commit 045c51476c7abf6144815a4db44f51a118b4cb3e Author: Stian Halseth Date: Sun Oct 11 18:32:49 2026 +0200 linux: Do not return stack garbage in sparc tcgetattr c_cc [BZ #34734] The sparc kernel's struct termios2 declares 19 c_cc entries, but TCGETS2 only writes the first 17 and TCSETS2 only reads them. Since the termios rework in glibc 2.42, tcgetattr copies all 19 from an uninitialized struct termios2 on its stack, so c_cc[17] and c_cc[18] return whatever was there before. Two tcgetattr calls on the same terminal can then disagree, which fails Python's test_termios and test_tty. Set _TERMIOS2_NCCS to 17 for sparc, as __KERNEL_NCCS was before 2.42. The struct size and layout do not change, since c_ispeed is aligned to 4 bytes either way, and c_cc[17] onwards is filled with _POSIX_VDISABLE again. Add a test that calls tcgetattr twice with different stack contents and compares the results. Link: https://github.com/sparclinux/issues/issues/112 Signed-off-by: Stian Halseth Reviewed-by: Avinal Kumar (cherry picked from commit e4080b50a38a9e07b6fb5d75f3786e36031d8bd2) commit 34106fee698c83eb0af71d4d0381e66b399be746 Author: Sachin Monga Date: Thu Oct 1 00:51:23 2026 +0530 powerpc: Fix one byte overread in strncasecmp (bug 34683, CVE-2026-97399) The Power8 strncasecmp (strcasecmp.S with USE_AS_STRNCASECMP) touches s1[n]/s2[n] in three places when the first n bytes compare equal and contain no NUL: L(loop) preloads the next byte before its bdnz; L(loop1) increments then loads before its bdnz; and L(bytebybyte) loads s1[0]/s2[0] before checking r5. A caller that maps exactly n readable bytes can get SIGSEGV if byte n falls on an unmapped page. The L(bytebybyte) site was identified by Florian Weimer; the original AISLE report covered only the two loops. Fix all three sites: guard L(bytebybyte) with a r5 == 0 check, split the bdnz/load pairs in L(loop) and L(loop1) so the load only runs when the count is still positive, and preload rCHAR1/rCHAR2 in L(lessthan4) after confirming r5 != 0. strcasecmp is unaffected; its generated code is unchanged. Add string/test-strncasecmp-nonarray.c, built on the test-Xncmp-nonarray.c skeleton: maps a PROT_NONE page past both buffers and sweeps all start offsets and lengths. Runs as an xtest. Reported-by: AISLE in partnership with Red Hat Suggested-by: Florian Weimer (cherry picked from commit e622f82ea8797704ac8f761f88ed3e429e97fedd) commit 07dc0a64a3256151beb20a2b4ebc77ee74ebe0dc Author: Samuel Thibault Date: Mon Sep 28 01:23:15 2026 +0200 realloc: Fix mmap non-mremap reallocation case [BZ #34697] This case was missing copying SIZE_SZ bytes from the old allocation. Fixes commit 614cfd0f8a2820aed54f9745077c7da0e6643bac ("malloc: Change mmap chunk layout"), which went into glibc 2.43. Checked by Wilco Dijkstra Resolves #34697. (cherry picked from commit 1e0512a684809e32170eae42c8f04f61126d77cc) commit c90398e00571476711792baacb6d92bd2a7b6891 Author: DJ Delorie Date: Mon Sep 28 14:27:16 2026 +0200 CVE-2026-89092: nscd: replace alloca with malloc in aicache, hstcache This changes the alloca fallback to a malloc fallback in the addrinfo and host cache code. This fixes bug 34624. Co-authored-by: Florian Weimer Reviewed-by: Adhemerval Zanella (cherry picked from commit cbf59b836645b6ac69ad8c47a560598bc4942ecc) commit 67dd5150c6c1f76262b7d76ecbc296c564376c74 Author: mengqinggang Date: Mon Aug 24 17:48:52 2026 +0800 LoongArch: Add standard search paths for 32-bit Previously, add_system_dir added different paths depending on the ABI: ilp32d: /lib32 ilp32s: /lib32/sf Now, add_sysmtem_dir adds all of the following directories to standard search path for both ilp32d ABI and ilp32s ABI: /lib /lib32 /lib32/sf /lib64 /lib64/sf This change fixes elf/tst-ptrguard-static-dlopen on ilp32s ABI. The test is a statically linked executable with dlopen tst-ptrguard-static-dlopen-mod.so. Without this patch, the test fails because it looks for ld.so in /lib32/sf, but the file is actually in /lib32. (cherry picked from commit b3d14eff4fe5c9a3d52ab076d3edd29f96f0082d) commit 2ee4e25c971eedb25a9413e17f38a88e2f5b43c3 Author: mengqinggang Date: Mon Aug 10 16:44:53 2026 +0800 LoongArch: Support pointer guard on LoongArch32 LoongArch32 Reduced has no rotri.d/rotri.w instructions. Use slli.w/srli.w/or to synthesize the rotation on LoongArch32 and LoongArch32 Reduced. Reported-by: Haiyong Sun (cherry picked from commit dd63105d1b883a9fb5603a5eb3e12aab64d72d47) commit 6dea23eeac895231d86c375891a580b27866f6e1 Author: mengqinggang Date: Wed Aug 5 16:03:34 2026 +0800 LoongArch: Fix intermittent nptl/tst-cancel32 failure The nptl/tst-cancel32 test fails intermittently on LoongArch with SIGSEGV at __longjmp: 0x7ffff7de7f6c <__longjmp+28> rotri.d $sp, $t0, 0x11 0x7ffff7de7f70 <__longjmp+32> xor $sp, $sp, $t1 rotri.d and xor are expanded from PTR_DEMANGLE2. If the thread is cancelled between the rotri.d and xor, an incomplete sp register causes the SIGSEGV. Change the destination register of rotri.d to avoid an incomplete sp. (cherry picked from commit 4b0c2842a85f2f3cbe4aa11bd8aea18487982ba8) commit 13fd9fe7df9783ef1471865786ecb841165b213e Author: Adhemerval Zanella Date: Mon Aug 31 13:09:36 2026 -0300 Revert "posix: Add POSIX aliases to some spawn functions" (BZ 34437) This reverts commit 7594b4e5a75d41e891782aa7e3fb51924f6840cb. Reviewed-by: Andreas K. Huettel (cherry picked from commit 24b18e1dfd46e05198a516133648fc18a49e3610) commit 1848099f063e99d4ffecbd7667766d54862398b9 Author: Mark Wielaard Date: Fri Sep 18 00:24:34 2026 +0200 stdlib: Don't call clearenv from __libc_setenv_freemem Since commit 7a61e7f557a9 ("stdlib: Make getenv thread-safe in more cases") clearenv doesn't call any deallocation functions anymore. __libc_setenv_freemem (called from __libc_freeres) now clears all backing arrays. So there is no reason anymore to call clearenv from __libc_setenv_freemem. Tested against valgrind memcheck with --run-libc-freeres=yes which is the default. Reviewed-by: Florian Weimer (cherry picked from commit b837aae83df8fe80c8977b5ed5c538aebd2b152a) commit 6b48c0b29c359dfa84c09c32373a48c8f663c304 Author: Adhemerval Zanella Date: Mon Aug 17 15:15:32 2026 -0300 elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (BZ 34360) For AT_SECURE programs the loader honors $ORIGIN in DT_RPATH only when the expansion is rooted in a trusted directory, but it validated the lexically normalized path while opening the raw expansion. As "a/b/../c" only names "a/c" when "b" is not a symlink, an attacker who controls a component of $ORIGIN -- e.g. by hard-linking the setuid binary into an attacker-owned directory -- can make the opened path escape the trusted directory even though the check passed, loading an attacker-controlled object. Normalize the expansion in place and open that, so the path that is opened is exactly the path that was validated. _dl_normalize_path rewrites the string in place without ever advancing its write cursor past its read cursor or appending, so it stays within the original storage. Add elf/tst-origin-secure as a regression test. Reviewed-by: Florian Weimer (cherry picked from commit ed0c137b97eb940b4b64981e84ed806d3276edd9) commit 1f5026241027260e9280039698bca031484c82ad Author: Adhemerval Zanella Date: Mon Sep 14 17:08:03 2026 -0300 resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674] update_from_conf copies the search list into the 256-byte resp->defdname and truncates it when an entry does not fit, then asserts that resolv_conf_matches accepts the result. The truncation check there compared the accumulated size against sizeof (resp->dnsrch) (the pointer array) instead of resp->defdname, and the empty-list case did not account for a first entry that does not fit at all. A long search domain in resolv.conf or LOCALDOMAIN thus aborts any process using the resolver. Check whether the entry fits in the remaining defdname space, matching alloc_buffer_copy_string, and also accept an empty resp->dnsrch when the first entry is too long. Add tests covering both cases through the search and domain directives. Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: Florian Weimer (cherry picked from commit 506ea57086bfb9ce3daff1c14246a1cb532aba0a) commit e01330dcec96ddc3495bb3c62fe59e4fc9bbe083 Author: Sam James Date: Sat Aug 29 17:02:29 2026 +0100 fcntl: drop nonnull attribute for openat, openat2's path argument [BZ #34313] .. and openat64. Linux 7.2 (31cf44efa6df72a524b40adefb80539f3a4e13ba) allows openat, openat2 to take a NULL path with the new O_EMPTYPATH flag, so the nonnull attribute is no longer sound. Drop it. Bug: https://sourceware.org/PR34313 Reviewed-by: Paul Eggert (cherry picked from commit f750ffab2f76ae10575cde110b4069ae7009667f) commit e58294a5a7e37971ab3827efbd0469ac6a19e4b8 Author: Sam James Date: Sat Aug 29 16:54:46 2026 +0100 io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313] Since Linux 6.11, AT_EMPTY_PATH can be used for a NULL path argument, so the nonnull attribute is no longer sound. Drop it. This bug was worked around in gnulib's 6db27b4dd36eda618db20e997ff56bbed7fce3cb. See also 55618e13968a60b89e5b226a23afaa8f17c5ef48 which fixed fstatat in glibc. Bug: https://sourceware.org/PR34313 Reviewed-by: Paul Eggert (cherry picked from commit 5bcfeca12b295908453c9045965842feb9e63ced) commit d7179269b79eb7394e980cb8ebd810629c686f0f Author: Sam James Date: Thu Sep 17 02:04:11 2026 +0100 Revert "io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]" This reverts commit b14c4b0bc95c25f9718807be07ad9a13442d2b6f. commit d19791b12ae5f054187ebe93a653c0ef90447a4f Author: H.J. Lu Date: Wed Sep 16 08:22:35 2026 +0800 x86-64: Link tst-shstk-legacy-1{f,g} with -Wl,--no-as-needed Link tst-shstk-legacy-1f and tst-shstk-legacy-1g with -Wl,--no-as-needed so that tst-shstk-legacy-mod-1.so is added to DT_NEEDED. This fixes BZ #31877. Signed-off-by: H.J. Lu Reviewed-by: Aurelien Jarno (cherry picked from commit 1db83d1652d35115525960021e4fb5b76dd1c633) commit b14c4b0bc95c25f9718807be07ad9a13442d2b6f Author: Sam James Date: Sat Aug 29 16:54:46 2026 +0100 io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313] Since Linux 6.11, AT_EMPTY_PATH can be used for a NULL path argument, so the nonnull attribute is no longer sound. Drop it. This bug was worked around in gnulib's 6db27b4dd36eda618db20e997ff56bbed7fce3cb. See also 55618e13968a60b89e5b226a23afaa8f17c5ef48 which fixed fstatat in glibc. Bug: https://sourceware.org/PR34313 commit b84047b5b792e1f028f4d82acbfa9ee9f6e89069 Author: Shamil Abdulaev Date: Fri Sep 11 14:59:48 2026 +0200 elf: Do not load cache extensions from an old-format ld.so.cache [BZ #34600] Since b9957a70b8 the cache extensions are loaded in _dl_maybe_load_ldsocache. A cache written by "ldconfig -c old" has no new-format header, so tmp_cache_new is NULL there and cache_extension_load dereferences it. Because __tunables_init loads the cache unconditionally, ld.so crashes at startup of every dynamically linked program. An old-format cache cannot carry extensions, so return early instead. Checked on x86_64-linux-gnu. Signed-off-by: Shamil Abdulaev Reviewed-by: Florian Weimer (cherry picked from commit fa91c51bb7bdd47ba4a1bb0ee7d66be101032ba5) commit b4f51887c48ac82acfdb13f96d9eab5d120cb2b7 Author: Hemanth Kumar M D Date: Mon Sep 7 01:59:06 2026 -0700 nptl: Skip pretty-printer tests without python3 [BZ #34507] The tests-printers-out rule in Rules wraps $(PYTHON) through $(test-wrapper-env). Unlike ordinary tests, which wrap a freshly built target binary, this wraps python3, a build-host tool. When cross-testing with test-wrapper set (e.g. via scripts/cross-test-ssh.sh) the whole command is forwarded to the target; if the target lacks python3 the shell returns 127 and evaluate-test.sh reports the six nptl pretty-printer tests as FAIL instead of UNSUPPORTED. scripts/test_printers_common.py already exits UNSUPPORTED (77) when its dependencies are missing, but that is unreachable when python3 itself is absent. Guard the invocation with a "command -v" check so the recipe exits 77 (UNSUPPORTED) when python3 is not found. Native builds are unaffected, as configure requires python3. Signed-off-by: Hemanth Kumar M D Suggested-by: Adhemerval Zanella Netto Reviewed-by: Adhemerval Zanella (cherry picked from commit c958d789db3bd8dbfb93868d8a975d13a3d66396) commit 30950ce64dbc29db0aedf1d46b6b8eb70b360f0c Author: Shamil Abdulaev Date: Thu Sep 3 20:19:42 2026 +0300 libio: Add test for fopen with an empty ", ccs=" value [BZ #34574] This goes on top of the fix for CVE-2026-18374. The test runs the reproducer from the bug report, plus "w,ccs=" and "w,ccs=,", and expects NULL with errno set to EINVAL. Signed-off-by: Shamil Abdulaev Reviewed-by: Florian Weimer (cherry picked from commit cca93e5d88d3d4ed073c03100467696f652269e7) commit 0b4e41fc51e6aba6216a908961b49b0622b47fa0 Author: Dongkyun Son Date: Fri Sep 4 21:28:41 2026 +0900 libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling When fopen() is called with a ,ccs= parameter whose value becomes empty after strip(), the code must reject it with EINVAL instead of attempting to use it. The original upstr() fallback could read past the ',' delimiter and cause a heap buffer overflow. The fix checks if the charset specification is empty after strip() and returns EINVAL immediately, preventing the overflow and following the approach described in BZ #34574. CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Reported-by: AISLE in partnership with Red Hat Signed-off-by: Dongkyun Son Reviewed-by: Florian Weimer (cherry picked from commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4) commit 5c479454d1232f71c78fa21584e90a2f57883407 Author: Adhemerval Zanella Date: Mon Aug 24 13:38:02 2026 -0300 powerpc: Fix preprocessor conditional in soft-float __longjmp (bug 34530) Commit 24d188a2a149b9933e17240e454f917e065cdf06 left a stray #endif in the powerpc32 soft-float __longjmp-common.S. Remove it, matching the fpu variant. Checked with a build for powerpc32-linux-gnu-soft. (cherry picked from commit 5f5bc63a4d8a7eec7f11e56664ca76455d837b22) commit 93606c5c1d2a571abf5d2e8af66e4f0aee9c67ba Author: Florian Weimer Date: Tue Aug 18 21:48:34 2026 +0200 powerpc: Fix non-atomic stack pointer update in fortified longjmp (bug 34530) After commit 78f1f0e39cd41d28ae771eb3498bc33780c85cfd ("Consolidate the C pointer guard and align the assembly implementations"), PTR_DEMANGLE3 on POWER no longer atomically updates the destination register. The fortified longjmp relies on atomic update of the stack pointer (r1) in sysdeps/powerpc/powerpc64/__longjmp-common.S and parallel files: #ifdef PTR_DEMANGLE # ifdef CHECK_SP PTR_DEMANGLE3 (r22, r22, r25) # else PTR_DEMANGLE3 (r1, r22, r25) # endif #endif Fix this by using PTR_DEMANGLE instead of PTR_DEMANGLE3. Remove PTR_MANGLE3 and PTR_DEMANGLE3 as unused. An alternate fix would store the pointer guard cookie rotated, but this would go against the unification in the commit that introduced the regression. Reviewed-by: Adhemerval Zanella (cherry picked from commit 24d188a2a149b9933e17240e454f917e065cdf06) commit 2d5421ffca8893534d5e02ad38c28acd8e778fa3 Author: H.J. Lu Date: Wed Aug 26 15:18:35 2026 +0800 Add check-symbol-version.awk commit 6deadd4eb6ab4f59d116b2d7ad97be0d0848cb7f Author: Adhemerval Zanella Date: Wed Oct 8 10:55:05 2025 -0300 didn't remove sysdeps/m68k/m680x0/fpu/w_fmod_compat.c. As the result, due to a linker bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34550 there were 2 default versions of fmod in m68k libm: 996: 0001433c 174 FUNC WEAK DEFAULT 12 fmod@@GLIBC_2.0 997: 000307d4 214 FUNC GLOBAL DEFAULT 12 fmod@@GLIBC_2.43 Add check-symbol-version.awk to verify that versioned symbols only have one default version in dynamic symbol table. Signed-off-by: H.J. Lu Reviewed-by: Sam James (cherry picked from commit 0e57c798c68eaf229a9fa8cb02179e43d4f8581a) commit 8587edfc9642b46232292b5722fec955851aa7c2 Author: Matt Turner Date: Mon Aug 3 19:55:09 2026 -0400 alpha: expect test-float32x-float64-div to fail _Float32x and _Float64 are both binary64 on Alpha, so this narrowing divide is a plain divide and the hardware alone decides whether to signal underflow. IEEE 754 determines tininess after rounding from the result rounded as if the exponent range were unbounded, while Alpha determines it from the delivered result. The two differ for a quotient that is tiny but rounds up to the smallest normal, as in DBL_MIN / (1 + 2^-52) under a rounding mode that rounds away from zero: the binade below DBL_MIN has a finer spacing than the subnormals, so the unbounded rounding stays below DBL_MIN and the result is tiny, but the delivered result is DBL_MIN and looks normal. Alpha signals no underflow for it. Nothing in software can correct this. The hardware detects no underflow, so no software completion trap is taken and the kernel emulation never runs, and as the operation is not really narrowing there is no wider intermediate for libm to examine. Reviewed-by: Adhemerval Zanella (cherry picked from commit a32db99a38c5f0c64b414af270830c3b6e3719c1) commit 3258c3fd9167ac5e1bfbb62b55710a139382d6a0 Author: Matt Turner Date: Mon Aug 3 19:55:06 2026 -0400 alpha: add the denormal trap enable bit to FE_NOMASK_ENV FE_NOMASK_ENV is the floating-point environment in which no exception is masked, so it must enable every exception that FE_ALL_EXCEPT covers. On Alpha that includes the GNU extension FE_DENORMAL, whose SWCR trap enable bit is IEEE_TRAP_ENABLE_DNO (bit 6). The constant only set bits 1 through 5 (INV, DZE, OVF, UNF and INE), so after fesetenv (FE_NOMASK_ENV) a subsequent fegetexcept () returned 0x3e0000 rather than FE_ALL_EXCEPT (0x7e0000), and denormal exceptions stayed masked. Set bit 6 as well. Fixes math/test-fenv-return on alpha. Reviewed-by: Adhemerval Zanella (cherry picked from commit 8e41f6008df3b5d56df199e8b4d19891666857a4) commit 890f1c13f0de88678db16f8f189d43b51b77b8dc Author: Magnus Lindholm Date: Mon Aug 3 17:51:59 2026 +0200 alpha: Fix stack alignment in makecontext The Alpha ABI requires the stack pointer to be 16-byte aligned. However, __makecontext did not realign it after reserving space for arguments. Depending on uc_stack.ss_size, this could leave the stack only 8-byte aligned. Round the new stack pointer down to a 16-byte boundary after reserving the argument area. This fixes stdlib/tst-makecontext2. Signed-off-by: Magnus Lindholm Reviewed-by: Adhemerval Zanella (cherry picked from commit 4a07bb292f921c10e71fbf48c4a7f44391feb06c) commit ca54198decdc3be693b010687f8de716a750b0e4 Author: Florian Weimer Date: Fri Aug 28 10:26:07 2026 +0200 iconvdata: Test case for bug 34556, bug 34568 Assisted-by: LLM Reviewed-by: Carlos O'Donell (cherry picked from commit 35efcffa97553df071bc37ab31fd7dc2c634e7da) commit cb61572ea3f773e1e1978f6c412cc36a30acdb0c Author: Florian Weimer Date: Fri Aug 28 10:26:07 2026 +0200 iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489) This fixes bug 34568. Reviewed-by: Carlos O'Donell (cherry picked from commit 4dafa087ff5fe7df45bd37dc727e988da6b8c935) commit 6f9b2bfa500bf5d1cff5d990adfff4b71298dadd Author: Florian Weimer Date: Fri Aug 28 10:26:07 2026 +0200 iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117) This fixes bug 34556. Reviewed-by: Carlos O'Donell (cherry picked from commit 68d94bbe50b7577d48998107d632ef3a0df050e3) commit 63b53df549451a5d69fcba6d7612ea99f517e8e3 Author: Florian Weimer Date: Thu Aug 27 13:34:54 2026 +0200 stdlib: Fix right-justification in strfmon (bug 34510, CVE-2026-19499) The memmove call did not take into account that __printf_buffer_pad updated the buffer pointers. Fixes commit e88b9f0e5cc50cab57a299dc7efe1a4eb385161d ("stdio-common: Convert vfprintf and related functions to buffers"), which went into glibc 2.37. Reviewed-by: Adhemerval Zanella (cherry picked from commit b090cf226ff65b913e41536f1f573f500855615c) commit 9c48b91ee34431f19fca47bf31e2f2ef77c119d5 Author: Adhemerval Zanella Date: Thu Aug 13 08:53:06 2026 -0300 posix: Remove unnecessary overflow check in wordexp (BZ 34090) The WRDE_APPEND path duplicates the caller's we_wordv array, which already holds we_offs + we_wordc + 1 pointers. Follow-up to commit e2cefe16c37. Checked on x86_64-linux-gnu and i686-linux-gnu. (cherry picked from commit 53ec26f1736aee747b353aaea0667b1ebdd5cae7) commit ae9225d55963c4420c49ccfa3f2fafc416f92032 Author: Andreas Schwab Date: Mon Aug 24 18:00:26 2026 +0200 m68k: remove sysdeps/m68k/m680x0/fpu/w_fmod_compat.c (bug 34559) This was missed from commit 6deadd4eb6. (cherry picked from commit ff1c5580610dee6d743169fc0f6684505d372dc9) commit d6ff274313d79feb864cc10eb775b91c817a67e9 Author: Florian Weimer Date: Fri Aug 14 13:41:16 2026 +0200 misc: Fix out-of-bounds array write in tdelete (bug 34506) Allocate the maximum array sizes directly, instead of resizing the arrays as needed. This eliminates alloca usage from the function, and fixes the out-of-bounds accesses. The asserts guard against the bug coming back if the balancing of the tree turns out not to work correctly. Reviewed-by: Adhemerval Zanella (cherry picked from commit e2789c46e3bfdcd67a82bea9946b315c179e83d3) commit afd131806b25715a7617ab757db43f0bb610acbf Author: Adhemerval Zanella Date: Wed Aug 12 09:03:17 2026 -0300 m68k: Fix fmod/fmodf infinite recursion (BZ 34508) Commits 6deadd4eb6a and ade9f30ce27 changed m68k fmod to call __m81_u(fmod), instead of the mathimpl.h inline __m81_u(__ieee754_fmod) (that wraps the m68k fmod instruction). This leads to infinite recursion. Tested-by: John Paul Adrian Glaubitz (cherry picked from commit bb213471bedc177b8efd3178584137fb81cc976a) commit 16be1518495f1fa05481b0182c4e4c24927c62df Author: Adhemerval Zanella Date: Mon Aug 3 11:02:53 2026 -0300 elf: Honour skip_ifunc for cross-object IFUNC relocations [BZ #34428] Commit 63b31c05a8a ("elf: Defer all IRELATIVE relocations until after PLT setup") dropped the skip_ifunc argument from elf_dynamic_do_Rel, assuming the new deferred elf_dynamic_do_Rel_irelative pass handles every relocation that may run an IFUNC resolver. That only holds for IFUNC symbols defined in the object being relocated: a reference to an IFUNC in another object is an ordinary JMP_SLOT or GLOB_DAT against an undefined symbol, and its IFUNC nature is only known after symbol resolution inside elf_machine_rel. Those relocations stay in the regular pass, which no longer propagated skip_ifunc, so __RTLD_NOIFUNC was ignored for them. ldd -u forces non-lazy binding (GLRO(dl_lazy) = 0 for DL_DEBUG_UNUSED), so the resolver was called and the diagnostic emitted: $ ldd -u /bin/ls /bin/ls: Relink `' with `/usr/lib64/libc.so.6' for IFUNC symbol `__mempcpy_chk' ldd -r with LD_BIND_NOW is affected in the same way. Restore the skip_ifunc parameter and thread it through _ELF_DYNAMIC_DO_RELOC. This new semantic shows that ELF_DYNAMIC_RELOCATE_NOIFUNC naming is misleading (it reads as "do not process IFUNC", yet it takes a skip_ifunc argument). Replace it to: DL_RELOC_BOTH -> DL_RELOC_ALL DL_RELOC_NOIFUNC -> DL_RELOC_NORMAL DL_RELOC_IFUNC -> DL_RELOC_IRELATIVE ELF_DYNAMIC_RELOCATE_NOIFUNC and ELF_DYNAMIC_RELOCATE_IFUNC become a single ELF_DYNAMIC_RELOCATE_PASS taking the pass as its first argument, and ELF_DYNAMIC_DO_REL/ELF_DYNAMIC_DO_RELA take the pass instead of having three near-identical variants each. Checked on x86_64-linux-gnu, and built for all supported architectures. Reviewed-by: Sam James (cherry picked from commit 2f2e9bae4093e1c3ba61250e340d3c3b99788f68) commit 11ac3d78fc5e4f7f2846002e099f773ad8ff82fc Author: Magnus Lindholm Date: Wed Aug 5 23:14:59 2026 +0200 string: Speed up strcasecmp test data initialization The strcasecmp and strncasecmp tests repeatedly initialize large buffers for many combinations of lengths and alignments. The existing loops perform a remainder operation and call toupper and tolower for every element. Generate at most max_char elements using an additive recurrence and apply the case conversions while creating this initial pattern. The recurrence produces the same sequence as the existing multiplication and remainder expression. Expand the completed pattern using bulk copies. This preserves the generated test data and locale-dependent case conversion while substantially reducing the initialization cost on slower systems. Signed-off-by: Magnus Lindholm Reviewed-by: Adhemerval Zanella (cherry picked from commit c1fb5d0e6b8d292ac526974d05c5adb4c3827fb0) commit 65d35639a9d055e423345c8748908c8aa48b19b9 Author: Magnus Lindholm Date: Wed Aug 5 23:14:58 2026 +0200 string: Speed up strcmp test data initialization The strcmp and strncmp tests repeatedly initialize large buffers for many combinations of lengths and alignments. The existing loops perform a remainder operation and two individual stores for every element. Generate at most max_char elements using an additive recurrence. The recurrence produces the same sequence as the existing multiplication and remainder expression. Expand this initial pattern using bulk copies, and then copy the completed first buffer to the second buffer. This preserves the generated test data while substantially reducing the initialization cost on slower systems. The change also applies to the wcscmp and wcsncmp tests, which include the same test sources. Signed-off-by: Magnus Lindholm Reviewed-by: Adhemerval Zanella (cherry picked from commit 9b323b95567dff46b34157ac4455734633921abb) commit 7cc7a3a4fbf15c8a7d61a69452f754f9c352cd62 Author: Matt Turner Date: Mon Aug 3 21:59:44 2026 -0400 stdio-common: avoid repeated regexp matches in tst-printf-format.awk Whether the value is an infinity, a NaN or zero does not change between the conversions applied to it, but was determined again for each one. Determine it where the value is read. Also look for the '#' flag with index() before matching the expressions that need it, and test the value first where both have to hold. For the %f conversion for double, in the C locale, as the median of five runs: x86_64, gawk 5.4.1 1.248s -> 1.184s x86_64, gawk 5.3.2 0.703s -> 0.708s alpha, gawk 5.4.60 26.6s -> 25.8s So this only helps with the regular expression engine that gawk 5.4 brought in; under 5.3.2 it is lost in the noise. Output and exit status are unchanged for the e, f and g conversions for double under both gawk versions and both locales. Reviewed-by: Adhemerval Zanella (cherry picked from commit 0cc3f9b3f3f2950844bd41cc8923215cd5d97269) commit 89da37bb6e4a631f375b5fe48783e5c023441b0c Author: Matt Turner Date: Tue Aug 4 10:17:20 2026 -0400 stdio-common: run AWK in the C locale in the printf format tests The program under test runs in the C locale, through the test program prefix, but AWK inherits whatever locale the build was started in. They agree today only because the locale in use shares its decimal point with the C locale. It is also faster. gawk takes a single byte path in its regular expression engine when MB_CUR_MAX is 1, and the script matches several expressions against every line. For the %f conversion for double, the largest of these tests, as the median of five runs: x86_64, gawk 5.4.1 1.482s -> 1.248s x86_64, gawk 5.3.2 0.911s -> 0.703s alpha, gawk 5.4.60 30.9s -> 26.6s Worth noting that gawk 5.4 is a good deal slower here than 5.3 was, at 1.248s against 0.703s for the same input in the C locale, so these tests have become more expensive than they used to be. Reviewed-by: Adhemerval Zanella (cherry picked from commit 866a70167b85903a02d4ccacb91afb8922702c14) commit eacd9cced93498e671c7e7f758aaf52593847e01 Author: Matt Turner Date: Sun Jul 26 14:43:11 2026 -0400 powerpc: Fix -mlong-double-128 IBM format configure test for Clang The check for -mlong-double-128 IBM extended format support wrapped its test code in AC_LANG_PROGRAM, which places the body inside main(). The body defines a function, so it became a nested function definition -- a GCC extension that Clang does not implement, making the test fail with Clang. Use AC_LANG_SOURCE so the function is defined at file scope, and regenerate configure. Reviewed-by: Sam James (cherry picked from commit 559d0f77f3ee1000cf8a2d0baba7a59a1ec45f50) commit 9e1b1ef77c7b1cc58f625500e9ea74fb3cafdf12 Author: Matt Turner Date: Sun Jul 26 00:27:37 2026 -0400 ldbl-opt: Fix -mlong-double-128 configure test for Clang The check for -mlong-double-128 support wrapped its test code in AC_LANG_PROGRAM, which places the body inside main(). The body defines a function, so it became a nested function definition -- a GCC extension that Clang does not implement, making the test fail (and thus the whole build error out) with Clang even though it supports -mlong-double-128. Use AC_LANG_SOURCE so the function is defined at file scope, matching the pattern already used by the powerpc64le compiler checks, and regenerate configure. Reviewed-by: Sam James (cherry picked from commit e7a14f03b8d5e34e8ac46db6c377da5c66a3ec2a) commit 4662c4675d7f3ba87637c61730f06071f305c5cb Author: Xi Ruoyao Date: Sun Jul 26 00:11:44 2026 +0800 elf: test: handle different rootsbindir in tst-ldconfig-cache When compiling a glibc for a merged-/usr distro people may set rootsbindir=/usr/sbin. But tst-ldconfig-cache has hard-coded /sbin/ldconfig path and so it fails with a different rootsbindir. Fix it by using support_install_rootsbindir like run_ldconfig in test-container.c. Signed-off-by: Xi Ruoyao Reviewed-by: Florian Weimer (cherry picked from commit 02ea17b5add83a205d8b204dce28f38fe0498ea3) commit 26b9cc42a051f78233fcecd2a3b83f98ec9862b9 Author: Adhemerval Zanella Date: Tue Jul 28 11:27:33 2026 -0300 benchtests: Create objdir in the bench-%.c generation rule The $(objpfx)bench-%.c rule writes its output into $(objpfx) without ensuring that directory exists. Serial builds happened to satisfy that ordering, with parallel builds the generation recipe can run before the directory is created, failing with: cannot create .../benchtests/bench-xxx.c-tmp: Directory nonexistent Add the standard $(make-target-directory). Reviewed-by: Florian Weimer (cherry picked from commit 