:10:56 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:46:13 2023 +0200

    CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
    
    Without passing alt_dns_packet_buffer, __res_context_search can only
    store 2048 bytes (what fits into dns_packet_buffer).  However,
    the function returns the total packet size, and the subsequent
    DNS parsing code in _nss_dns_gethostbyname4_r reads beyond the end
    of the stack-allocated buffer.
    
    Fixes commit f282cdbe7f436c75864e5640a4 ("resolv: Implement no-aaaa
    stub resolver option") and bug 30842.
    
    (cherry picked from commit bd77dd7e73e3530203be1c52c8a29d08270cb25d)
    (cherry picked from commit b25508dd774b617f99419bdc3cf2ace4560cd2d6)

 NEWS                          |   9 +++
 resolv/Makefile               |   2 +
 resolv/nss_dns/dns-host.c     |   2 +-
 resolv/tst-resolv-noaaaa-vc.c | 129 ++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 141 insertions(+), 1 deletion(-)

commit d749eb775ce31675788d5ac1f86fe023a2109ac2
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Mon Sep 11 10:06:15 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:45:55 2023 +0200

    NEWS: Add the 2.38.1 bug list
    
    (cherry picked from commit 89da8bc588c2296252543b049bf6d9272321f90d)

 NEWS | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

commit d8c325e099b98b1c46f62527c0bd9d262b5d1fd3
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Mon Sep 11 09:17:52 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:45:38 2023 +0200

    elf: Move l_init_called_next to old place of l_text_end in link map
    
    This preserves all member offsets and the GLIBC_PRIVATE ABI
    for backporting.
    
    (cherry picked from commit d3ba6c1333b10680ce5900a628108507d9d4b844)

 include/link.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

commit 7c2515e5a156c7015bbdd710ab9939eb8db9ab60
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Fri Sep 8 13:02:06 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:45:21 2023 +0200

    elf: Remove unused l_text_end field from struct link_map
    
    It is a left-over from commit 52a01100ad011293197637e42b5be1a479a2
    ("elf: Remove ad-hoc restrictions on dlopen callers [BZ #22787]").
    
    When backporting commmit 6985865bc3ad5b23147ee73466583dd7fdf65892
    ("elf: Always call destructors in reverse constructor order
    (bug 30785)"), we can move the l_init_called_next field to this
    place, so that the internal GLIBC_PRIVATE ABI does not change.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Tested-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 53df2ce6885da3d0e89e87dca7b095622296014f)
    (cherry picked from commit 750f19526ae71aac801c77a3f7ef5374890c09b7)

 elf/dl-load.c    | 2 +-
 elf/dl-load.h    | 7 ++-----
 elf/rtld.c       | 6 ------
 elf/setup-vdso.h | 4 ----
 include/link.h   | 2 --
 5 files changed, 3 insertions(+), 18 deletions(-)

commit 9ae52eecb570ad74764137a56aacd647b09fdea5
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Fri Sep 8 12:32:14 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:45:01 2023 +0200

    elf: Always call destructors in reverse constructor order (bug 30785)
    
    The current implementation of dlclose (and process exit) re-sorts the
    link maps before calling ELF destructors.  Destructor order is not the
    reverse of the constructor order as a result: The second sort takes
    relocation dependencies into account, and other differences can result
    from ambiguous inputs, such as cycles.  (The force_first handling in
    _dl_sort_maps is not effective for dlclose.)  After the changes in
    this commit, there is still a required difference due to
    dlopen/dlclose ordering by the application, but the previous
    discrepancies went beyond that.
    
    A new global (namespace-spanning) list of link maps,
    _dl_init_called_list, is updated right before ELF constructors are
    called from _dl_init.
    
    In dl_close_worker, the maps variable, an on-stack variable length
    array, is eliminated.  (VLAs are problematic, and dlclose should not
    call malloc because it cannot readily deal with malloc failure.)
    Marking still-used objects uses the namespace list directly, with
    next and next_idx replacing the done_index variable.
    
    After marking, _dl_init_called_list is used to call the destructors
    of now-unused maps in reverse destructor order.  These destructors
    can call dlopen.  Previously, new objects do not have l_map_used set.
    This had to change: There is no copy of the link map list anymore,
    so processing would cover newly opened (and unmarked) mappings,
    unloading them.  Now, _dl_init (indirectly) sets l_map_used, too.
    (dlclose is handled by the existing reentrancy guard.)
    
