summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorLines
2020-06-02move declaration of interfaces between malloc and ldso to dynlink.hRich Felker-5/+4
this eliminates consumers of malloc_impl.h outside of the malloc implementation.
2020-06-02reformat clock_adjtime with always-true condition removedRich Felker-48/+46
2020-06-02always use time64 syscall first for clock_adjtimeRich Felker-2/+1
clock_adjtime always returns the current clock setting in struct timex, so it's always possible that the time64 version is needed.
2020-06-02fix broken time64 clock_adjtimeRich Felker-1/+1
the 64-bit time code path used the wrong (time32) syscall. fortunately this code path is not yet taken unless attempting to set a post-Y2038 time.
2020-06-02fix unbounded heap expansion race in mallocRich Felker-152/+87
this has been a longstanding issue reported many times over the years, with it becoming increasingly clear that it could be hit in practice. under concurrent malloc and free from multiple threads, it's possible to hit usage patterns where unbounded amounts of new memory are obtained via brk/mmap despite the total nominal usage being small and bounded. the underlying cause is that, as a fundamental consequence of keeping locking as fine-grained as possible, the state where free has unbinned an already-free chunk to merge it with a newly-freed one, but has not yet re-binned the combined chunk, is exposed to other threads. this is bad even with small chunks, and leads to suboptimal use of memory, but where it really blows up is where the already-freed chunk in question is the large free region "at the top of the heap". in this situation, other threads momentarily see a state of having almost no free memory, and conclude that they need to obtain more. as far as I can tell there is no fix for this that does not harm performance. the fix made here forces all split/merge of free chunks to take place under a single lock, which also takes the place of the old free_lock, being held at least momentarily at the time of free to determine whether there are neighboring free chunks that need merging. as a consequence, the pretrim, alloc_fwd, and alloc_rev operations no longer make sense and are deleted. simplified merging now takes place inline in free (__bin_chunk) and realloc. as commented in the source, holding the split_merge_lock precludes any chunk transition from in-use to free state. for the most part, it also precludes change to chunk header sizes. however, __memalign may still modify the sizes of an in-use chunk to split it into two in-use chunks. arguably this should require holding the split_merge_lock, but that would necessitate refactoring to expose it externally, which is a mess. and it turns out not to be necessary, at least assuming the existing sloppy memory model malloc has been using, because if free (__bin_chunk) or realloc sees any unsynchronized change to the size, it will also see the in-use bit being set, and thereby can't do anything with the neighboring chunk that changed size.
2020-06-01suppress unwanted warnings when configuring with clangRich Felker-0/+7
coding style warnings enabled by default in clang have long been a source of spurious questions/bug-reports. since clang provides a -w that behaves differently from gcc's, and that lets us enable any warnings we may actually want after turning them all off to start with a clean slate, use it at configure time if clang is detected.
2020-05-22restore lock-skipping for processes that return to single-threaded stateRich Felker-6/+12
the design used here relies on the barrier provided by the first lock operation after the process returns to single-threaded state to synchronize with actions by the last thread that exited. by storing the intent to change modes in the same object used to detect whether locking is needed, it's possible to avoid an extra (possibly costly) memory load after the lock is taken.
2020-05-22cut down size of some libc struct membersRich Felker-3/+3
these are all flags that can be single-byte values.
2020-05-22don't use libc.threads_minus_1 as relaxed atomic for skipping locksRich Felker-3/+3
after all but the last thread exits, the next thread to observe libc.threads_minus_1==0 and conclude that it can skip locking fails to synchronize with any changes to memory that were made by the last-exiting thread. this can produce data races. on some archs, at least x86, memory synchronization is unlikely to be a problem; however, with the inline locks in malloc, skipping the lock also eliminated the compiler barrier, and caused code that needed to re-check chunk in-use bits after obtaining the lock to reuse a stale value, possibly from before the process became single-threaded. this in turn produced corruption of the heap state. some uses of libc.threads_minus_1 remain, especially for allocation of new TLS in the dynamic linker; otherwise, it could be removed entirely. it's made non-volatile to reflect that the remaining accesses are only made under lock on the thread list. instead of libc.threads_minus_1, libc.threaded is now used for skipping locks. the difference is that libc.threaded is permanently true once an additional thread has been created. this will produce some performance regression in processes that are mostly single-threaded but occasionally creating threads. in the future it may be possible to bring back the full lock-skipping, but more care needs to be taken to produce a safe design.
2020-05-22reorder thread list unlink in pthread_exit after all locksRich Felker-8/+11
since the backend for LOCK() skips locking if single-threaded, it's unsafe to make the process appear single-threaded before the last use of lock. this fixes potential unsynchronized access to a linked list via __dl_thread_cleanup.