26f0f2aa7d6ea63f85b5186349c41de2c91b4dd7) commit 10e3ce8a57e134c13dd28772de68542b0e3d4e86 Author: Adhemerval Zanella Date: Thu Aug 6 14:08:00 2026 -0300 arm: Order the rtld link after libgcc-stubs.a The librtld.map and librtld.os link recipes use $(gnulib), which on arm contains libgcc-stubs.a through gnulib-arch. But the archive is only a prerequisite of lib-noranlib so the rtld link can run before the archive exists: ld.bfd: cannot find .../elf/libgcc-stubs.a: No such file or directory The race seems to predates the parallel subdirectory recursion, which only made it observable. Add the order-only dependency in sysdeps/arm/Makefile rather than in elf/Makefile. Theprerequisite lists expand when the rule is parsed, and gnulib-arch is only defined once Makerules includes the sysdeps makefiles. Verified with a build for arm-linux-gnueabihf. Reviewed-by: Sam James (cherry picked from commit a33ceb6e96dc8de8d36de1b1f3ec06ceb524d012) commit f34027b27fefbc94aab04bff613ba5c24fb909b1 Author: Adhemerval Zanella Date: Thu Aug 6 14:07:59 2026 -0300 Makefile: Order the top-level stamp files before the subdirectory fan-out The archive rules in Makerules list every stamp file as a prerequisite, including the top level's own, and the elf sub-make evaluates them to build libc_pic.a for the librtld.map link. A sub-make can only create the stamp files of its own directory, so when the top-level ones do not exist yet it fails with: make[2]: *** No rule to make target '.../stamp.os', needed by '.../libc_pic.a'. Stop. The serial recursion created them before the subdirectories through the prerequisite order of subdir_lib; the parallel recursion (commit 7cac99621e96) does not. Add them as prerequisites of the object-building per-subdirectory targets. Reviewed-by: Sam James (cherry picked from commit 25c42d04c45fc5fdb1481a7f968782791b21fd3e) commit fc3641194619c7c327ef398c88c07b3069878ed3 Author: Adhemerval Zanella Date: Thu Aug 6 14:07:58 2026 -0300 Makerules: Make the .dt to .d conversion safe against concurrent sub-makes The %.d: %.dt rule seds its input into a fixed temporary name, renames it into place and removes the input. Two makes converting the same file trip over each other: mv: cannot stat '.../test-double-libmvec-sincos-avx512f.o.T': No such file or directory sed: can't read .../test-float-libmvec-acosf-avx512f.o.dt: No such file or directory That happens because the elf rtld-Rules recursion runs a sub-make over every $(rtld-subdirs) directory, which converts that directory's .dt files, and the parallel subdirectory recursion (commit 7cac99621e96) runs it concurrently with those subdirectories' own sub-makes. Add the PID of the shell to the temporary name and claim the input with a rename: only the run that wins converts and installs the target. Reviewed-by: Sam James (cherry picked from commit ba8c8801be7674cc12406914184516a811ac22a8) commit f7beb24f3ad5dbf8e84a5b75d5b2428a262e9ab9 Author: Adhemerval Zanella Date: Thu Aug 6 14:07:57 2026 -0300 Makefile: Only print the test summary in the second pass of 'make check' The build-only first pass of the two-pass 'make check' still runs the static checks (abi, conformtest, installed headers, etc.), and the top-level tests recipe merged and summarized their results. An unexpected FAIL there (e.g. check-abi) aborted 'check' before the second pass ran any built test, and even a clean run printed a misleading partial summary. Pass tests-summary=no in the first pass to skip the merge and summary; the .test-result files persist, so the second pass folds those results into the one complete summary at the end, restoring the single-pass reporting behavior. Reviewed-by: Sam James (cherry picked from commit 96a9a09d7d5527462a823c247569e65feeca8ddb) commit 45b8a13c48da92bc5dd6fe102011391dd6847862 Author: Rudi Heitbaum Date: Thu Aug 6 14:07:56 2026 -0300 Makerules: Only install the ABI lib-names header from the top level (BZ 34439) The $(inst_includedir)/%.h install rules exist only where $(headers) is non-empty, so in a subdir without headers (e.g. csu) the prerequisite added on install-others-nosubdir has no rule. It only worked because .NOTPARALLEL made the top level install the header first, which the parallel subdir recursion no longer guarantees. Reviewed-by: Sam James (cherry picked from commit 82c0a96b8e63005a49ba52ddb21993811030613f) commit 5d1e923ed79185668ac62d19fc37e7e23a3642b6 Author: Adhemerval Zanella Date: Thu Aug 6 14:07:55 2026 -0300 Fix gen-as-const-headers races with the parallel subdir recursion (BZ 34438) The parallel subdirectory recursion (commit 7cac99621e96) only orders csu (and mach/hurd on Hurd) before the parallel fan-out plus the edges the Depend files request. A header generated from gen-as-const-headers is only ordered before the compilations of the subdirectory that adds the .sym (through before-compile), so a header consumed by a different subdirectory may not exist yet when its consumer is compiled. That is the case for : it is generated when building misc, while its only consumer, ____longjmp_chk.S (x86_64 and sh), is built in debug. The serial recursion always ran misc before debug in the sorted order, hiding the missing dependency. Move the generate the header to 'debug' instead. The same class of problem exists on Hurd: jmp_buf-ssp.h that is used by ____longjmp_chk.S in debug, and signal-defines.h that is sued by debug and setjmp. Deterministically reproduced with 'make debug/subdir_lib' from a clean build tree (which orders only csu before debug), and verified with builds for x86_64-linux-gnu, sh4-linux-gnu, i686-gnu, and x86_64-gnu. Reviewed-by: Sam James (cherry picked from commit 60c9ed0e6b9cce07e85ee56fc39b9afe36919e45) commit fec2a9c6765b548f9d738e3a1c63a63ad7061d40 Author: Adhemerval Zanella Date: Fri Mar 21 14:03:00 2025 +0000 linux: Inline syscall cancellation to keep wrapper frames observable (BZ 34338) The cancellable syscall wrappers end with a tail call to __syscall_cancel, the wrapper frame is then elided, so when the syscall executes the wrapper is no longer present on the stack. Tools that unwind from CFI alone, such as valgrind, perf and sampling profilers, cannot observe it. On gdb, it only recovers it from DWARF call site information, which reduced-debuginfo libc builds usually omit. The behaviour is target dependent: for a shared (PIC) the tail call is emitted on aarch64, arc, loongarch and riscv. It is not emitted on i386, x86_64, arm, s390x, sparc and alpha, where the seventh argument is passed on the stack or fewer argument registers are available, nor on powerpc and mips, where the TOC/GOT pointer must be restored after the call. This is why the problem was originally reported as aarch64 specific while x86_64 was unaffected. Rather than only inhibiting the tail call [1] (which keeps the wrapper frame but still leaves the __syscall_cancel and __internal_syscall_cancel frames), move the cancellation logic back into the wrappers. In the single-threaded case the syscall is now issued directly from the wrapper; only the multi-threaded path still calls the out-of-line __syscall_cancel_arch. This keeps the wrapper observable and removes the extra frames, mimicking how cancellation was handled before 89b53077d2a58f00e7debdfe58afabe953dac60d. The result is a small libc.so .text increase (size, first column): ABI master patched diff increase aarch64 1635880 1647424 11544 0.71% x86_64 1981081 1992257 11176 0.56% powerpc64le 2364336 2376964 12628 0.53% riscv64 1368386 1376704 8318 0.61% loongarch64 1741385 1755601 14216 0.82% The tst-backtrace5 was suppose to track this issue, but due wrong loop variable check it does not take this in account. This patch also fixes it. Checked on aarch64-linux-gnu, x86_64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, and powerpc64le-linux-gnu. [1] https://sourceware.org/pipermail/libc-alpha/2025-March/165395.html (cherry picked from commit 1b5ff009fa5bf01ad26e6cc330a1df5a0c84135e) commit 58da792d8a2d8f2fe711318836e853fcddfd7cd8 Author: Adhemerval Zanella Date: Tue Aug 4 14:25:48 2026 +0000 hurd: Fix build after the ftw kernel_stat.h inclusion Commit 6758def7171 changed the generic ftw{64}.c to include kernel_stat.h, which is Linux specific. Add a Hurd version of kernel_stat.h defining XSTAT_IS_XSTAT64 to 0, since struct stat and struct stat64 never share a layout on Hurd: on 32-bit ABIs st_ino, st_size, and st_blocks are narrower in struct stat, and on 64-bit ABIs the two structures still differ in size because _SPARE_SIZE in bits/stat.h reserves three more ints of spare space in struct stat than in struct stat64. This keeps the ftw/ftw64 symbols exactly as before the change, where the aliasing check on __OFF_T_MATCHES_OFF64_T was always false because the Hurd bits/typesizes.h does not define it. Checked with a full build for i686-gnu and x86_64-gnu. (cherry picked from commit d6031665c3a59faf75cf6bc55e041611da21d0e6) commit 9bcb85688e58847191deb42bfc68d60802078df4 Author: Xi Ruoyao Date: Wed Jul 22 19:26:10 2026 +0800 io: fix ftw ABI on MIPS n64 On MIPS n64 off_t is same as off64_t, but struct stat is not same as struct stat64 (very peculiar but see the "as tempting as it..." comment in linux/mips/kernel_stat.h). As the ftw/ftw64 callback accepts a pointer to a function who accepts struct stat/stat64, for MIPS n64 we must use different implementations for ftw and ftw64. Thus for testing if ftw64 can be aliased to ftw, we should check XSTAT_IS_XSTAT64 instead of __OFF_T_MATCHES_OFF64_T. This resolves the io/tst-ftw-lnk failure observed on MIPS n64. Link: https://sourceware.org/glibc/wiki/Testing/Tests/io/tst-ftw-lnk Signed-off-by: Xi Ruoyao Reviewed-by: Adhemerval Zanella (cherry picked from commit 6758def717175e679cb49b5051b6b5ec54ddfb2c) commit 0b58f5d80d24cf83cfde9d8381aafb11fef0e152 Author: Adhemerval Zanella Date: Thu Jul 30 08:55:54 2026 -0300 math: Fix x86_64 tanh _FloatN aliases binding to the FMA variant [BZ 34465] The generic implementation emits libm_alias_double unconditionally, so tanhf32x and tanhf64 bind directly to __tanh_fma. Guard the alias with '#ifndef __tanh' and emit it from the dispatcher, as sin. Also remove the stale __expm1 defines, unused since tanh moved to CORE-MATH. Checked on x86_64-linux-gnu, and with 'qemu-x86_64 -cpu Nehalem'. Reported-by: Michael Brunnbauer (cherry picked from commit b01abba04a954cbd6b2834c0643a08685a915fe5) commit 7cba77790f3279bec3ac20e9c7632b021cd53f95 Author: Adhemerval Zanella Date: Mon Jul 27 13:37:19 2026 -0300 math: Fix sinh worst-case results for |x| > 36.736801 [BZ 34441] The CORE-MATH import mistranslated the accurate path result scaling 'th *= sp.f' as 'th *= asuint64 (sp)' (commit 106f8c2ed68), and two of the 51 exceptional-case table entries were dropped when the table was moved to e_sinh_data.c (commit f05c4907a27). Checked on x86_64-linux-gnu and aarch64-linux-gnu. (cherry picked from commit fdc90dbb52b092f68cd5a4fac7a4cbd854c91bc3) commit c045fc61e8435c103ebfe06d01fec7f56503e2b4 Author: Samuel Thibault Date: Mon Jul 27 00:59:36 2026 +0200 hurd: fix fork's longjmp demangling on i386 i386's setjmp does not actually mangle ebp. commit 0b05bc142249ac47e72be5cad5c37f33f4bb68d4 Author: Samuel Thibault Date: Fri Jul 24 23:10:02 2026 +0200 hurd: Make the readlink __fstatat64 references optional They may show up or not depending on the toolchain in use. commit 1bd79651065b27c02c6502b9423124e54882058d Author: Andreas K. Hüttel Date: Sat Jul 25 09:21:33 2026 +0900 NEWS: start 2.44.1 section Signed-off-by: Andreas K. Hüttel commit 5e5ddf57987ae4b37da5ca2fa039c8803b0be735 Author: Andreas K. Hüttel Date: Sat Jul 25 09:20:26 2026 +0900 advisories: replace with ADVISORIES text file Signed-off-by: Andreas K. Hüttel commit c3a3a9808ad3ab4a3336836833f83288b672ccbf Author: Andreas K. Hüttel Date: Fri Jul 24 22:16:45 2026 +0900 ChangeLog.old/ChangeLog.33: add Signed-off-by: Andreas K. Hüttel commit 50245c56a61e27ea4ae58703070c12c5d687b1d0 Author: Andreas K. Hüttel Date: Fri Jul 24 22:10:57 2026 +0900 version.h, include/features.h: Increase version number Signed-off-by: Andreas K. Hüttel commit bc92b40b1516e3d45f9e3e155a4904223766caf1 Author: Andreas K. Hüttel Date: Fri Jul 24 21:53:17 2026 +0900 NEWS: drop empty section Signed-off-by: Andreas K. Hüttel commit 5961de55881c3eb4d2e4f821e0a68d2cd52d4c69 Author: Andreas K. Hüttel Date: Fri Jul 24 21:48:02 2026 +0900 po: update (only line number changes) Signed-off-by: Andreas K. Hüttel commit 12726491afcbbdfb723ceb0d3176619b7dbabd42 Author: Andreas K. Hüttel Date: Fri Jul 24 21:12:27 2026 +0900 libc.pot: regenerate Signed-off-by: Andreas K. Hüttel commit ffaa52a30eeff2bfb264bb17e4fa7b4c5c934bfa Author: Samuel Thibault Date: Wed Jul 22 22:24:29 2026 +0200 hurd: Make setitimer clear interval on value being 0 posix says value being 0 means disabling a timer, regardless of the interval, so we should clear the interval in that case, so a further setitimer call does not see a non-zero interval. commit 015e8ef482f04459e9ece9d9a801f19240aac1a0 Author: Samuel Thibault Date: Wed Jul 22 22:22:19 2026 +0200 hurd: xfail more tests waiting for barrier setpshared support commit 0f731d92cd54f0b4fbcd1d2062d69e91a18ca9ac Author: Andreas K. Hüttel Date: Wed Jul 22 00:29:10 2026 +0900 manual/install.texi, INSTALL: update version numbers Signed-off-by: Andreas K. Hüttel commit e9996c743d48e9bdb9f82e518b174363e3d20947 Author: Florian Weimer Date: Tue Jul 21 15:54:27 2026 +0200 resolv: Disable TCP servers in tst-resolv-res_init-failure This avoids spurious xaccept errors on slow systems. With this change, the test still reproduces the original bug. Reviewed-by: Carlos O'Donell commit b9bd146ad1be2f459bab404fca07201871446761 Author: Andreas K. Hüttel Date: Mon Jul 20 17:21:29 2026 +0900 NEWS: mention more recent developments Signed-off-by: Andreas K. Hüttel commit 3f3229739ebf6f91ae3f9681f225f0d1ef734163 Author: Yury Khrustalev Date: Thu Jul 16 14:09:33 2026 +0100 math: test: Fix unsupported check in test-narrowing-trap Reviewed-by: Carlos O'Donell commit a5aa0df24ad61a7dbc0f7c0dc9da7387ec0e974d Author: Samuel Thibault Date: Mon Jul 20 17:10:44 2026 +0200 hurd: demangle pointers on fork's longjmp The thread state structure requires plain pointers, while the jmpbuf has mangled pointers. Fixes 78f1f0e39cd41d28ae771eb3498bc33780c85cfd ("Consolidate the C pointer guard and align the assembly implementations") commit 623279d52a59f47f91ee1b7fae67d94b530094cd Author: Samuel Thibault Date: Mon Jul 20 20:17:08 2026 +0200 hurd: Add __readlink and readlink to dl-sysdep.c Fixes fcea66cd4685f9f3719e09cac52c73b9ece4bade ("Add system-wide tunables: Filters") which adds calling it from rtld. commit 0d61a8161235e84c240d0f80c3039557f82cc96d Author: Samuel Thibault Date: Mon Jul 20 11:15:46 2026 +0200 hurd: Add __fstatat64 to dl-sysdep.c Fixes b9957a70b82203d91b0659b93cfe8632f954aba3 ("Add system-wide tunables: cache ld.so.cache") which adds calling it from rtld. commit 7ace1143691919bc63a553440f7399660c367833 Author: Florian Weimer Date: Mon Jul 