    After _dl_init_called_list traversal, two more loops follow.  The
    processing order changes to the original link map order in the
    namespace.  Previously, dependency order was used.  The difference
    should not matter because relocation dependencies could already
    reorder link maps in the old code.
    
    The changes to _dl_fini remove the sorting step and replace it with
    a traversal of _dl_init_called_list.  The l_direct_opencount
    decrement outside the loader lock is removed because it appears
    incorrect: the counter manipulation could race with other dynamic
    loader operations.
    
    tst-audit23 needs adjustments to the changes in LA_ACT_DELETE
    notifications.  The new approach for checking la_activity should
    make it clearer that la_activty calls come in pairs around namespace
    updates.
    
    The dependency sorting test cases need updates because the destructor
    order is always the opposite order of constructor order, even with
    relocation dependencies or cycles present.
    
    There is a future cleanup opportunity to remove the now-constant
    force_first and for_fini arguments from the _dl_sort_maps function.
    
    Fixes commit 1df71d32fe5f5905ffd5d100e5e9ca8ad62 ("elf: Implement
    force_first handling in _dl_sort_maps_dfs (bug 28937)").
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 6985865bc3ad5b23147ee73466583dd7fdf65892)
    (cherry picked from commit a3189f66a5f2fe86568286fa025fa153be04c6c0)

 NEWS                       |   7 +++
 elf/dl-close.c             | 113 +++++++++++++++++++++------------
 elf/dl-fini.c              | 152 ++++++++++++++++-----------------------------
 elf/dl-init.c              |  16 +++++
 elf/dso-sort-tests-1.def   |  19 ++----
 elf/tst-audit23.c          |  44 +++++++------
 include/link.h             |   4 ++
 sysdeps/generic/ldsodefs.h |   4 ++
 8 files changed, 186 insertions(+), 173 deletions(-)

commit 7382f3eb9890cb286e6876056bef88fcc7f4061e
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Tue Aug 22 13:56:25 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:44:29 2023 +0200

    elf: Do not run constructors for proxy objects
    
    Otherwise, the ld.so constructor runs for each audit namespace
    and each dlmopen namespace.
    
    (cherry picked from commit f6c8204fd7fabf0cf4162eaf10ccf23258e4d10e)
    (cherry picked from commit 7ae211a01b085d0bde54bd13b887ce8f9d57c2b4)

 elf/dl-init.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

commit bcfb847830eab94be532014b8ee1d2cf6fa0b610
Author:     Adam Jackson <ajax@redhat.com>
AuthorDate: Fri Sep 8 15:55:19 2023 -0400
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:44:12 2023 +0200

    libio: Fix oversized __io_vtables
    
    IO_VTABLES_LEN is the size of the struct array in bytes, not the number
    of __IO_jump_t's in the array. Drops just under 384kb from .rodata on
    LP64 machines.
    
    Fixes: 3020f72618e ("libio: Remove the usage of __libc_IO_vtables")
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    Reviewed-by: Florian Weimer <fweimer@redhat.com>
    Tested-by: Florian Weimer <fweimer@redhat.com>
    (cherry picked from commit 8cb69e054386f980f9ff4d93b157861d72b2019e)
    (cherry picked from commit 92201f16cbcfd9eafe314ef6654be2ea7ba25675)

 libio/vtables.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

commit 3c8fe579dc0feead147a1d67ab2c3bd2aff27ac1
Author:     Aurelien Jarno <aurelien@aurel32.net>
AuthorDate: Mon Aug 28 23:30:37 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:43:55 2023 +0200

    io: Fix record locking contants for powerpc64 with __USE_FILE_OFFSET64
    
    Commit 5f828ff824e3b7cd1 ("io: Fix F_GETLK, F_SETLK, and F_SETLKW for
    powerpc64") fixed an issue with the value of the lock constants on
    powerpc64 when not using __USE_FILE_OFFSET64, but it ended-up also
    changing the value when using __USE_FILE_OFFSET64 causing an API change.
    
    Fix that by also checking that define, restoring the pre
    4d0fe291aed3a476a commit values:
    
    Default values:
    - F_GETLK: 5
    - F_SETLK: 6
    - F_SETLKW: 7
    
    With -D_FILE_OFFSET_BITS=64:
    - F_GETLK: 12
    - F_SETLK: 13
    - F_SETLKW: 14
    
    At the same time, it has been noticed that there was no test for io lock
    with __USE_FILE_OFFSET64, so just add one.
    