2020-05-21fix incorrect SIGSTKFLT on all mips archsRich Felker-3/+3
signal 7 is SIGEMT on Linux mips* ABI according to the man pages and kernel. it's not clear where the wrong name came from but it dates back to original mips commit.
2020-05-21handle possibility that SIGEMT replaces SIGSTKFLT in strsignalRich Felker-0/+10
presently all archs define SIGSTKFLT but this is not correct. change strsignal as a prerequisite for fixing that.
2020-05-19fix return value of res_send, res_query on errors from nameserverRich Felker-1/+1
the internal __res_msend returns 0 on timeout without having obtained any conclusive answer, but in this case has not filled in meaningful anslen. res_send wrongly treated that as success, but returned a zero answer length. any reasonable caller would eventually end up treating that as an error when attempting to parse/validate it, but it should just be reported as an error. alternatively we could return the last-received inconclusive answer (typically servfail), but doing so would require internal changes in __res_msend. this may be considered later.
2020-05-19fix handling of errors resolving one of paired A+AAAA queryRich Felker-4/+7
the old logic here likely dates back, at least in inspiration, to before it was recognized that transient errors must not be allowed to reflect the contents of successful results and must be reported to the application. here, the dns backend for getaddrinfo, when performing a paired query for v4 and v6 addresses, accepted results for one address family even if the other timed out. (the __res_msend backend does not propagate error rcodes back to the caller, but continues to retry until timeout, so other error conditions were not actually possible.) this patch moves the checks to take place before answer parsing, and performs them for each answer rather than only the answer to the first query. if nxdomain is seen it's assumed to apply to both queries since that's how dns semantics work.
2020-05-18set AD bit in dns queries, suppress for internal useRich Felker-0/+3
the AD (authenticated data) bit in outgoing dns queries is defined by rfc3655 to request that the nameserver report (via the same bit in the response) whether the result is authenticated by DNSSEC. while all results returned by a DNSSEC conforming nameserver will be either authenticated or cryptographically proven to lack DNSSEC protection, for some applications it's necessary to be able to distinguish these two cases. in particular, conforming and compatible handling of DANE (TLSA) records requires enforcing them only in signed zones. when the AD bit was first defined for queries, there were reports of compatibility problems with broken firewalls and nameservers dropping queries with it set. these problems are probably a thing of the past, and broken nameservers are already unsupported. however, since there is no use in the AD bit with the netdb.h interfaces, explicitly clear it in the queries they make. this ensures that, even with broken setups, the standard functions will work, and at most the res_* functions break.
2020-04-30fix undefined behavior from signed overflow in strstr and memmemRich Felker-8/+8
unsigned char promotes to int, which can overflow when shifted left by 24 bits or more. this has been reported multiple times but then forgotten. it's expected to be benign UB, but can trap when built with explicit overflow catching (ubsan or similar). fix it now. note that promotion to uint32_t is safe and portable even outside of the assumptions usually made in musl, since either uint32_t has rank at least unsigned int, so that no further default promotions happen, or int is wide enough that the shift can't overflow. this is a desirable property to have in case someone wants to reuse the code elsewhere.
2020-04-26remove arm (32-bit) support for vdso clock_gettimeRich Felker-6/+0
it's been reported that the vdso clock_gettime64 function on (32-bit) arm is broken, producing erratic results that grow at a rate far greater than one reported second per actual elapsed second. the vdso function seems to have been added sometime between linux 5.4 and 5.6, so if there's ever been a working version, it was only present for a very short window. it's not clear what the eventual upstream kernel solution will be, but something needs to be done on the libc side so as not to be producing binaries that seem to work on older/existing/lts kernels (which lack the function and thus lack the bug) but will break fantastically when moving to newer kernels. hopefully vdso support will be added back soon, but with a new symbol name or version from the kernel to allow continued rejection of broken ones.
2020-04-24fix undefined behavior in wcsto[ld] family functionsRich Felker-4/+2
analogous to commit b287cd745c2243f8e5114331763a5a9813b5f6ee but for the custom FILE stream type the wcstol and wcstod family use. __toread could be used here as well, but there's a simple direct fix to make the buffer pointers initially valid for subtraction, so just do that to avoid pulling in stdio exit code in programs that don't use stdio.
2020-04-18fix sh fesetround failure to clear old modeRich Felker-0/+2
the sh version of fesetround or'd the new rounding mode onto the control register without clearing the old rounding mode bits, making changes sticky. this was the root cause of multiple test failures.