20 15:53:56 2026 +0200 manual: Add stability warning regarding system-wide tunables And mention system-wide tunables in NEWS. Reviewed-by: Andreas K. Hüttel commit a36971bebea0b54e8e890700a4c5868058ad929f Author: Andreas K. Hüttel Date: Mon Jul 20 23:12:23 2026 +0900 contrib.texi: update Signed-off-by: Andreas K. Hüttel commit b2d4136341cc27a29f3d68959bfff2771dd43f5a Author: Andreas K. Hüttel Date: Mon Jul 20 17:31:33 2026 +0900 NEWS: insert list of fixed bugs Signed-off-by: Andreas K. Hüttel commit a8e580f6a057957d0a6cd44ffd433104ba3272bc Author: Andreas K. Hüttel Date: Mon Jul 20 14:24:35 2026 +0900 NEWS: editorial changes Signed-off-by: Andreas K. Hüttel commit 6b29e74c731e2ac1bc8048a389fdaf029bd96072 Author: Adhemerval Zanella Date: Fri Jul 17 17:14:44 2026 +0000 math: Update tanh from CORE-MATH (revision cf237fa0) Sync the double-precision tanh implementation with CORE-MATH revision cf237fa0. Checked on aarch64-linux-gnu. commit 249639137ed360d1827d9e663261ba26d2b01d81 Author: Peter Bergner Date: Sat Jul 18 01:24:38 2026 +0800 Revert "malloc: Remove dynamic mmap/trim threshold [BZ #30769]" This change causes large degradations on multiple SPEC benchmarks, so we have to revert this commit. GLIBC BZ: https://sourceware.org/PR34394 This reverts commit 17a79a51208c5648fe70983085833bf15d83d0f1 Signed-off-by: Peter Bergner Reviewed-by: Adhemerval Zanella commit a29c483d3cf3155a32fb452330d06041a96f056f Author: Adhemerval Zanella Date: Mon Jul 6 11:18:36 2026 -0300 Add RWF_NOSIGNAL from Linux 6.18 to bits/uio-ext.h It was added by commit db2ab24a341ce89351a1bede37a96a3e3ce1726a. Reviewed-by: Carlos O'Donell commit 5c47592adb388365312451e361eaedfa32d98d5b Author: Adhemerval Zanella Date: Thu Jul 16 18:21:20 2026 -0300 math: Fix inaccurate sin/cos/tan for large arguments (BZ 34376) The Payne-Hanek range reducer __branred delivers the reduced argument as a double-double with only about 93 significant bits. For arguments extremely close to a multiple of pi/2 the true reduced argument can be as small as 2^-61, so most of those bits cancel and sin/cos/tan can be wrong by up to ~143000 ulp. This inaccuracy used to be handled by the multiple-precision slow paths, which was removed by commit 649095838b8 ("sin/cos slow paths: remove slow paths from huge range reduction") and commit 476d692e8a8 ("math: Remove slow paths in tan [BZ #15267]"). Restore the e_rem_pio2.c (removed as unused by commit ca3aac57efa "Remove unused math files") and use __ieee754_rem_pio2 for the huge-argument reduction instead of __branred, which is removed. It also does not depend on precise IEEE double rounding, so the nofma and vector-width workarounds for branred.c are no longer needed. The file is restored trimmed to its huge-argument path, the callers reduce smaller arguments themselves and handle non-finite inputs, so only 1e8 < |x| < 2^1024 reaches __ieee754_rem_pio2. Checked on x86_64-linux-gnu, aarch64-linux-gnu, armv7a-linux-gnueabihf, and i686-linux-gnu. Reviewed-by: Carlos O'Donell commit 70685abb809639c702e4c38e93149bc748534fcd Author: Adhemerval Zanella Date: Thu Jul 16 18:21:19 2026 -0300 benchtests: Add path-oriented workloads to tan The tan input list spans the full binary64 range, so a single number mixes the kernel, and the i__branred reductions in one average. Add two named workloads that isolate the ends of that spread, so each can be measured separately: - workload-fast.wrf: uniform random inputs in [-pi, pi]. - workload-slow.wrf: |x| in [2^27, 2^1024), log-uniform over binades. The existing full-range inputs are replaced as the default workload. Reviewed-by: Carlos O'Donell commit 18f97e140d228b453bb54614be852566a97abe68 Author: Adhemerval Zanella Date: Thu Jul 16 18:21:18 2026 -0300 benchtests: Add path-oriented workloads to sin The sin input list spans the full binary64 range, so a single number mixes the kernel, the reduce_sincos reduction , and the __branred reduction in one average. Add three named workloads that isolate the paths __cos actually dispatches to, so each can be measured separately: - workload-fast.wrf: uniform random inputs in [-pi, pi]. - workload-moderate.wrf: |x| in [4, 6.7e7], log-uniform over binades. - workload-slow.wrf: |x| in [2^27, 2^1024), log-uniform over binades. The existing full-range inputs are replaced as the default workload. Reviewed-by: Carlos O'Donell commit 49d25edb76a1e5d7e496ddf943ed0b10d7b43146 Author: Adhemerval Zanella Date: Thu Jul 16 18:21:17 2026 -0300 benchtests: Add path-oriented workloads to cos The cos input list spans the full binary64 range, so a single number mixes the kernel, the reduce_sincos reduction , and the __branred reduction in one average. Add three named workloads that isolate the paths __cos actually dispatches to, so each can be measured separately: - workload-fast.wrf: uniform random inputs in [0, 2*pi]. - workload-moderate.wrf: |x| in [4, 6.7e7], log-uniform over binades. - workload-slow.wrf: |x| in [2^27, 2^1024), log-uniform over binades. The existing full-range inputs are replaced as the default workload. Reviewed-by: Carlos O'Donell commit 2678adc8eb9617daea54d900f8ffc39d3039e2a5 Author: Adhemerval Zanella Date: Wed Jul 15 10:09:10 2026 -0300 sparc: Align THP tests to the 8MB huge-page size The sparc64 uses an 8KB base page and 8MB PMD transparent huge page. It fixes the following regression on sparc: FAIL: elf/tst-thp-1 FAIL: elf/tst-thp-1-no-s-code FAIL: elf/tst-thp-1-no-s-code-pde FAIL: elf/tst-thp-1-no-s-code-static FAIL: elf/tst-thp-1-pde FAIL: elf/tst-thp-1-static FAIL: elf/tst-thp-align Checked with the elf tests on qemu sparc64. Tested-by: Andreas K. Hüttel commit 82a0bf8d33f4be557b36218b446231644d5790e5 Author: Adhemerval Zanella Date: Tue Jul 14 10:39:57 2026 -0300 elf: Defer arch PLT IFUNC relocations in the two-phase relocation split The split introduced by commit 63b31c05a8a does not handle sparc and (R_SPARC_JMP_IREL) powerpc64 (ELFv1, R_PPC64_JMP_IREL), which are emited in some constructions. Handle such cases on elf_dynamic_is_Rel_irelative. It fixes elf/tst-ifunc-fault-bindnow and elf/tst-ifunc-fault-lazy on sparc64 (powerpc64 emits R_PPC64_IRELATIVE in both cases, R_PPC64_JMP_IREL is emitted only when the ifunc is called, not just referenced). Checked with the elf tests on qemu sparc64 and powerpc64. Tested-by: Andreas K. Hüttel commit c82b6095964105156606af35b1ca1a08af230a2d Author: Adhemerval Zanella Date: Tue Jul 14 09:07:27 2026 -0300 sparc: Fix static IFUNC startup crash by redirecting __mempcpy (BZ #34396) After commit b75ad99d45b, __libc_setup_tls -> _dl_allocate_tls_init copies the TLS init image with the IFUNC __mempcpy before ARCH_SETUP_IREL resolves it, so on a multi-arch sparcv9/sparc64 static build the call jumps through an unrelocated PLT slot and the process dies with SIGILL. The sparc dl-symbol-redir-ifunc.h only redirected memset. Redirect memcpy, memmove, mempcpy and __mempcpy to the ultra1 routines as well, and merge the identical sparc64 and sparc32/sparcv9 copies into a single sysdeps/sparc file. The redirection is guarded by __sparc_v9__ && USE_MULTIARCH so that sparcv8 (leon) and --disable-multi-arch builds, which have no __*_ultra1 routines, are left untouched. Checked with elf tests for sparc32 and sparc64 on qemu system. Tested-by: Andreas K. Hüttel commit af51ed63d094a056486b932b0585ee5893d19b6f Author: H.J. Lu Date: Thu Jul 16 06:15:44 2026 +0800 Revert "strace-tst-thp.sh: Allow unsupported THP tests" This reverts commit ea50bcc538f3e161dd589b4a855d80ef8a35fce8. commit ea50bcc538f3e161dd589b4a855d80ef8a35fce8 Author: H.J. Lu Date: Fri Jul 3 10:17:20 2026 +0800 strace-tst-thp.sh: Allow unsupported THP tests Change strace-tst-thp.sh to output=${test_prog}.$$ ... /bin/sh -c \ "timeout -k 4 $((3*$TIMEOUTFACTOR)) ${cmd} --direct 2>&1" > "${output}" if grep -E "madvise\(0x[0-9a-f]+, [0-9]+, 0xe)" "${output}"; then ... so that unsupported THP tests exit with status 77. Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella commit e03cefb56b748139def60d97eea805a4a303e91e Author: H.J. Lu Date: Sat Jul 4 08:17:05 2026 +0800 thp: Disable THP if THP isn't supported by kernel Since DL_MAP_DEFAULT_THP_PAGESIZE is defined for x86-64, THP control is to set to madvise by default. If THP is disabled in x86-64 kernel, madvise (..., MADV_HUGEPAGE) returns -EINVAL to indicate that THP isn't supported. Add _dl_thp_madvise to disable THP in this case. This fixes BZ #34348. Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella commit 81ae8211135d380d9938ed81c80ba5644a7a03c7 Author: H.J. Lu Date: Sat Jul 4 13:32:10 2026 +0800 thp: Link THP PDE tests with $(LOAD-THP-ADDRESS-LDFLAGS) LOAD-THP-ADDRESS-LDFLAGS was added to work around: https://sourceware.org/bugzilla/show_bug.cgi?id=34184 which is needed for THP PDE tests. Add $(LOAD-THP-ADDRESS-LDFLAGS) to LDFLAGS-tst-thp-1 and LDFLAGS-tst-thp-1-no-s-code if PIE isn't built by default so that they are linked with $(LOAD-THP-ADDRESS-LDFLAGS). This fixes BZ #34314. Signed-off-by: H.J. Lu commit cdfa80fad3d52217ae986f9acdcbdbfc94b3da3e Author: Adhemerval Zanella Date: Wed Jul 1 15:24:34 2026 -0300 Add advisory text for CVE-2026-6368 commit e2cefe16c37a617df9f11407cb00a272a6098823 Author: Adhemerval Zanella Date: Mon Apr 13 16:33:30 2026 -0300 posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) The previous implementation saved a copy of the wordexp_t struct at entry and blindly restored it on error via (*pwordexp = old_word). This is incorrect when WRDE_APPEND is set because w_addword may have called realloc on we_wordv during partial processing before the error was detected. If realloc relocated the buffer, the saved we_wordv pointer is dangling; restoring it causes a use-after-free in the caller (e.g. via wordfree), and the relocated buffer is leaked. Fix this by duplicating the we_wordv pointer array at entry when WRDE_APPEND is set, so that all subsequent realloc calls inside w_addword operate on the copy. This change also fixes a POSIX conformance issue: if the WRDE_APPEND flag is specified, pwordexp->we_wordc and pwordexp->we_wordv shall not be modified. Also fix two pre-existing error return paths in the '"' and '\'' cases that returned directly from w_addword failures instead of going through do_error, which would leak the saved array (and previously would also skip the word cleanup). Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: DJ Delorie commit 2324aa7aa81a324ea9936a29ed41d6b0fa3ae6e4 Author: DJ Delorie Date: Tue Jun 30 17:26:34 2026 -0400 ldconfig: add --install option Add --install option, which copies a pre-built ld.so.cache into place, honoring the cache and root options and defaults. This gives the user a canonical "correct" way to install a pre-built cache without risk of a program trying to load a partially-written file. Co-authored-by: Adhemerval Zanella Netto Reviewed-by: Adhemerval Zanella commit 69b0bacd72d44ff80c7f249e89389912beff3f16 Author: Andreas K. Hüttel Date: Tue Jul 14 22:04:19 2026 +0900 po: Integrate translations Signed-off-by: Andreas K. Hüttel commit a3d4ff18c57eb962e18920a394d2b032e5e7b1aa Author: Stefan Liebler Date: Tue Jul 14 10:56:49 2026 +0200 s390: Use 64bit branch relative on count instruction in strncpy-z900.S [BZ #34398] At the time the s390-32 strncpy implementation was adjusted for the s390-64 port, the brct (branch relative on count) instruction was not adjusted from 32bit to 64bit instruction. If n contains a value >32bit, the number of 8 byte chunks is computed with srlg (64bit shift right). The processing of 8 byte chunks is then processed by looping with brct (32bit branch relative on count) instruction. This patch just uses the brctg (64bit branch relative on count) instruciton. Note 1: There is a second loop copying the remaining seven bytes. The usage of 32bit brct for looping is fine here. Note 2: If glibc is build with architecture level set >=z13, the z900 variant of strncpy is not build at all. Note 3: If glibc is build for =z13 or if called via __GI_strncpy. commit 202b4f794aa38370aaf03a0e28a2eb2a21877072 Author: Stefan Liebler Date: Mon Jul 13 10:31:53 2026 +0200 Use correct type for glibc.malloc.perturb in tst-tunconf1.c On s390x the test elf/tunconf1 fails with: tst-tunconf1.c:41: numeric comparison failure (widths 64 and 32) left: 180388626436 (0x2a00000004); from: (long)perturb right: 42 (0x2a); from: 42 According to elf/dl-tunables.list, glibc.malloc.perturb is of type int32_t (4byte) and not size_t (8byte) which was used for TUNABLE_GET_FULL inside the testcase. Therefore the correct 32bit value 0x2a=42 is written to the to the wrong place and leads to the comparison failure. The printf format specifiers for size_t were also adjusted. Reviewed-by: DJ Delorie commit aafc0024b3935cefffe8b96f3725d0a8fbf778d4 Author: Adhemerval Zanella Date: Tue Jul 7 15:30:12 2026 -0300 benchtests: Build benchmarks in parallel The unconditional '.NOTPARALLEL' in benchtests/Makefile forced the whole subdirectory to build serially, even though its only purpose is to keep the benchmark *runs* from perturbing each other's timing. Replace it with ordering that serializes only the benchmark runs, and only when more than one benchmark group will actually run. The combined 'bench' goal builds every benchmark program in parallel (through bench-build) and then runs the bench-set, bench-func and bench-malloc groups strictly one after another. Reviewed-by: Sam James commit b8985facc9842c8ea79583ab8b0d57b61e4191a2 Author: Adhemerval Zanella Date: Sat Jul 11 13:33:12 2026 -0300 sparc: Fix static (non-PIE) executables when PIE is enabled by default For the default --enable-default-pie, $(pic-default) adds -DPIC to CPPFLAGS-.o so. However, -fPIE ($(pie-default)) is only added to CFLAGS-.o, which does not affect assembler (.S) sources On SPARC the GOT register setup in SETUP_PIC_REG references _GLOBAL_OFFSET_TABLE_ through %hi/%lo, and the assembler only rewrite those into the required PC-relative relocations (R_SPARC_PC22 and R_SPARC_PC10) when it is in *PIC* mode; otherwise it emits absolute R_SPARC_HI22/R_SPARC_LO10. With the absolute relocations the __sparc_get_pc_thunk sequence adds the run-time PC to an already-absolute GOT address, so the computed GOT register is wrong. In _start this makes the address of main come out bogus, and __libc_start_main jumps to an unmapped address. This removes the requirement of the --disable-default-pie for sparc to build static binaries correctly. Checked some tests (mainly the elf/ one) on a sparc64-linux-gnu qemu system. Reviewed-by: Sam James commit 1c0531af67926aae72584055d6603764c88f34b6 Author: Adhemerval Zanella Date: Mon Jul 6 16:56:35 2026 -0300 elf: Remove unused tunable_seclevel_t The per-tunable security level is no longer part of struct _tunable and no tunable in dl-tunables.list declares one. Reviewed-by: DJ Delorie commit 098e6c969ca6dba9da2e7bbde131c9e78756e50a Author: Adhemerval Zanella Date: Mon Jul 6 16:36:49 2026 -0300 elf: Remove _dl_unload_cache It is a no-op since b9957a70b82. Reviewed-by: DJ Delorie commit 3a9c4dbe307d8d2b40fc4a54339c203cdf89af00 Author: Adhemerval Zanella Date: Mon Jul 6 11:48:23 2026 -0300 manual: Document default AT_SECURE handling for system-wide tunables A system-wide tunable without an onlysecure/nonsecure/anysecure prefix defaults to "nonsecure", i.e. it is not applied to AT_SECURE processes. This is a deliberate, conservative default but was not documented. Reviewed-by: DJ Delorie commit 93d68cfbeb04cb717852c2d21347cfd5ce927c72 Author: Adhemerval Zanella Date: Mon Jul 6 13:35:15 2026 -0300 elf: Let environment aliases override overridable system-wide tunables The environment-variable alias loop in __tunables_init skipped every tunable whose "initialized" flag was set, which was originally meant only to give the canonical GLIBC_TUNABLES form precedence over the legacy MALLOC_* aliases. Now that the cache also sets "initialized", a legacy alias could no longer override an *overridable* cache default, even though the canonical GLIBC_TUNABLES form still could. Track separately the tunables that were set from GLIBC_TUNABLES during this call and skip only those in the alias loop Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: DJ Delorie commit f1c94392d96ba10b6ea3acbd617f73d5fab35b88 Author: Adhemerval Zanella Date: Mon Jul 6 11:48:23 2026 -0300 elf: Avoid redundant ld.so.cache reload after first load _dl_check_ldsocache_needs_loading only stored the stat fields it compares (mtime, ino, size, dev) on the path where a cache was already loaded. On the very first call CACHE is NULL and the function returned "needs loading" without recording those fields, leaving new_cache_file_time zero. The next call then copied that zero value into cache_file_time and compared it against the freshly stat'd values, which always differed, forcing a second, unnecessary load (munmap + mmap + re-parse) of an unchanged cache at every startup. It can be shown with repro: $ cat << EOF > repro.c #include int main (void) { dlopen ("does-not-exist-xyz.so.99", RTLD_NOW); return 0; } EOF $ gcc repro.c -o repro $ strace -f -e trace=openat elf/ld.so --library-path . ./repro 2>&1 | grep -c "/etc/ld.so.cache" The result should be 1, instead of 2. Record the stat fields as soon as the stat succeeds, before the CACHE == NULL early return, so the following call has an accurate baseline and does not spuriously reload. Reviewed-by: DJ Delorie commit 4e971f555850f856e70ceb05d963baa9e0a455a4 Author: Adhemerval Zanella Date: Mon Jul 6 16:56:27 2026 -0300 elf: Verify the tunable cache header signature and version The tunable header signature and version are written by ldconfig but never checked them on read, so the version field was inert. Reject the section unless both match. Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: DJ Delorie commit 3d3cd10c4ec8bf5fb48faaad8c0acea3da225a35 Author: Adhemerval Zanella Date: Mon Jul 6 16:56:12 2026 -0300 elf: Bound the tunable cache string table against the mapping size _dl_load_cache_tunables bounds each entry's string offsets against [s_start, start + cache_new->len_strings], but len_strings is an unvalidated 32-bit field from ld.so.cache and s_start/s_end were int. A corrupt cache with an oversized len_strings could make s_end exceed the mapping (or overflow), letting an offset point outside the mmap; the following strcmp/__strdup would then read unmapped memory. Compute the offsets as size_t and clamp s_end to cachesize, matching how the regular library lookup bounds string offsets against the mapping size. Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: DJ Delorie commit 5396eb704531d9ede0388bffcc21b93bb661d404 Author: Siddhesh Poyarekar Date: Thu Jul 9 09:52:39 2026 -0400 localedata: Use libc-alpha ML as the canonical contact Replace instances of "bug-glibc@gnu.org", "libc-locales@sourceware.org" and "bug-glibc-locales@gnu.org" with libc-alpha@sourceware.org as the single touchpoint for the community. Signed-off-by: Siddhesh Poyarekar Reviewed-by: Carlos O'Donell commit 980089ebab2a05af6d675d614bb2ec84c58b6615 Author: Florian Weimer Date: Thu Jul 9 17:09:32 2026 +0200 posix: Use unique PID file in tst-spawn3 and tst-spawn3-pidfd The test sources are built twice and the two tests may run in parallel. They cannot use the same PID file. Reviewed-by: Sam James commit 20b13fa08b2831ee67fcc92edf2d89288bcc2c93 Author: Florian Weimer Date: Wed Jul 8 17:38:42 2026 +0200 localedata: Avoid concurrently written locales in gen-locale.sh There is no cross-directory exclusion of concurrent $(gen-locales) usage. Parallel localedef calls can clobber locale data as it is being loaded by tests. With the separate staging areas, there are no peer directories, so hard-linking no longer happens. The touch command is therefore unnecessary. Reviewed-by: Sam James commit 617376a04b28efe0e17c9227557ef6231735b0eb Author: DJ Delorie Date: Mon Jul 6 23:27:44 2026 -0400 Add system-wide tunables: implement overridability Implement the overridability/nonoverridability flags for tunables. Reviewed-by: Adhemerval Zanella commit b5eecf35d91a3b29cff80b731bbc6bcce6863827 Author: Andreas K. Hüttel Date: Tue Jul 7 10:39:18 2026 +0900 libc.pot: regenerate Signed-off-by: Andreas K. Hüttel commit d70dd7d72273ac1aa53b435156de3f50f0c5a868 Author: Yury Khrustalev Date: Wed Jul 1 13:45:40 2026 +0100 Revert "malloc: aarch64: Add ifuncs for malloc functions" Due to issue in GDB and Valgrind that incorrectly call malloc ifunc resolver as the malloc function, we have to revert this change. GDB BZ: https://sourceware.org/bugzilla/show_bug.cgi?id=34330 Valgrind bug: https://bugs.kde.org/show_bug.cgi?id=522497 This reverts commit 9ed3576e61f7a87eb83d512531566f5e5d6bb032. Reviewed-by: Adhemerval Zanella commit b416f91801b72982e4fa09b01fca19969c2ba90b Author: Adhemerval Zanella Date: Fri Jul 3 10:33:48 2026 -0300 netinet/tcp.h: Sync with Linux 6.15 and fix struct tcp_info tail (BZ 34347) Add the TCP_RTO_MAX_MS and TCP_RTO_MIN_US socket options (commit 54a378f43425085d0684679d99735696b69165bc, Linux 6.15) and TCP_DELACK_MAX_US (commit 9552f90835ef3552d0af327e48dc360717777d62, Linux 6.15). Commit 7e46c2aae47d3284d4eb0845ddcc3951e987d681 synced the accurate ECN additions but encoded the trailing bitfield word of struct tcp_info incorrectly as two uint16_t fields (tcpi_accecn_fail_mode and tcpi_accecn_opt_seen), omitting tcpi_ecn_mode and tcpi_options2. Restore the kernel layout: uint32_t tcpi_ecn_mode:2, tcpi_accecn_opt_seen:2, tcpi_accecn_fail_mode:4, tcpi_options2:24; The overall structure size is unchanged. Also add the TCPI_ECN_MODE_* and TCP_ACCECN_* value constants for these fields, introduced together with them by Linux commit 4fa4ac5e5848 (Linux 7.0). Reviewed-by: Florian Weimer commit 3e3146fd86889143066eb2bf8d3320490262d8a0 Author: Adhemerval Zanella Date: Fri Jul 3 11:46:33 2026 -0300 Add OPEN_TREE_NAMESPACE and FSMOUNT_NAMESPACE to sys/mount.h Add OPEN_TREE_NAMESPACE (commit 9b8a0ba68246a61d903ce62c35c303b1501df28b, Linux 7.0) and FSMOUNT_NAMESPACE (commit 5e8969bd192712419aae511dd5ba26855c2c78db, Linux 7.1). commit 28c3a25bc249ab4f20d09fc2a8694f6bca9155dd Author: Adhemerval Zanella Date: Wed Jun 17 11:25:47 2026 -0300 s390: Prevent hoisting the thread-pointer read in THREAD_SET_STACK_GUARD (BZ 34297) THREAD_SET_STACK_GUARD reads the thread pointer via THREAD_SELF (__builtin_thread_pointer), which the compiler treats as invariant. In the static startup path the thread pointer is installed by the __libc_setup_tls call that immediately precedes the guard store, so the read must stay below it. The existing barrier only clobbered the access registers a0/a1, which creates no dependency on the call, so the compiler could move the whole barrier and read above __libc_setup_tls. This is sensitive to instruction scheduling and recent TLS startup changes exposed it on s390x. Add a "memory" clobber to the barrier so it is tied to the call's memory effects and cannot be hoisted above it. The macro is shared with the dynamic loader, so both startup paths are covered. I checked on s390x-linux-gnu build for arch5, arch8, arch9, and arch11 by running the elf tests on qemu system (kernel 6.1.0). Reviewed-by: Stefan Liebler commit 1d95a42ead684eb70a4a25113ebd769931052c4a Author: Adhemerval Zanella Date: Fri Jul 3 11:46:29 2026 -0300 Add new AArch64 HWCAP definitions from Linux 6.14, 6.18 and 7.0 to bits/hwcap.h Add the 2024 dpISA HWCAP bits HWCAP_CMPBR, HWCAP_FPRCVT, HWCAP_F8MM8, HWCAP_F8MM4, HWCAP_SVE_F16MM, HWCAP_SVE_ELTPERM, HWCAP_SVE_AES2, HWCAP_SVE_BFSCALE, HWCAP_SVE2P2, HWCAP_SME2P2, HWCAP_SME_SBITPERM, HWCAP_SME_AES, HWCAP_SME_SFEXPA, HWCAP_SME_STMOP and HWCAP_SME_SMOP4 (commit 819935464cb2f72fff8dfbbf95cf2726d4a66388, Linux 6.14), HWCAP3_LSFE (commit 220928e52cb03d223b3acad3888baf0687486d21, Linux 6.18) and HWCAP3_LS64 (commit 58ce78667a641f93afa0c152c700a1673383d323, Linux 7.0). Reviewed-by: Wilco Dijkstra commit 0f61d77aef1bcd5977211e87e0496768f5650c0e Author: H.J. Lu Date: Mon Jul 6 08:51:10 2026 +0800 Makefile: Depend on elf/subdir_lib only if $(subdirs) has elf commit 7cac99621e9601f916121bcaa9b7734a2e4c2529 Author: Adhemerval Zanella Date: Wed Jun 10 16:26:15 2026 -0300 Makefile: Run the subdirectory recursion in parallel added: $(elf-objpfx)ld.so $(elf-objpfx)sofini.os $(elf-objpfx)interp.os: \ | elf/subdir_lib ; which doesn't work with $ make check -jN subdirs=DIR where DIR doesn't have elf. Add such rule only if $(subdirs) has elf. This fixes BZ #34355. Signed-off-by: H.J. Lu commit db59f396469dfa6b44c212ea1b0ee6e7b4cbf065 Author: Andreas Schwab Date: Thu Jul 2 13:14:19 2026 +0200 sysdeps/x86: don't spuriously mark tests as xfail Properly set xfail marker, $(with-lld) is always non-empty. commit 59cb960a22fbacb8b8baaa049529bf4638dfc625 Author: Yao Zihong Date: Fri Jul 3 21:59:53 2026 +0000 riscv: Add RVV strncpy for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of strncpy for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__strncpy_vector) is added alongside the generic fallback (__strncpy_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling strncpy(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit df0669d41d753269312374e2eb6bd107bbec9c7b Author: Yao Zihong Date: Thu Jul 2 03:45:24 2026 +0000 riscv: Add RVV stpncpy for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of stpncpy for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__stpncpy_vector) is added alongside the generic fallback (__stpncpy_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling stpncpy(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit d692a3444ebbb61984ca3f81b9b86160406d9193 Author: H.J. Lu Date: Sun Jul 5 15:59:43 2026 +0800 Add tst-thp-size-mod.so dependency to strace THP tests After 7cac99621e Makefile: Run the subdirectory recursion in parallel tests under elf may run in parallel. "make check -jN" reports FAIL: elf/strace-tst-thp-align-default FAIL: elf/strace-tst-thp-align-disabled FAIL: elf/strace-tst-thp-align-enabled at random since they use tst-thp-align which dlopens tst-thp-size-mod.so, but tst-thp-size-mod.so dependency is missing. Add the missing dependency to fix BZ #34351. Signed-off-by: H.J. Lu commit d109f366ced6787fa295ab5c6b87de699c4bc25e Author: Adhemerval Zanella Date: Fri Jul 3 11:46:39 2026 -0300 build-many-glibcs.py: Update Linux kernel version to 7.1 Use the 7.1 release as the default Linux kernel version for building test compilers and headers. Reviewed-by: Florian Weimer commit c6ce3bed6da30d2dd9b314457d2e63de275f993f Author: Adhemerval Zanella Date: Fri Jul 3 11:46:38 2026 -0300 Update kernel version to 7.1 in header constant tests There are no new constants covered by tst-mman-consts.py or tst-openat2-consts.py in Linux 6.18, 6.19, 7.0, or 7.1. Reviewed-by: Florian Weimer commit 800ab3e463bc97fbcf5b9204a305fa3c4148c9a6 Author: Adhemerval Zanella Date: Fri Jul 3 11:46:37 2026 -0300 Update syscall lists for Linux 7.1 Linux 6.18 adds the uprobe syscall (x86_64 only), Linux 6.19 adds listns, and Linux 7.0 adds rseq_slice_yield. Linux 7.0 also wires up clone3 on sparc and memfd_secret on loongarch. Update syscall-names.list and regenerate the arch-syscall.h headers with build-many-glibcs.py update-syscalls. Reviewed-by: Florian Weimer commit 568e673fa9d41208bc7297110e180618acdf0495 Author: Adhemerval Zanella Date: Fri Jul 3 11:46:36 2026 -0300 Add NT_RISCV_USER_CFI from Linux 7.0 to elf.h It was added by commit 2af7c9cf021c5dabe880b68e5cc22c618060d954. Reviewed-by: Florian Weimer commit 6f1d069804e25810f0ca30e86b9bb7b7b7876c10 Author: Adhemerval Zanella Date: Fri Jul 3 11:46:34 2026 -0300 Add IPPROTO_AGGFRAG from Linux 6.14 to netinet/in.h (BZ 34347) It was added by commit 64e844505bc08cde3f346f193cbbbab0096fef54. Reviewed-by: Florian Weimer commit b4a0ea4a2c8c48eebab4a32fd919ec0284d45935 Author: Adhemerval Zanella Date: Fri Jul 3 11:46:32 2026 -0300 Add SCHED_GETATTR_FLAG_DL_DYNAMIC from Linux 7.1 to bits/sched.h It was added by commit 2e7af192697ef2a71c76fd57860b0fcd02754e14, which introduced the flags argument for sched_getattr. Reviewed-by: Florian Weimer commit b9476fa9aaed9c66b162ee3731983148b48c19da Author: Adhemerval Zanella Date: Fri Jul 3 11:46:31 2026 -0300 Update PIDFD_* constants for Linux 7.1 The pidfd_info interface was extended to report coredump information: * PIDFD_INFO_SUPPORTED_MASK, along with the supported_mask field, so userspace can check which flags the running kernel supports (commit dfd78546c95330db2252e0d7e937a15ab5eddb4e, Linux 6.19). * PIDFD_INFO_COREDUMP_SIGNAL, along with the coredump_signal field (commit 036375522be8425874e9e0f907c7127e315c7a52, Linux 6.19). * PIDFD_INFO_COREDUMP_CODE, along with the coredump_code field (commit 701f7f4fbabbf4989ba6fbf033b160dd943221d5, Linux 7.1). The struct pidfd_info is extended accordingly and PIDFD_INFO_SIZE_VER1, PIDFD_INFO_SIZE_VER2, and PIDFD_INFO_SIZE_VER3 are added to reflect the new struct sizes. Reviewed-by: Florian Weimer commit 5bba5e06e0305461bab35931f7575e03915a379d Author: Adhemerval Zanella Date: Fri Jul 3 11:46:30 2026 -0300 Add new LoongArch HWCAP definitions from Linux 7.0 and 7.1 to bits/hwcap.h Add HWCAP_LOONGARCH_SCQ (commit 48543c4283e76d561d11b9955222b1a3054abdb9, Linux 7.0) and HWCAP_LOONGARCH_LAM_BH (commit 1dd3e8a8eeb4059fb34b07578362380cf35b7ed5, Linux 7.1). Reviewed-by: Florian Weimer commit f2e3dacbff8892bc3ef0f3642a0d01bd78141c86 Author: Adhemerval Zanella Date: Fri Jul 3 11:46:27 2026 -0300 Add new constants from Linux 6.12, 6.18 and 6.19 to bits/fcntl-linux.h Add the FD_NSFS_ROOT (commit e83f0b5d10dcf62833008327cb661c7d118bca85, Linux 6.18), and F_GETDELEG and F_SETDELEG (commit 1602bad16d7df82faca6d7c70821117684a66f49, Linux 6.19). Reviewed-by: Florian Weimer commit 2077c0e3856df4fa749038c4cebfb3058487b6b3 Author: RyotaSaito Date: Wed Jul 1 16:20:34 2026 +0900 x86: Remove unused VZEROUPPER_SHORT_RETURN macro from memset The VZEROUPPER_SHORT_RETURN macro in memset-vec-unaligned-erms.S has had no users since commit e59ced238482 ("x86: Optimize memset-vec-unaligned-erms.S") removed its last invocation, leaving both the VEC_SIZE > 16 definition and the "rep; ret" fallback definition in place. Remove the two now-dead definitions. Signed-off-by: RyotaSaito Reviewed-by: Adhemerval Zanella commit 70dd422b6ffd02639f39063e59a8f9fb5620ed2c Author: Samuel Balazi Date: Fri Jun 19 15:11:39 2026 +0200 string: Fix memory leak in argz-addsep.c Assign the realloc result to a temporary variable, so the original memory block is not lost if the allocation fails. Reviewed-by: Adhemerval Zanella commit 1ab000387207a968f7cd18a5f3e3e7dcdadad139 Author: Adhemerval Zanella Date: Wed Jul 1 10:40:04 2026 -0300 Makerules: run test-container helper through the built loader The tests-container rule launches support/test-container, which is always dynamically linked, through $(test-via-rtld-prefix). That prefix is empty for tests listed in tests-static/xtests-static, so for a static container test the helper ran under the system loader/libc instead of the newly built one. Reviewed-by: Florian Weimer commit 2b13da5e0eb77b843b93ad40273b3b8ce4742b2c Author: Adhemerval Zanella Date: Mon Jun 15 14:22:38 2026 -0300 Makerules: add 'make check-parallel' to run tests without serialization The default 'make check' serializes the timing-sensitive test runs: the threading (nptl, or htl on Hurd) and realtime (rt) subdirectories run with .NOTPARALLEL and are ordered after the rest of the test run, so they are not perturbed by competing machine load. Add a check-parallel (and xcheck-parallel) variant for when that is not wanted -- an idle machine, or a run where the extra throughput is worth the risk of flakiness in the timing-sensitive tests (check the libc-alpha discussion [1] for more context why this approach was proposed). A new serialize-tests flag (default yes, defined in Makeconfig) gates both the per-subdirectory .NOTPARALLEL and the top-level run-time ordering; check-parallel just runs the suite with serialize-tests=no, so every test program builds and runs at full concurrency in a single pass. 