    Tested on x86_64-linux-gnu, i686-linux-gnu and
    powerpc64le-unknown-linux-gnu.
    
    Resolves: BZ #30804.
    Co-authored-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
    (cherry picked from commit 434bf72a94de68f0cc7fbf3c44bf38c1911b70cb)
    (cherry picked from commit 5bdef6f27c91f45505ed5444147be4ed0e9bc3c7)

 NEWS                                         | 2 ++
 io/Makefile                                  | 1 +
 io/tst-fcntl-lock-lfs.c                      | 2 ++
 sysdeps/unix/sysv/linux/powerpc/bits/fcntl.h | 2 +-
 4 files changed, 6 insertions(+), 1 deletion(-)

commit 3655fa1d10a0c23e146da47bf6c6e6b7087b99fe
Author:     Sam James <sam@gentoo.org>
AuthorDate: Thu Aug 17 09:30:29 2023 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:43:28 2023 +0200

    sysdeps: tst-bz21269: fix -Wreturn-type
    
    Thanks to Andreas Schwab for reporting.
    
    Fixes: 652b9fdb77d9fd056d4dd26dad2c14142768ab49
    Signed-off-by: Sam James <sam@gentoo.org>
    (cherry picked from commit 369f373057073c307938da91af16922bda3dff6a)
    (cherry picked from commit 1aed90c9c8f8be9f68b58e96b6e4cd0fc08eb2b1)

 sysdeps/unix/sysv/linux/i386/tst-bz21269.c | 2 --
 1 file changed, 2 deletions(-)

commit ed51a5a6ce550304cccbd654db6f6f225d17ae2a
Author:     Sam James <sam@gentoo.org>
AuthorDate: Sat Aug 5 00:04:33 2023 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:43:03 2023 +0200

    sysdeps: tst-bz21269: handle ENOSYS & skip appropriately
    
    SYS_modify_ldt requires CONFIG_MODIFY_LDT_SYSCALL to be set in the kernel, which
    some distributions may disable for hardening. Check if that's the case (unset)
    and mark the test as UNSUPPORTED if so.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    Signed-off-by: Sam James <sam@gentoo.org>
    (cherry picked from commit 652b9fdb77d9fd056d4dd26dad2c14142768ab49)
    (cherry picked from commit ad9b8399537670a990572c4b0c4da5411e3b68cf)

 sysdeps/unix/sysv/linux/i386/tst-bz21269.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

commit 6a637a4fff958997b4c01b549589fc96055f07b9
Author:     Sam James <sam@gentoo.org>
AuthorDate: Fri Aug 4 23:58:27 2023 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Fri Sep 15 22:42:47 2023 +0200

    sysdeps: tst-bz21269: fix test parameter
    
    All callers pass 1 or 0x11 anyway (same meaning according to man page),
    but still.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    Signed-off-by: Sam James <sam@gentoo.org>
    (cherry picked from commit e0b712dd9183d527aae4506cd39564c14af3bb28)
    (cherry picked from commit c8ecda6251dd4a0dfe074e0a6011211cadeef742)

 sysdeps/unix/sysv/linux/i386/tst-bz21269.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 69ee5dc11a56c29c240161ec4dae6abd3c952776 (tag: gentoo/glibc-2.38-2)
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Thu Aug 10 19:36:56 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Aug 23 13:37:06 2023 +0200

    malloc: Remove bin scanning from memalign (bug 30723)
    
    On the test workload (mpv --cache=yes with VP9 video decoding), the
    bin scanning has a very poor success rate (less than 2%).  The tcache
    scanning has about 50% success rate, so keep that.
    
    Update comments in malloc/tst-memalign-2 to indicate the purpose
    of the tests.  Even with the scanning removed, the additional
    merging opportunities since commit 542b1105852568c3ebc712225ae78b
    ("malloc: Enable merging of remainders in memalign (bug 30723)")
    are sufficient to pass the existing large bins test.
    