2020-04-17move __string_read into vsscanf source fileRich Felker-21/+13
apparently this function was intended at some point to be used by strto* family as well, and thus was put in its own file; however, as far as I can tell, it's only ever been used by vsscanf. move it to the same file to reduce the number of source files and external symbols.
2020-04-17remove spurious repeated semicolon in fmemopenRich Felker-1/+1
2020-04-17combine two calls to memset in fmemopenRich Felker-2/+2
this idea came up when I thought we might need to zero the UNGET portion of buf as well, but it seems like a useful improvement even when that turned out not to be necessary.
2020-04-17fix possible access to uninitialized memory in shgetc (via scanf)Rich Felker-1/+1
shgetc sets up to be able to perform an "unget" operation without the caller having to remember and pass back the character value, and for this purpose used a conditional store idiom: if (f->rpos[-1] != c) f->rpos[-1] = c to make it safe to use with non-writable buffers (setup by the sh_fromstring macro or __string_read with sscanf). however, validity of this depends on the buffer space at rpos[-1] being initialized, which is not the case under some conditions (including at least unbuffered files and fmemopen ones). whenever data was read "through the buffer", the desired character value is already in place and does not need to be written. thus, rather than testing for the absence of the value, we can test for rpos<=buf, indicating that the last character read could not have come from the buffer, and thereby that we have a "real" buffer (possibly of zero length) with writable pushback (UNGET bytes) below it.
2020-04-17fix undefined behavior in scanf coreRich Felker-0/+3
as reported/analyzed by Pascal Cuoq, the shlim and shcnt macros/functions are called by the scanf core (vfscanf) with f->rpos potentially null (if the FILE is not yet activated for reading at the time of the call). in this case, they compute differences between a null pointer (f->rpos) and a non-null one (f->buf), resulting in undefined behavior. it's unlikely that any observably wrong behavior occurred in practice, at least without LTO, due to limits on what's visible to the compiler from translation unit boundaries, but this has not been checked. fix is simply ensuring that the FILE is activated for read mode before entering the main scanf loop, and erroring out early if it can't be.
2020-03-24math: add x86_64 remquolAlexander Monakov-0/+32
2020-03-24math: move x87-family fmod functions to C with inline asmAlexander Monakov-44/+38
2020-03-24math: move x87-family remainder functions to C with inline asmAlexander Monakov-50/+42
2020-03-24math: move x87-family rint functions to C with inline asmAlexander Monakov-24/+28
2020-03-24math: move x87-family lrint functions to C with inline asmAlexander Monakov-60/+64
2020-03-24math: move x86_64 (l)lrint(f) functions to C with inline asmAlexander Monakov-20/+32
2020-03-24math: move i386 sqrt to C with inline asmAlexander Monakov-21/+15
2020-03-24math: move i386 sqrtf to C with inline asmAlexander Monakov-7/+12
2020-03-24math: move trivial x86-family sqrt functions to C with inline asmAlexander Monakov-18/+28
2020-03-24math: move x87-family fabs functions to C with inline asmAlexander Monakov-24/+28
2020-03-24math: move x86_64 fabs, fabsf to C with inline asmAlexander Monakov-16/+20
2020-03-21fix parsing offsets after long timezone namesSamuel Holland-5/+5
TZ containg a timezone name with >TZNAME_MAX characters currently breaks musl's timezone parsing. getname() stops after TZNAME_MAX characters. getoff() will consume no characters (because the next character is not a digit) and incorrectly return 0. Then, because there are remaining alphabetic characters, __daylight == 1, and dst_off == -3600. getname() must consume the entire timezone name, even if it will not fit in d/__tzname, so when it returns, s points to the offset digits.
2020-03-21avoid out-of-bounds read for invalid quoted timezoneSamuel Holland-2/+2
Parsing the timezone name must stop when reaching the null terminator. In that case, there is no '>' to skip.
2020-03-20remove redundant condition in memccpyAlexander Monakov-1/+1
Commit d9bdfd164 ("fix memccpy to not access buffer past given size") correctly added a check for 'n' nonzero, but made the pre-existing test '*s==c' redundant: n!=0 implies *s==c. Remove the unnecessary check. Reported by Alexey Izbyshev.
2020-03-20ldso: remove redundant switch case for REL_NONEFangrui Song-2/+0
as a result of commit b6a6cd703ffefa6352249fb01f4da28d85d17306, the REL_NONE case is now redundant.
2020-03-14define MAP_SYNC on powerpc/powerpc64Samuel Holland-2/+0
Linux defines MAP_SYNC on powerpc and powerpc64 as of commit 22fcea6f85f2 ("mm: move MAP_SYNC to asm-generic/mman-common.h"), so we can stop undefining it on those architectures.