'make check' and its default behavior are unchanged. [1] https://inbox.sourceware.org/libc-alpha/lhutsr3khz7.fsf@oldenburg.str.redhat.com/ Reviewed-by: Sam James commit 19e158b7f052d03262d2aaeb4e5b5df022797cb0 Author: Adhemerval Zanella Date: Wed Jun 10 18:45:39 2026 -0300 Run check-installed-headers concurrently for each header The check-installed-headers-c/-cxx tests ran one script invocation per subdirectory over all of its installed headers, performing about 80 compiler invocations per header serially. Give each header its own intermediate target so the compiler invocations parallelize under the make jobserver, recording the per-header script exit status next to the output. The .out target concatenates the per-header outputs in the original $(headers) order and fails if any recorded status is non-zero, so both the .out contents (verified byte-identical for all 76 files) and the tests.sum results are unchanged. Results on a x86_64 machine [1] from a make check with run-built-tests=no show neutral results, and on aarch64 machine [2] it improves from 241.574s to 182.405. [1] Ryzen 5900x, 12c/24t, gcc 16.1.1, binutils 2.26, and GNU make 4.3 [2] N1, 80c, gcc 15.1.1, binutils 2.25, GNU make 4.3 Reviewed-by: Sam James commit b6804fb36e67b2c8e37d48cc106313cfa34bbf19 Author: Adhemerval Zanella Date: Wed Jun 10 18:25:56 2026 -0300 Makefile: Do not install the container testroot if not running tests Every subdirectory tests target depends on $(objpfx)testroot.pristine/install.stamp, whose recipe performs a full DESTDIR installation (about 12s and 154MB on x86_64). The testroot is only consumed by the container tests, which do not run when run-built-tests is no, so skip it entirely in that case. This saves about 10s on x86_64 [1] and 30s on aarch64 [2]. [1] Ryzen 5900x, 12c/24t, gcc 16.1.1, binutils 2.26, and GNU make 4.3 [2] N1, 80c, gcc 15.1.1, binutils 2.25, GNU make 4.3 Reviewed-by: Sam James commit ef1cb97f69429ded911bdebdce417357af0b2484 Author: Adhemerval Zanella Date: Wed Jun 10 16:56:44 2026 -0300 Makefile: Do not force elf last for the others and tests passes The requirement that the elf subdirectory comes last in the subdirectory ordering stems from its lib pass: the rtld link consumes $(common-objpfx)libc_pic.a, which aggregates every other subdirectory's objects. The others, tests, and xtests classes have no such dependency: everything they consume from other subdirectories is provided by the pass barriers (others after lib, tests after others). Keep elf last only for the object-building classes and let its others and tests sub-makes run concurrently with the other subdirectories. With elf no longer forced last for those classes, the Depend edges pointing to elf (e.g. support/Depend) no longer create a cycle there, so honor them instead of dropping them. This improves the make check with run-built-tests=no, specially on machine with many cores. Results on a x86_64 machine [1] it improves from 190s to 181s, while on a aarch64 machine [2] it improves from 298.726s to 243.098s. Build results remain bit-identical and the tests.sum failure sets are unchanged. [1] Ryzen 5900x, 12c/24t, gcc 16.1.1, binutils 2.26, and GNU make 4.3 [2] N1, 80c, gcc 15.1.1, binutils 2.25, GNU make 4.3 Reviewed-by: Sam James commit 7cac99621e9601f916121bcaa9b7734a2e4c2529 Author: Adhemerval Zanella Date: Wed Jun 10 16:26:15 2026 -0300 Makefile: Run the subdirectory recursion in parallel The top-level makefile was marked .NOTPARALLEL and ran the per-subdirectory sub-makes strictly one at a time in the topological order computed by scripts/gen-sorted.awk. Only the compilations inside a single subdirectory could run in parallel, so on wide machines every subdirectory's compile tail and link steps left most cores idle, once per subdirectory per pass. Drop .NOTPARALLEL and encode the ordering the serial recursion relied on as explicit dependencies between the per-subdirectory targets: * The subdirectories that generate shared files in $(common-objpfx) consumed by the rest of the build without explicit dependencies run serially, in their sorted order, before the rest fan out: csu provides the tree-wide gen-as-const headers, and on Hurd the mach and hurd directories generate the MiG RPC headers (every other subdirectory otherwise runs a nested make in hurd/ to create them, racing under parallel recursion; see sysdeps/mach/hurd/Makefile). The first of them also materializes the other shared generated files (abi-versions.h, sysd-syscalls, before-compile headers). * The edges requested by the Depend files (now emitted by gen-sorted.awk as subdir-deps-*) are preserved. Edges pointing to elf are dropped, as the sorted list already overrides them by forcing elf last. * The tests and xtests classes only run the per-directory test programs, which are mutually independent once the others pass has built the tree. They therefore carry only the others pass barrier below and none of the csu-first or Depend edges (+ordered_parallel_- subdir_targets excludes them); otherwise "make subdir/tests" would also run the tests of every subdirectory reachable through those edges, rather than just the requested one. * elf stays last: its rtld link consumes $(common-objpfx)libc_pic.a, which aggregates every other subdirectory's objects, and its rtld-Rules recursion compiles into the other subdirectories' object directories. * Pass barriers replace the implicit pass ordering: others after lib (a subdirectory others sub-make would otherwise race to link libc.so itself), tests/xtests after others, and the testroot install behind others. * The threading (nptl, or htl on Hurd) and realtime (rt) tests are timing-sensitive and were previously shielded from system load by the global .NOTPARALLEL. With the recursion now parallel, a full test run ('make check'/'tests', run-built-tests=yes) orders them after the rest of the test run and one group at a time -- the threading subdirectory, then rt -- and each serializes its own run via a .NOTPARALLEL in its Makefile. A targeted 'make subdir/tests' is not ordered. The serialization (the per-subdirectory .NOTPARALLEL and the ordering above) constrains only the test run, not the build of the test programs; but building and running a subdirectory's tests are fused in its sub-make, so under run-built-tests=yes the serialized subdirectories would also build their test programs serially. To avoid that, the top-level 'make check' (in Makerules) now runs two passes: it builds every test program with run-built-tests=no, where the recursion is fully parallel and none of the serialization applies, and then runs the tests with run-built-tests=yes. 'make tests' and a subdirectory's own 'check' stay single pass. * The subdirectory-built files that the top-level libc.so and linkobj/libc_pic.a rules list as prerequisites (elf/ld.so, interp.os, sofini.os, sunrpc/librpc_compat_pic.a, and on Hurd mach/libmachuser_pic.a and hurd/libhurduser_pic.a, from which the lib*user-link.so inputs of libc.so are built) get order-only edges on the corresponding sub-make with an explicit empty recipe. A prerequisite-only rule would trigger an implicit rule search and this level would compile them itself in the wrong context. * The install, clean, abi, and stubs target classes keep the previous total order via a serial dependency chain. * The elf DSO sorting test recipes, run when make remakes the included generated makefiles at parse time, create the elf object directory before writing into it; the serial recursion no longer guarantees another rule created it first. * catgets builds locale-specific message catalogs (and tst-catgets reads one) by running gencat under de_DE.ISO-8859-1, hr_HR.ISO-8859-2 and ja_JP.SJIS, but never declared those locales as prerequisites: it relied on localedata running before it in the serial order. Under the parallel recursion gencat could run before localedata generated the locale, fall back to C, and fail. catgets/Makefile now pulls the locales in via gen-locales.mk, like the other subdirectories that use locales in their tests. Results on a x86_64 machine [1] with default configuration [3]: a from-scratch build improves from 78.728s to 61s, and check with run-built-tests=no from 374s to 190s. On a 80-core aarch64 machine [2] with default configuration [3]: a from-scratch build improves from 105.251s to 56.703s, and check with run-built-tests=no from 886.183s to 298.726s. Build results are unchanged: all 8919 built objects, archives, and shared objects are bit-identical to the serial build across 7 clean parallel builds, the installed tree layout is identical, and the tests.sum failure sets are identical. i686-gnu was verified with repeated from-scratch builds. [1] Ryzen 5900x, 12c/24t, gcc 16.1.1, binutils 2.26, and GNU make 4.3 [2] N1, 80c, gcc 15.1.1, binutils 2.25, GNU make 4.3 [3] --enable-stack-protector=all --enable-bind-now=yes --enable-profile=yes --enable-fortify-source=2 --enable-hardcoded-path-in-tests Reviewed-by: Sam James commit e80612e5969d619a7f948c783d0a66b3dbe17e5c Author: Adhemerval Zanella Date: Wed Jun 10 16:25:50 2026 -0300 scripts/gen-sorted.awk: Also emit the subdirectory dependency edges gen-sorted.awk collects the inter-subdirectory dependencies from the Depend files and the sysdeps Subdirs 'first' directives, but only uses them to compute the flattened sorted-subdirs list. This change also emit the raw edges as subdir-deps- make variables so the parent makefile can express the same ordering as explicit dependencies between the per-subdirectory recursion targets and run independent subdirectories in parallel. For instance, on x86_64-linux-gnu build the 'sysd-sorted' now shows: [...] subdir-deps-assert += iconvdata subdir-deps-assert += localedata subdir-deps-catgets += intl subdir-deps-debug += localedata subdir-deps-iconvdata += iconv subdir-deps-iconvdata += localedata subdir-deps-intl += iconvdata subdir-deps-intl += localedata subdir-deps-libio += localedata subdir-deps-localedata += locale [...] Reviewed-by: Sam James commit 3c779ab1557b787890ebc85f33b2518ec48c1470 Author: Sam James Date: Fri Jul 3 00:33:33 2026 +0100 intl: create correct directory in tst-translit.sh Depending on parallelism, it's possible for domaindir/existing-locale/LC_MESSAGES to have not been created yet: ``` msgfmt: error while opening "build/intl/domaindir/existing-locale/LC_MESSAGES/translit.mo" for writing: No such file or directory make[2]: Leaving directory 'src/intl' FAIL: intl/tst-translit original exit status 1 cat: build/intl/tst-translit.out: No such file or directory make[1]: *** [Makefile:944: test] Error 1 ``` If so, the following msgfmt call will fail. Fix the typo in the mkdir call. Arguably we should split these test preparations to avoid producing binaries we know won't PASS because their support data is missing. Reviewed-by: Collin Funk commit 84c3993f1ff1546c8dd06c3ced5d2bed0be649c0 Author: Andreas K. Hüttel Date: Wed Jul 1 11:14:06 2026 +0900 po/*.po: integrate current state of translations Signed-off-by: Andreas K. Hüttel commit 45267197ff542b8ee0a51b33c9efa1c47187a33e Author: Andreas K. Hüttel Date: Wed Jul 1 10:53:46 2026 +0900 po/libc.pot: regenerate Signed-off-by: Andreas K. Hüttel commit fae194043a099d45c044c883467c934153ecc51f Author: DJ Delorie Date: Thu Jun 25 23:30:39 2026 -0400 Add system-wide tunables: manual Document the syntax and operation. Reviewed-by: Arjun Shankar commit fcea66cd4685f9f3719e09cac52c73b9ece4bade Author: DJ Delorie Date: Thu Jun 25 23:30:39 2026 -0400 Add system-wide tunables: Filters Add support for [proc:*] syntax where * matches /proc/self/exe (fallback: argv[0] unless AT_SECURE). Tunables after such a line are limited to matching processes. Note that this filter is reset when including a file or at end of file. If the filename starts with a slash (example: [proc:/bin/foo]) the full path must match. If not (example: [proc:foo]) the basename is matched. Add support for filtering out AT_SECURE or non-AT_SECURE binaries: $glibc.only-for.nonsecure-binaries=1 @glibc.only-for.secure-binaries=1 Reviewed-by: Arjun Shankar commit 9a953f9a48b4b8d1124dc4a8b7a8426157a7b1bd Author: DJ Delorie Date: Thu Jun 25 23:30:39 2026 -0400 Add system-wide tunables: Apply tunables part Load ld.so.cache and fetch the tunables extension. Apply those tunables to the current program. We do not yet apply security policies. Reviewed-by: Arjun Shankar commit b9957a70b82203d91b0659b93cfe8632f954aba3 Author: DJ Delorie Date: Tue Jun 30 16:49:42 2026 -0400 Add system-wide tunables: cache ld.so.cache The purpose of this change is twofold: 1. The ld.so.cache is cached in memory and only re-read if/when it changes on disk. This allows us to have much more intensive security checks in the future, without impacting performance as much. It also allows for cases where the cache is corrupted - we continue using the last valid one. 2. We break out the load/check logic so that the cache can be loaded independently of the library lookup, such as for code that only needs to look at the extensions. Reviewed-by: Arjun Shankar commit e24269f74b8cd37ce33652e752f8012c3bfcdadc Author: DJ Delorie Date: Thu Jun 25 23:30:39 2026 -0400 Add system-wide tunables: ldconfig part Adds support for reading /etc/tunables.conf The file contains one line per tunable, like this: glibc.foo.bar=14 glibc.malloc.more=0 Additionally, each line can be prefixed with a single word or character that controls overridability by the GLIBC_TUNABLES env var: overridable glibc.foo=0 +glibc.foo=0 ^ May be overridden (the default) nonoverridable glibc.foo=0 -glibc.foo=0 ^ May not be overridden The tunable cache format allows for a filter to be assigned to each tunable, to be used at program start to decide if a tunable applies to that program. No such filters have yet been specified. The cache format also stores a pre-parsed value for the tunable, and the ID of the tunable, to improve load-time performance. Reviewed-by: Arjun Shankar commit ccd4cd5324caaaea1bb12bc8cef073170da51a19 Author: H.J. Lu Date: Sat Apr 18 11:36:41 2026 +0800 malloc: Don't call __get_thp_mode/__get_thp_size twice Both ld.so and malloc track kernel THP mode and THP page size when THP in ld.so is enabled by GLIBC_TUNABLES=glibc.elf.thp=1 and THP in malloc is enabled by GLIBC_TUNABLES=glibc.malloc.hugetlb=1 But DL_MAP_DEFAULT_THP_PAGESIZE and MALLOC_DEFAULT_THP_PAGESIZE may be different when they are defined in . If THP in ld.so is enabled, change malloc to use kernel THP mode from ld.so, instead of calling __get_thp_mode, and use THP page size from ld.so if it came from __get_thp_size. This avoids calling __get_thp_mode and __get_thp_size again, which are quite expensive: 1. Initialize mp_.thp_mode and GL(dl_thp_mode) to thp_mode_unknown. 