    Remove leftover variables from _int_free from refactoring in the
    same commit.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 0dc7fc1cf094406a138e4d1bcf9553e59edcf89d)
    (cherry picked from commit 2af141bda3cd407abd4bedf615f9e45fe79518e2)

 NEWS                    |   1 +
 malloc/malloc.c         | 169 ++----------------------------------------------
 malloc/tst-memalign-2.c |   7 +-
 3 files changed, 11 insertions(+), 166 deletions(-)

commit 12249ca1b007c9d86a744af9b57bcc7e31d5a7b4
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Fri Aug 11 11:18:17 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Aug 23 13:36:49 2023 +0200

    malloc: Enable merging of remainders in memalign (bug 30723)
    
    Previously, calling _int_free from _int_memalign could put remainders
    into the tcache or into fastbins, where they are invisible to the
    low-level allocator.  This results in missed merge opportunities
    because once these freed chunks become available to the low-level
    allocator, further memalign allocations (even of the same size are)
    likely obstructing merges.
    
    Furthermore, during forwards merging in _int_memalign, do not
    completely give up when the remainder is too small to serve as a
    chunk on its own.  We can still give it back if it can be merged
    with the following unused chunk.  This makes it more likely that
    memalign calls in a loop achieve a compact memory layout,
    independently of initial heap layout.
    
    Drop some useless (unsigned long) casts along the way, and tweak
    the style to more closely match GNU on changed lines.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 542b1105852568c3ebc712225ae78b8c8ba31a78)
    (cherry picked from commit 98c293c61f770b6b7a22f89a6ea81b711ecb1952)

 malloc/malloc.c | 197 ++++++++++++++++++++++++++++++++++----------------------
 1 file changed, 121 insertions(+), 76 deletions(-)

commit c8563e31fe575c503cfcaf2d1638ecf00fd587cf
Author:     Adhemerval Zanella <adhemerval.zanella@linaro.org>
AuthorDate: Tue Aug 8 09:27:55 2023 -0300
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Aug 23 13:36:33 2023 +0200

    i686: Fix build with --disable-multiarch
    
    Since i686 provides the fortified wrappers for memcpy, mempcpy,
    memmove, and memset on the same string implementation, the static
    build tries to optimized it by not tying the fortified wrappers
    to string routine (to avoid pulling the fortify function if
    they are not required).
    
    Checked on i686-linux-gnu building with different option:
    default and --disable-multi-arch plus default, --disable-default-pie,
    --enable-fortify-source={2,3}, and --enable-fortify-source={2,3}
    with --disable-default-pie.
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    
    (cherry picked from commit c73c96a4a1af1326df7f96eec58209e1e04066d8)
    (cherry picked from commit 7ac405a74c6069b0627dc2d8449a82a621f8ff06)

 sysdeps/i386/i686/memcpy.S                | 2 +-
 sysdeps/i386/i686/mempcpy.S               | 2 +-
 sysdeps/i386/i686/multiarch/memcpy_chk.c  | 2 ++
 sysdeps/i386/i686/multiarch/memmove_chk.c | 2 ++
 sysdeps/i386/i686/multiarch/mempcpy_chk.c | 2 ++
 sysdeps/i386/i686/multiarch/memset_chk.c  | 2 ++
 6 files changed, 10 insertions(+), 2 deletions(-)

commit 136fefff5c5b80a85bc6fb7ae4fffd62acb217f7
Author:     Adhemerval Zanella <adhemerval.zanella@linaro.org>
AuthorDate: Tue Aug 8 09:27:54 2023 -0300
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Aug 23 13:36:15 2023 +0200

    x86_64: Fix build with --disable-multiarch (BZ 30721)
    
    With multiarch disabled, the default memmove implementation provides
    the fortify routines for memcpy, mempcpy, and memmove.  However, it
    does not provide the internal hidden definitions used when building
    with fortify enabled.  The memset has a similar issue.
    