2020-03-14improve strerror speedTimo Teräs-22/+32
change the current O(n) lookup to O(1) based on the machinery described in "How To Write Shared Libraries" (Appendix B).
2020-03-14fix corrupt sysvipc timestamps on 32-bit archs with old kernelsRich Felker-0/+30
kernel commit 4693916846269d633a3664586650dbfac2c5562f (first included in release v4.14) silently fixed a bug whereby the reserved space (which was later used for high bits of time) in IPC_STAT structures was left untouched rather than zeroed. this means that a caller that wants to read the high bits needs to pre-zero the memory. since it's not clear that these operations are permitted to modify the destination buffer on failure, use a temp buffer and copy back to the caller's buffer on success.
2020-03-14work around negated error code bug on some mips kernelsRich Felker-22/+22
on all mips variants, Linux did (and maybe still does) have some syscall return paths that wrongly return both the error flag in r7 and a negated error code in r2. in particular this happened for at least some causes of ENOSYS. add an extra check to only negate the error code if it's positive to begin with. bug report and concept for patch by Andreas Dröscher.
2020-03-14remove useless mips syscall asm constraint, align style with mips64/n32Rich Felker-15/+16
commit 4221f154ff29ab0d6be1e7beaa5ea2d1731bc58e added the r7 constraint apparently out of a misunderstanding of the breakage it was addressing, and did so because the asm was in a shared macro used by all the __syscallN inline functions. now "+r" is used in the output section for the forms 4-argument and up, so having it in input is redundant, and the forms with 0-3 arguments don't need it as an input at all. the r2 constraint is kept because without it most gcc versions (seems to be all prior to 9.x) fail to honor the output register binding for r2. this seems to be a variant of gcc bug #87733. both the r7 and r2 input constraints look useless, but the r2 one was a quiet workaround for gcc bug 87733, which affects all modern versions prior to 9.x, so it's kept and documented.
2020-03-14revert mips (32-bit, o32) syscall asm clean-up due to regressionsRich Felker-32/+31
exactly revert commit 604f8d3d8b08ee4f548de193050ef93a7753c2e0 which was wrong; it caused a major regression on Linux versions prior to 2.6.36. old kernels did not properly preserve r2 across syscall restart, and instead restarted with the instruction right before syscall, imposing a contract that the previous instruction must load r2 from an immediate or a register (or memory) not clobbered by the syscall.
2020-03-14revert mips64/n32 syscall asm clean-up due to regressionsRich Felker-56/+61
effectivly revert commit ddc7c4f936c7a90781072f10dbaa122007e939d0 which was wrong; it caused a major regression on Linux versions prior to 2.6.36. old kernels did not properly preserve r2 across syscall restart, and instead restarted with the instruction right before syscall, imposing a contract that the previous instruction must load r2 from an immediate or a register (or memory) not clobbered by the syscall. since other changes were made since, including removal of the struct stat conversion that was replaced by separate struct kstat, this is not a direct revert, only a functional one. the "0"(r2) input constraint added back seems useless/erroneous, but without it most gcc versions (seems to be all prior to 9.x) fail to honor the output register binding for r2. this seems to be a variant of gcc bug #87733. further changes should be made later if a better workaround is found, but this one has been working since 2012. it seems this issue was encountered but misidentified then, when it inspired commit 4221f154ff29ab0d6be1e7beaa5ea2d1731bc58e.
2020-03-04remove duplicate definitions of INET[6]_ADDRSTRLENRich Felker-7/+0
these were leftover from early beginnings when arpa/inet.h was not including netinet/in.h.
2020-02-26add PTHREAD_NULLRich Felker-0/+3
this is added for POSIX-future as the outcome of Austin Group issue 599. since it's in the reserved namespace for pthread.h, there are no namespace considerations for adding it early.
2020-02-22use __socketcall to simplify socket()Rich Felker-5/+5
commit 59324c8b0950ee94db846a50554183c845ede160 added __socketcall analogous to __syscall, returning the negated error rather than setting errno. use it to simplify the fallback path of socket(), avoiding extern calls and access to errno. Author: Rich Felker <dalias@aerifal.cx> Date: Tue Jul 30 17:51:16 2019 -0400 make __socketcall analogous to __syscall, error-returning
2020-02-21remove wrap_write helper from vdprintfRich Felker-6/+1
this reverts commit 4ee039f3545976f9e3e25a7e5d7b58f1f2316dc3, which added the helper as a hack to make vdprintf usable before relocation, contingent on strong assumptions about the arch and tooling, back when the dynamic linker did not have a real staged model for self-relocation. since commit f3ddd173806fd5c60b3f034528ca24542aecc5b9 this has been unnecessary and the function was just wasting size and execution time.