2. Set mp_.thp_mode to GL(dl_thp_mode) if GL(dl_thp_mode) isn't thp_mode_unknown. Otherwise call __get_thp_mode to set mp_.thp_mode. 3. GL(dl_elf_thp_pagesize) is set to DL_MAP_DEFAULT_THP_PAGESIZE without calling __get_thp_size and THP page size for malloc may be different from THP page size for ld.so. Set mp_.thp_pagesize to GL(dl_elf_thp_pagesize) if DL_MAP_DEFAULT_THP_PAGESIZE is defined. Otherwise call __get_thp_size to set mp_.thp_pagesize. 4. THP page size in malloc is capped to MAX_THP_PAGESIZE. If THP page size is above MAX_THP_PAGESIZE, THP in malloc is disabled. These result in when glibc.elf.thp is set to 1, malloc uses the actual kernel THP mode instead of defaulting to madvise mode and madvise_thp will stop issuing MADV_HUGEPAGE if kernel THP mode is always. This fixes BZ #34083. Signed-off-by: H.J. Lu commit 96773cc77bc7596fb503dc1f0cf916a98f1c3701 Author: Jiri Stransky Date: Tue Jun 23 16:15:25 2026 +0200 nis: Fix a memory leak in nis_creategroup when malloc fails The zo_domain field was missing from the list of fields to be freed. Reviewed-by: DJ Delorie commit 21103aef1263beae17dea86153d594a428ed6a7f Author: Xiang Gao Date: Thu Jun 25 16:29:57 2026 +0800 stdio-common: Fix scanf nan/inf pushback [BZ #34208] When scanf parses special floating-point inputs like "nan", "inf", it may read one extra character to check whether the input still matches the expected word. If that extra character does not match, the conversion should fail, but the character has already been read from the stream. Some error paths did not push it back before reporting the conversion error, so later input started at the wrong position. Fix this by keeping EOF and width errors separate from character mismatch errors. Push the character back before calling conv_error for mismatch errors. Add narrow and wide scanf tests using the same test body. The test cases focus on the paths changed by this patch: mismatches while matching "nan", "nan(...)", "inf", and "infinity". Tested on x86_64 Fedora 42. The following tests passed without regressions: make test t=stdio-common/tst-scanf-bz34208 make test t=stdio-common/tst-wscanf-bz34208 make subdirs="stdio-common libio" check Signed-off-by: Xiang Gao Reviewed-by: Adhemerval Zanella commit ead80441e694fa52ac2fc36b11f21e35abe393ea Author: Michael Ford Date: Thu Jun 25 10:21:16 2026 +0100 nss: Remove --enable-static-nss configure option Since the NSS reorganization in glibc 2.33 the --enable-static-nss option no longer changes the build: the files and dns services are built into libc unconditionally, and there is no longer any mechanism to bake the remaining services into libc.a. After removing the dead -DSTATIC_NSS define and the include (commits 82b710c1900944ea122a3880f542215948fc023d and 21694014388ad278aa03241800d1f0c0a7127ad1), the option's only remaining effect was to define DO_STATIC_NSS, which suppresses the static link warnings on the NSS interface functions in libc.a. With DO_STATIC_NSS gone, nss_interface_function emits the static link warning unconditionally; static_nss and build-static-nss are removed along with the configure option. tst-nss-static, previously built only when build-static-nss was set, is now added to tests-static unconditionally so the static NSS path retains test coverage. Signed-off-by: Michael Ford Reviewed-by: Adhemerval Zanella commit 657fe73fb1ce09c109fffafb16d565eedbbe05ed Author: Adhemerval Zanella Date: Fri Jun 19 14:40:03 2026 -0300 manual: Document indirect functions (IFUNC) Add a new section to the Dynamic Linker chapter describing the STT_GNU_IFUNC mechanism: the resolver calling convention for each supported architecture, when resolvers run, and the functionality supported in resolvers (TLS access, stack protector, cross-object references) along with the remaining restrictions, reflecting the recent ordering fixes (BZ 20680, BZ 23240, BZ 28817, BZ 34164, BZ 34170). Also cross-reference it from the hardening section. Reviewed-by: Yury Khrustalev commit c9b5a4a593f24e19c889726f8fca9557962cf974 Author: Sachin Monga Date: Thu Jun 18 05:34:04 2026 -0500 ppc64le: Restore optimized memchr for power10 [BZ #34300] Restore the POWER10 memchr implementation reverted in commit a7877bb6685300f159fa095c9f50b22b112cddb8 [BZ #33059], addressing the actual cause: The non-volatile vector register v20 used as the zero vector (M_VREG_ZERO) is replaced with the volatile register v17. Additionally, the assembler workaround used earlier for the instructions lxvp and vextractbm is replaced with actual instructions. commit a014af39fd36151b204dfb6e91bef0788272c811 Author: Shengwen Cheng Date: Wed Jun 24 17:52:49 2026 +0000 riscv: Fix RV32 libthread_db THREAD_SELF register layout The RISC-V libthread_db THREAD_SELF descriptor currently assumes 64-bit general-register slots: REGISTER (64, 64, 4 * 8, ...) That is correct for RV64, where tp/x4 is at byte offset 4 * 8 in the general register set. On RV32, general-register slots are 32-bit wide, so tp/x4 is at byte offset 4 * 4. Using the RV64 layout on RV32 makes libthread_db read the wrong thread pointer value and prevents GDB from enabling pthread-aware thread debugging. Use a helper macro to pass the RISC-V register size into the DB_THREAD_SELF definition. Signed-off-by: Shengwen Cheng Reviewed-by: Peter Bergner commit 16c74b94b9c3a5d1360cb1a1049ff0e7b0f031dd Author: Adhemerval Zanella Date: Wed Jun 24 13:40:50 2026 -0300 elf: Fix clang-18 build of ifunc resolver tests clang-18 errors on the static ifunc resolvers seen as unused. commit 8e5c2999803be8b4a1c831268f24d12f258c38bf Author: H.J. Lu Date: Tue Jun 23 05:15:38 2026 +0800 arm: Xfail 2 static THP tests Since 2 static THP tests fail on arm: FAIL: elf/tst-thp-1-no-s-code-static FAIL: elf/tst-thp-1-static due to limitations of arm32 kABI: https://sourceware.org/bugzilla/show_bug.cgi?id=34096 xfail them. Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella commit d00085d6d0975715607e74945d4fde66a1823052 Author: H.J. Lu Date: Tue Jun 23 08:10:05 2026 +0800 thp: Limit THP code padding to 2 * THP page size Since R_ARC_S25W_PCREL range is limited, 32MB THP code padding leads to relocation overflow: .../support/libsupport_nonshared.a(support_test_main.oS): in function `support_test_main': .../support/support_test_main.c:396:(.text+0x650): relocation truncated to fit: R_ARC_S25W_PCREL_PLT against symbol `atexit' defined in .text section in ../glibc/libc_nonshared.a(atexit.oS) .../install/compilers/arc-linux-gnu/arc-glibc-linux-gnu/bin/ld: final link failed collect2: error: ld returned 1 exit status Limit THP code padding to 2 * THP page size to avoid R_ARC_S25W_PCREL relocation overflow. Tested natively for Linux/x86-64 and Linux/i686 as well as with build-many-glibcs.py for arc-linux-gnu. This fixes BZ #34311 Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella commit 98e1e467a80b1f434e1c6d0275881e51a2eed4f2 Author: Mike FABIAN Date: Fri Jun 19 11:45:41 2026 +0200 Update documentation of iconv [BZ #30136] Reviewed-by: Florian Weimer commit 2cce7ec3c85d568db4727be17c67839de6ed5c4a Author: Pierre Blanchard Date: Thu Jun 18 21:44:43 2026 +0000 AArch64: additional mathvec build system cleanups. Rely on a single list of ISAs and precisions for source, tests and benchmarks. Reviewed-by: Adhemerval Zanella commit c5a4d7ccb2dc9f4bb2ed61c7c3463be97d28cc68 Author: Pierre Blanchard Date: Thu Jun 18 21:44:42 2026 +0000 AArch64: Update SHARED-FILES with files from Arm Optimized-Routines Adds lists for math.h and string.h and track file revisions. Reviewed-by: Adhemerval Zanella commit 5a60281b88a7dfd4423648fc8e1e02609219a4b6 Author: Pierre Blanchard Date: Thu Jun 18 21:44:41 2026 +0000 AArch64: Update mathvec directory structure. The new structure matches that of Arm Optimized-routines, to facilitate files traceability. Reviewed-by: Adhemerval Zanella commit f9deb2f50b59607abe6219c6edf9fe3488504b32 Author: John David Anglin Date: Tue Jun 23 13:41:10 2026 -0400 hppa: Fix missing call to __feraiseexcept (BZ 34306) The feupdateenv function is supposed to raise exceptions after installing the environment represented by its envp argument. This was accidentally missed on hppa. The failure to raise exceptions was noticed by the failure of the math/test-narrowing-trap test. Signed-off-by: John David Anglin commit b61b98e3d0c81c85200e2082407708c7b0e821a3 Author: Sergey Kolosov Date: Mon Jun 22 20:15:44 2026 +0200 resolv: Add test for gethostbyname_r unaligned buffer [BZ #18287] Add a test for the buffer overflow in gethostbyname_r (Bug 18287), which occurs when alignment padding is not subtracted from the remaining buffer length. The test uses binary search to find the exact required buffer size for a mocked DNS response. It then tests all pointer misalignments (1-7 bytes) using a custom 0xAA guard region. This guarantees deterministic detection of out-of-bounds writes, avoiding false negatives caused by malloc chunk rounding. Reviewed-by: Florian Weimer commit 91eb5057b9d9e7e20e976a74e3e777310007c47a Author: Justus Winter <4winter@informatik.uni-hamburg.de> Date: Thu Aug 15 10:43:35 2013 +0200 Define _PATH_MOUNTED as "/etc/mtab" Change the definition of _PATH_MOUNTED to "/etc/mtab". This is the value used on Linux, and BSD also uses /etc/mtab. The change is motivated by the fact that on Debian /etc/mtab is a symbolic link to /proc/mounts. This patch adjusts the macro for non-linux systems such as Hurd. Changing this using sysdeps/mach/hurd/paths.h causes build problems because /usr/include/hurd/paths.h is shadowed by this file. This change is proposed in the hope that aligning the non-linux targets with the glibc for Linux is perceived as a good thing while fixing this problem on Debian/Hurd along the way. commit bc76aa16589494458b8430da38d077d399fe8990 Author: Adhemerval Zanella Date: Tue Apr 21 11:08:27 2026 -0300 Add advisory text for CVE-2026-6791 Reviewed-by: Carlos O'Donell Reviewed-by: Siddhesh Poyarekar commit 07c24f35392b727e6100d33edfdf811a6c68c218 Author: Adhemerval Zanella Date: Tue Apr 14 10:50:37 2026 -0300 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791) The parse_tilde function previously used strndupa to allocate memory for the parsed username on the stack, and since the input is user-defined, this can lead to a stack overflow. This patch fixes the issue by replacing strndupa with scratch_buffer, by reusing the buffer used in the __getpwnam_r call. The new “tst-wordexp-tilde.c” test is a test-container to avoid using system-defined NSS modules. Checked on x86_64-linux-gnu and i686-linux-gnu. commit 60f7247847ba7244541fc783079c298416756399 Author: Yao Zihong Date: Sat Jun 20 22:54:22 2026 -0500 riscv: Add RVV memmove for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of memmove for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__memmove_vector) is added alongside the generic fallback (__memmove_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling memmove(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit 53d909a283085c82bdcc71e1cf06c0899506b664 Author: H.J. Lu Date: Mon Apr 13 08:23:05 2026 +0800 elf: Support THP segment load with madvise enabled THP The current THP segment load approach works only when THP is enabled with always in the kernel. If THP is enabled with madvise in the kernel, to enable THP segment load in an application, madvise should be called with MADV_HUGEPAGE on all THP eligible PT_LOAD segments: 1. Define DL_MAP_DEFAULT_THP_PAGESIZE in hugepages.h and default it to 0. If DL_MAP_DEFAULT_THP_PAGESIZE is defined, assume kernel THP madvise mode. If kernel THP mode is always or never, there is an extra madvise call which has no impact. DL_MAP_DEFAULT_THP_PAGESIZE is defined for x86-64 and 64-bit loongarch. 2. Update _dl_map_segment_align to support madvise THP mode. This fixes BZ #34079. 3. Call _dl_executable_postprocess in rtld_setup_main_map for dynamic executables and in LIBC_START_MAIN for static executables, which calls madvise with MADV_HUGEPAGE on all THP eligible PT_LOAD segments in executable. This fixes BZ #34080 for both dynamic and static executables. 4. Call _dl_postprocess_loadcmd_extra in _dl_postprocess_loadcmd, which calls madvise with MADV_HUGEPAGE on all THP eligible PT_LOAD segments when loading an object after they have been mapped in. This fixes BZ #34080 for shared objects. 