    Checked on x86_64-linux-gnu building with different options:
    default and --disable-multi-arch plus default, --disable-default-pie,
    --enable-fortify-source={2,3}, and --enable-fortify-source={2,3}
    with --disable-default-pie.
    Tested-by: Andreas K. Huettel <dilfridge@gentoo.org>
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    
    (cherry picked from commit 51cb52214fcd72849c640b12f5099ed3ac776181)
    (cherry picked from commit 6135d50e44233d8c89ca788f78c669941ad09fb9)

 sysdeps/x86_64/memcpy.S  | 2 +-
 sysdeps/x86_64/memmove.S | 3 +++
 sysdeps/x86_64/memset.S  | 1 +
 3 files changed, 5 insertions(+), 1 deletion(-)

commit df043ed8177611029e49be4e73a16c3923cdc2da
Author:     Noah Goldstein <goldstein.w.n@gmail.com>
AuthorDate: Thu Aug 10 19:28:24 2023 -0500
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Aug 23 13:35:56 2023 +0200

    x86: Fix incorrect scope of setting `shared_per_thread` [BZ# 30745]
    
    The:
    
    ```
        if (shared_per_thread > 0 && threads > 0)
          shared_per_thread /= threads;
    ```
    
    Code was accidentally moved to inside the else scope.  This doesn't
    match how it was previously (before af992e7abd).
    
    This patch fixes that by putting the division after the `else` block.
    
    (cherry picked from commit 084fb31bc2c5f95ae0b9e6df4d3cf0ff43471ede)
    (cherry picked from commit 5ea70cc02626d9b85f1570153873d8648a47bf95)

 sysdeps/x86/dl-cacheinfo.h | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

commit 737904507691fce7dbc9a59dfbbcba1c14580367
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Fri Aug 11 10:10:16 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Aug 23 13:35:37 2023 +0200

    nscd: Do not rebuild getaddrinfo (bug 30709)
    
    The nscd daemon caches hosts data from NSS modules verbatim, without
    filtering protocol families or sorting them (otherwise separate caches
    would be needed for certain ai_flags combinations).  The cache
    implementation is complete separate from the getaddrinfo code.  This
    means that rebuilding getaddrinfo is not needed.  The only function
    actually used is __bump_nl_timestamp from check_pf.c, and this change
    moves it into nscd/connections.c.
    
    Tested on x86_64-linux-gnu with -fexceptions, built with
    build-many-glibcs.py.  I also backported this patch into a distribution
    that still supports nscd and verified manually that caching still works.
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 039ff51ac7e02db1cfc0c23e38ac7bfbb00221d1)
    (cherry picked from commit 6b99458d197ab779ebb6ff632c168e2cbfa4f543)

 include/ifaddrs.h                  |  4 ---
 inet/check_pf.c                    |  9 -------
 nscd/Makefile                      |  2 +-
 nscd/connections.c                 | 11 +++++++++
 nscd/gai.c                         | 50 --------------------------------------
 sysdeps/unix/sysv/linux/check_pf.c | 17 +------------
 6 files changed, 13 insertions(+), 80 deletions(-)

commit 9a74d9a7e1ccb876b1a3e4b8f54b82b06c796016
Author:     Sajan Karumanchi <sajan.karumanchi@amd.com>
AuthorDate: Tue Aug 1 15:20:55 2023 +0000
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Aug 23 13:35:18 2023 +0200

    x86: Fix for cache computation on AMD legacy cpus.
    
    Some legacy AMD CPUs and hypervisors have the _cpuid_ '0x8000_001D'
    set to Zero, thus resulting in zeroed-out computed cache values.
    This patch reintroduces the old way of cache computation as a
    fail-safe option to handle these exceptions.
    Fixed 'level4_cache_size' value through handle_amd().
    
    Reviewed-by: Premachandra Mallappa <premachandra.mallappa@amd.com>
    Tested-by: Florian Weimer <fweimer@redhat.com>
    (cherry picked from commit ced101ed9d3b7cfd12d97ef24940cb00b8658c81)

 sysdeps/x86/dl-cacheinfo.h | 226 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 199 insertions(+), 27 deletions(-)

commit ca9228846b6d7cca04fa29cd91f27d956146e3ff
Author:     Florian Weimer <fweimer@redhat.com>
AuthorDate: Tue Aug 1 10:27:15 2023 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Wed Aug 23 13:35:03 2023 +0200

    stdlib: Improve tst-realpath compatibility with source fortification
    
    On GCC before 11, IPA can make the fortified realpath aware that the
    buffer size is not large enough (8 bytes instead of PATH_MAX bytes).
    Fix this by using a buffer that is large enough.
    
    (cherry picked from commit 510fc20d73de12c85823d9996faac74666e9c2e7)
    (cherry picked from commit d97cca1e5df812be0e4de1e38091f02bb1e7ec4e)

 stdlib/tst-realpath.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

commit fa7f864c669e484728fa6812b71466ee0efda875 (tag: gentoo/glibc-2.38-1)
Author:     Adhemerval Zanella <adhemerval.zanella@linaro.org>
AuthorDate: Fri Jan 27 14:28:34 2023 -0300
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Mon Jul 31 22:14:43 2023 +0200

    linux: Use getdents64 on readdir64 compat implementation
    
    It uses a similar strategy from the non-LFS readdir that also
    uses getdents64 internally and uses a translation buffer to return
    the compat readdir64 entry.
    
    It allows to remove __old_getdents64.
    
    Checked on i686-linux-gnu.

 sysdeps/unix/sysv/linux/dirstream.h  | 13 ++++-
 sysdeps/unix/sysv/linux/getdents64.c | 93 ------------------------------------
 sysdeps/unix/sysv/linux/olddirent.h  |  2 -
 sysdeps/unix/sysv/linux/readdir64.c  | 50 ++++++++++++++-----
 4 files changed, 50 insertions(+), 108 deletions(-)

commit b7328979355208b2fff3440aa31a61cd555eda42
Author:     Adhemerval Zanella <adhemerval.zanella@linaro.org>
AuthorDate: Fri Jan 27 14:28:33 2023 -0300
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Mon Jul 31 22:14:40 2023 +0200

    linux: Add __old_readdir64_unlocked
    
    And use it __old_readdir64_r.
    
    Checked on i686-linux-gnu.

 sysdeps/unix/sysv/linux/olddirent.h   |  2 +
 sysdeps/unix/sysv/linux/readdir64.c   | 24 +++++++----
 sysdeps/unix/sysv/linux/readdir64_r.c | 79 ++++++++---------------------------
 3 files changed, 35 insertions(+), 70 deletions(-)

commit be0329ac6b93d5421cf3cfa1ff55f25b9a163028
Author:     Adhemerval Zanella <adhemerval.zanella@linaro.org>
AuthorDate: Fri Jan 27 14:28:32 2023 -0300
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Mon Jul 31 22:14:38 2023 +0200

    linux: Add __readdir64_unlocked
    
    And use it on readdir_r implementation.
    
    Checked on i686-linux-gnu.

 include/dirent.h                      |  1 +
 sysdeps/unix/sysv/linux/readdir64.c   | 20 ++++++---
 sysdeps/unix/sysv/linux/readdir64_r.c | 80 ++++++++---------------------------
 3 files changed, 33 insertions(+), 68 deletions(-)

commit 78ff7263cf6825c7a4b8523b03f9d8ee3b1e7915
Author:     Adhemerval Zanella <adhemerval.zanella@linaro.org>
AuthorDate: Fri Jan 27 14:28:31 2023 -0300
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Mon Jul 31 22:14:35 2023 +0200

    linux: Set internal DIR filepos as off64_t (BZ #23960, BZ #24050)
    
    It allows to obtain the expected entry offset on telldir and set
    it correctly on seekdir on platforms where long int is smaller
    than off64_t.
    
    On such cases opendir creates a map entry between the DIR d_off
    offset and the returned long int (the telldir return value).
    seekdir will then set the correct offset from the internal list
    using the telldir as the list key.
    
    It also removes the overflow check on readdir and the returned value
    will be truncated by the non-LFS off_t size.  As Joseph has noted
    in BZ #23960 comment #22, d_off is an opaque value and since
    telldir/seekdir works regardless of the returned dirent d_off value.
    
    Finally it removes the requirement to check for overflow values on
    telldir (BZ #24050).
    
    Checked on x86_64-linux-gnu, i686-linux-gnu, powerpc-linux-gnu,
    and arm-linux-gnueabihf.

 dirent/tst-seekdir.c                        |   8 ++
 sysdeps/unix/sysv/linux/Makefile            |   1 +
 sysdeps/unix/sysv/linux/alpha/bits/dirent.h |   3 +
 sysdeps/unix/sysv/linux/bits/dirent.h       |   4 +
 sysdeps/unix/sysv/linux/closedir.c          |   4 +
 sysdeps/unix/sysv/linux/dirstream.h         |   6 +-
 sysdeps/unix/sysv/linux/opendir.c           |   3 +
 sysdeps/unix/sysv/linux/readdir.c           |  11 ++-
 sysdeps/unix/sysv/linux/rewinddir.c         |   5 +
 sysdeps/unix/sysv/linux/seekdir.c           |  35 ++++++-
 sysdeps/unix/sysv/linux/telldir.c           |  35 +++++++
 sysdeps/unix/sysv/linux/telldir.h           |  65 +++++++++++++
 sysdeps/unix/sysv/linux/tst-opendir-nolfs.c | 146 ++++++++++++++++++++++++++++
 13 files changed, 319 insertions(+), 7 deletions(-)

commit 7165ae0d0f3e181b18cb79e139821b1f00ded059
Author:     Adhemerval Zanella <adhemerval.zanella@linaro.org>
AuthorDate: Fri Jan 27 14:28:30 2023 -0300
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Mon Jul 31 22:14:32 2023 +0200

    linux: Use getdents64 on non-LFS readdir
    
    The non-LFS opendir reserves a translation entry to be used to return
    the entry and the dirent64 struct is translated to the temporary buffer
    on each readdir call.
    
    Entries that overflow d_off/d_ino and the buffer reallocation failure
    (in case of large d_name) are ignored.
    
    Checked on x86_64-linux-gnu and i686-linux-gnu.

 dirent/tst-scandir.c                |  6 ++-
 include/dirent.h                    |  2 +-
 sysdeps/unix/sysv/linux/dirstream.h |  5 +++
 sysdeps/unix/sysv/linux/readdir.c   | 83 +++++++++++++++++++++++++------------
 4 files changed, 67 insertions(+), 29 deletions(-)

commit 68f5f814329f282a8c5fb71cce36b2b3e5d4b925
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: Sat Jul 11 20:06:51 2020 +0300
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Mon Jul 31 22:14:29 2023 +0200

    Fix miscompilation on ia64's gcc-10
    
    Bug: https://bugs.gentoo.org/723268
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 sysdeps/unix/sysv/linux/ia64/dl-sysdep.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

commit a00120d733fa937b69adaa68d09af43d9c845824
Author:     Andreas K. Hüttel <dilfridge@gentoo.org>
AuthorDate: Fri Dec 14 20:43:04 2018 +0100
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Mon Jul 31 22:14:26 2023 +0200

    Force -O0 in conform tests to survive $CC changes
    
    In bug #659030 Gentoo started passing user's CFLAGS via $CC variable.
    conform tests should but are not ready to handle -O1/-O2 yet.
    Tests fail to validate headers due to inlining of weak symbol aliases
    and other problems. Let's force it back to -O0 until it's fixed upstream.
    
    Original patch by Sergei, ported to the new python test framework by Andreas
    
    Bug: https://bugs.gentoo.org/659030
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 conform/conformtest.py   | 6 ++++--
 conform/linknamespace.py | 4 +++-
 2 files changed, 7 insertions(+), 3 deletions(-)

commit af7770c80f9f361d661d8392670386b07dd987ab
Author:     Andreas K. Hüttel <dilfridge@gentoo.org>
AuthorDate: Mon Oct 22 22:34:13 2018 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Mon Jul 31 22:14:23 2023 +0200

    Adapt to Gentoo-specific /etc/mail/aliases
    
    Patch by pacho2
    
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
    (cherry picked from commit 4e616cda056f471b799beba2b1cedc787ad4ecc0)
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 nss/nss_files/files-alias.c    |  2 +-
 nss/tst-nss-files-alias-leak.c | 18 +++++++++---------
 support/support_chroot.c       |  8 +++++++-
 3 files changed, 17 insertions(+), 11 deletions(-)

commit e6c168146be4790fcf80dda1076b38fe7fdfe45d
Author:     Mike Frysinger <vapier@gentoo.org>
AuthorDate: Tue Aug 3 00:34:59 2021 +0200
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: Mon Jul 31 22:14:20 2023 +0200

    Disable ldconfig during install
    
    Do not bother running ldconfig on DESTDIR.  It's a waste of time as we
    won't use the result (portage will rebuild the cache after install).
    Also, the Gentoo sandbox does not currently catch chroot() behavior so
    we end up (incorrectly) flagging it as a violation as a write to /etc.
    
    http://sourceware.org/ml/libc-alpha/2012-08/msg00118.html
    https://bugs.gentoo.org/431038
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 Makefile | 1 +
 1 file changed, 1 insertion(+)