5. Set the maximum page alignment on THP tests to THP page size as the default maximum page alignment may be smaller than THP page size. 6. Add tests to verify that large executable PT_LOAD segments in executables are mapped at addresses aligned to THP page size when the kernel is configured to use THP in "always" mode or "madvise" mode by inspecting /proc/self/maps to check that the mapping address is aligned to THP page size reported by the kernel. Also verify that madvise is called with MADV_HUGEPAGE when the glibc tunable glibc.elf.thp=1 is used and madvise isn't called with MADV_HUGEPAGE when the glibc tunable glibc.elf.thp=0 is used. Skip these tests if THP page size cannot be determined or if THP is not enabled in "always" mode nor "madvise" mode. Quote WANG Rui : From benchmarking a clang build of the Linux kernel on x86_64 with your patch in THP madvise mode, I observed that iTLB misses were reduced, similar to what we see in THP always mode. NB: Some THP tests fail on arm due to limitations of arm32 kABI: https://sourceware.org/bugzilla/show_bug.cgi?id=34096 Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella commit 9310db5a085e80f0c15408675e2e5c054a7d5c9e Author: Carlos O'Donell Date: Fri Jun 19 16:12:40 2026 -0400 advisories: Update GLIBC-SA-2026-0012 metadata Update vulnerable versions in descriptive text. commit da11a7d92c32d19058a9b35b5c1c0bcc75afbd12 Author: Adhemerval Zanella Date: Fri Jun 19 14:16:34 2026 -0300 Remove unused THREAD_SET_POINTER_GUARD and THREAD_COPY_POINTER_GUARD Commit a5ec880f808ee7268d985bed4f961799bdc0a4bf ("Consolidate pointer guard to use a relro variable instead of the TCB") moved the pointer guard to the module-local relro variable __pointer_chk_guard_local and dropped the THREAD_{SET,COPY}_POINTER_GUARD macros, which are no longer defined by any target. Checked on a build for all afftected targets. commit 4ba0b79b9596e5a4951cc9eaa1546a55e543e083 Author: Florian Weimer Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069) This test case covers both input buffer overreads and output buffer overflows. It should systematically cover these issues. I used code auto-generation for updating the test expectations for truncated RDATA in TXT, ISDN records, after writing the rest of the test by hand. Assisted-by: LLM Reviewed-by: Carlos O'Donell Reviewed-by: Adhemerval Zanella commit a7b60d23bbb56eaef59f4962e4140062e552600a Author: Florian Weimer Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238) Check that the RDATA payload does not require more than RDATALEN bytes while processing it. The fixes cover A6, LOC records. (CERT, TKEY, TSIG were fixed before, by switching to the generic formatter.) The vulnerable LOC record handling was first introduced before glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. CERT, TSIG, TKEY handling came with commit b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. A6 record handling was introduced in commit 91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc 2.7. This fixes bug 34069. Reviewed-by: Carlos O'Donell Reviewed-by: Adhemerval Zanella commit ca44a6609c29a683b03575fa035c6d17aa591e72 Author: Florian Weimer Date: Fri Jun 19 18:22:20 2026 +0200 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy implementations of TSIG, fixing bug 34033, and partially fixing bug 34069. Reviewed-by: Carlos O'Donell Reviewed-by: Adhemerval Zanella commit cd0db208d56a2cecd528b8ae96df752ba5344d9a Author: Florian Weimer Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Check for inet_ntop failure in ns_sprintrrf This makes the output more consistent (either failure or complete output) and helps with systematic testing with varying buffer sizes. Reviewed-by: Carlos O'Donell Reviewed-by: Adhemerval Zanella commit d58415eb17d457a160af99f9e8ab164404ca151b Author: Florian Weimer Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Improve formatting of unknown records in ns_sprintrrf Do not add the "unknown RR type" comment. After adding the TYPE prefix, the number is largely redundant. Reviewed-by: Carlos O'Donell Reviewed-by: Adhemerval Zanella commit f69b7f95e3694177546faec25d88bb266885c3b8 Author: Florian Weimer Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289) The p_class and p_type results could overwrite each other if both were unknown. Format unknown values with CLASS and TYPE prefixes, as in RFC 3597. Handle A6 separately because it cannot be added to __p_type_syms for ABI reasons. Reviewed-by: Carlos O'Donell Reviewed-by: Adhemerval Zanella commit 360f352c9a6da545d798ef3015e73ca114f0d230 Author: Florian Weimer Date: Fri Jun 19 18:22:20 2026 +0200 resolv: Declare __p_class_syms, __p_type_syms for internal use Reviewed-by: Carlos O'Donell Reviewed-by: Adhemerval Zanella commit 1607beb5f424bff2eb84e97f013f8fda8a6ed5d4 Author: Florian Weimer Date: Fri Jun 19 18:22:20 2026 +0200 Update GLIBC-SA-2026-0012 to mention A6 records It turns out there is a missing inner length check in it, too. Also fix the vulnerable commit. It predates the glibc 2.0 release because the old stream-based formatting code in resolv/res_debug.c had the same bug in its LOC handling. Reviewed-by: Carlos O'Donell Reviewed-by: Adhemerval Zanella commit cdbefe2f940d0ef87c854e13514812785b062988 Author: Wilco Dijkstra Date: Thu Jun 18 17:02:59 2026 +0000 string: Improve memchr random test Add matches before the start to ensure the memchr test checks they do not result in false matches or missed matches. Reviewed-by: Adhemerval Zanella commit 4e105d9855977f3937ab75e03a541154d07d96a6 Author: Dylan Fleming Date: Thu Jun 18 14:55:42 2026 +0000 AArch64: Vectorise SVE fp64 sin/cos special case Implemented double precision vector fallback for SVE sin/cos. Includes rewrite of sin to use trig instructions. Reviewed-by: Wilco Dijkstra commit 708185c829f2657ccfb2d9cf53dbe59bf15ce4cc Author: Dylan Fleming Date: Thu Jun 18 14:55:31 2026 +0000 AArch64: Vectorise AdvSIMD fp64 sin/cos special case Implemented double precision vector fallback for AdvSIMD sin/cos. Reviewed-by: Wilco Dijkstra commit e585d88982e79fbc117c1b1e7bec541c70981182 Author: Dylan Fleming Date: Thu Jun 18 14:55:15 2026 +0000 AArch64: Vectorise SVE fp32 sin/cos special case Implemented single precision vector fallback for SVE sinf/cosf. Includes a rewrite of SVE sinf to use the trig instructions. Reviewed-by: Wilco Dijkstra commit faa9ea921abdb5affae09b430f1d28c86c7405a0 Author: Dylan Fleming Date: Thu Jun 18 14:54:57 2026 +0000 AArch64: Vectorise AdvSIMD fp32 sin/cos special case Implemented single precision vector fallback for AdvSIMD sinf/cosf. Includes cleanup of the fast pass to remove old styling and conventions. Reviewed-by: Wilco Dijkstra commit a3b1faddafc0d46653693546658b5955f8d2dfd7 Author: Yury Khrustalev Date: Wed Jun 17 11:09:20 2026 +0100 news: Describe AArch64-specific changes for 2.44 Reviewed-by: Wilco Dijkstra  commit 242a1f4b0f8d72948ee14a33c2dd5d0c361b6d73 Author: Adhemerval Zanella Date: Tue Jun 16 16:10:01 2026 -0300 elf: Do not scrub AT_RANDOM to a constant when reseeding fails (BZ 34197) _dl_reseed_random zeroed the AT_RANDOM bytes before refilling them with getrandom (GRND_NONBLOCK). That call is best-effort and can write nothing (e.g. before the kernel entropy pool is initialized early at boot), leaving the 16 bytes as a constant zero. Since the value is exposed through getauxval (AT_RANDOM), this traded a potential guard leak for a guaranteed predictable value. Drop the memset and overwrite the bytes in place instead. The generic version now just drops the pointer (it is not used anywhere). Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: Florian Weimer commit 368438d8b6e28b034dbf4722290ae4b3989bac57 Author: Wilco Dijkstra Date: Mon Jun 15 16:11:55 2026 +0000 manual: Update memchr description [BZ #19406] Update memchr description to indicate it cannot overread and the size may be larger than the object passed. This is required since C11. Suggested-by: Paul Eggert Reviewed-by: Paul Eggert commit 89b4605be88a10256a41f010a636df5d2b0fe2bd Author: Samuel Thibault Date: Wed Jun 17 01:25:49 2026 +0200 hurd: Add ETH_TLEN and ETH_FCS_LEN commit 145b53b22a6e68c5965e90384c4629515584363c Author: Samuel Thibault Date: Wed Jun 17 01:24:17 2026 +0200 hurd: Fix ETH_P_PUP According to IANA, PUP is 0200 commit 8d184c42cc6d3160365962983252947b55dee10f Author: Samuel Thibault Date: Wed Jun 17 01:17:21 2026 +0200 Factorize if_arp.h They were essentially identical between linux and hurd, and are OS-independent. commit 337e18d6617bb93a6c718818c4d77d000878dbb6 Author: Adhemerval Zanella Date: Fri Jun 12 13:10:16 2026 -0300 elf: Scrub and reseed the AT_RANDOM bytes after deriving the guards (BZ 34197) Once the pointer and stack guards have been derived from AT_RANDOM, scrub the bytes and refill them with new random data unrelated to the guards. On Linux, it uses getrandom syscall (as for tcache_key_initialize), and fallback to zero the memory if the syscall is not avaiable. This keeps AT_RANDOM useful to applications while ensuring those bytes no longer reveal the guards. The work is done by _dl_reseed_random, called once the guards are in place and before any ELF constructor can observe AT_RANDOM: in security_init for the dynamic loader and in __libc_start_main for statically linked programs. Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu. Reviewed-by: DJ Delorie commit 604fe0b87bf56f2c95206a8cffac71548b4436cb Author: Adhemerval Zanella Date: Fri Jun 12 13:10:15 2026 -0300 Consolidate dl-osinfo.h into the generic implementation The generic and the Linux _dl_setup_stack_chk_guard and _dl_setup_pointer_guard are identical when the kernel provides the AT_RANDOM auxiliary vector, which is always the case on the supported Linux kernels; the generic version only adds a fallback for a missing AT_RANDOM. Remove the Linux-specific dl-osinfo.h and use the generic one for all targets. The removed header pulled in , which is what transitively declared __libc_enable_secure for dl-parse_auxv.h; include there directly so it no longer relies on that. Include in the generic header so it is self-contained. Reviewed-by: DJ Delorie commit 78f1f0e39cd41d28ae771eb3498bc33780c85cfd Author: Adhemerval Zanella Date: Fri Jun 12 13:10:14 2026 -0300 Consolidate the C pointer guard and align the assembly implementations The per-architecture pointer_guard.h files all implemented some variant of C PTR_MANGLE/PTR_DEMANGLE: the i386 and x86_64 versions did an exclusive-or by the guard followed by a rotate left by 2 * sizeof (uintptr_t) + 1 bits (9 on 32-bit, 17 on 64-bit), while the other targets did the exclusive-or only. The assembly macros likewise rotated on i386 and x86_64 but not on the other targets. Consolidate everything to use XOR + rotate uniformly: collapse the per-architecture C headers into a single generic implementation, and add the matching rotate to the assembly implementations that lacked it. Targets with an assembly rotate instruction (aarch64, arm, loongarch, powerpc, s390, csky) just add it. Those without one (alpha, sparc, sh) synthesize the rotation: alpha and sparc with a shift/shift/or sequence, which needs an extra scratch register added to the PTR_MANGLE/PTR_DEMANGLE macros, sh with single-bit rotates, which needs no scratch. The s390 __longjmp and ____longjmp_chk demangle the return address and stack pointer in C, so update those too. Checked with setjmp, ptrguard and longjmp_chk tests for all supported ABIs that can run under qemu (all but csky), and with builds for all supported ABIs. Reviewed-by: DJ Delorie commit c626d764d7ea2ffe3e5dd60452435eeaebdf68f6 Author: Adhemerval Zanella Date: Fri Jun 12 13:10:13 2026 -0300 Remove the jmp_buf stack pointer demangle on ABIs that do not mangle it arc, m68k, microblaze, mips, and riscv store the raw stack pointer in setjmp, while their jmpbuf-unwind.h applies PTR_DEMANGLE to it in _jmpbuf_sp. This is currently harmless because these ABIs use the generic pointer_guard.h, where the C PTR_DEMANGLE is a no-op. No functional change. Reviewed-by: DJ Delorie commit afc90416e947cfe1c85fac3985f2a809d4005aad Author: Adhemerval Zanella Date: Fri Jun 12 13:10:12 2026 -0300 Split pointer_guard.h into C and assembly headers Move the assembly PTR_MANGLE/PTR_DEMANGLE definitions out of each pointer_guard.h into a new sibling pointer_guard-asm.h, guarded by __ASSEMBLER__. pointer_guard.h now includes pointer_guard-asm.h and keeps only the C definitions. No functional change: the .S and .c files still include pointer_guard.h and get the same macros, and resolves per-arch through the usual sysdeps include path. Checked with a build for all affected ABIs. Reviewed-by: DJ Delorie commit d50ae543a49b139c38fdc7746454d37942f911b3 Author: Adhemerval Zanella Date: Fri Jun 12 13:10:11 2026 -0300 Enable the pointer guard in the dynamic loader i386, powerpc, s390, sh and sparc fell back to the generic no-op pointer_guard.h in ld.so, so the loader's own setjmp/longjmp and mangled function pointers were left unprotected (the other targets already mangle in rtld). ld.so is position-independent and sets up __pointer_chk_guard_local early in dl_main, so the loader can reach it the same way a statically linked program does: - powerpc, s390, sh, sparc: select __pointer_chk_guard_local for IS_IN (rtld) and reuse the existing PIC guard load. - i386: load it via @GOTOFF off a GOT pointer set up with LOAD_PIC_REG in the caller-provided scratch register (ld.so does not keep the GOT in %ebx at the setjmp/longjmp entry). - s390: drop the IS_IN (rtld) "#undef PTR_DEMANGLE" in __longjmp.c so the loader's longjmp demangles to match its setjmp. Checked on x86_64-linux-gnu, aarch64-linux-gnu, i686-linux-gnu, and armv7a-linux-gnueabihf. I also run elf and setjmp checks on qemu loongarch64, powerpc64, powerpc64le, and s390x systems. Reviewed-by: DJ Delorie commit a5ec880f808ee7268d985bed4f961799bdc0a4bf Author: Adhemerval Zanella Date: Fri Jun 12 13:10:10 2026 -0300 Consolidate pointer guard to use a relro variable instead of the TCB For the targets that still read the pointer guard from the thread descriptor (i386, x86_64, powerpc, s390, sparc, and sh), mangle and demangle pointers using the module-local __pointer_chk_guard_local (in ld.so and static binaries) or the global __pointer_chk_guard provided by the dynamic loader (in shared objects), matching the scheme already used by aarch64, alpha, arm, csky and loongarch. On i386 the guard is no longer reachable as a single %gs-relative memory operand, so the assembly PTR_MANGLE/PTR_DEMANGLE PIC variants need a register to hold the GOT pointer and the guard address. This removes the dependency on the TCB pointer_guard slot: drop THREAD_{GET,SET,COPY}_POINTER_GUARD and the POINTER_GUARD tcb-offset, and point the POINTER_CHK_GUARD test macro at the relro variable. The tcbhead_t slot is kept (renamed to an unused reserved field, except on s390 which reused the stack guard) to preserve the ABI. s390 gains a distinct pointer guard rather than aliasing the stack guard. Checked on x86_64-linux-gnu, aarch64-linux-gnu, i686-linux-gnu, and armv7a-linux-gnueabihf. I also run elf and setjmp checks on qemu loongarch64, powerpc64, powerpc64le, and s390x systems. Reviewed-by: DJ Delorie commit 3785d4c0d0f2d1b08c4f1b744afa05951985e94d Author: Adhemerval Zanella Date: Fri Jun 12 13:10:09 2026 -0300 elf: Propagate the pointer guard to ld.so loaded via static dlopen (BZ 34196) The static-dlopen does not initialize the pointer guard for ABIs that define THREAD_SET_POINTER_GUARD. Besides not properly guard the pointer if a libc.so symbol is called, this can lead to setjmp failures (a jmp_buf set up by the loaded libc.so.6 cannot be restored by the static program's __longjmp, and vice versa). Seed the just-mapped loader's __pointer_chk_guard from the program's __pointer_chk_guard_local in __rtld_static_init, next to the other runtime values copied there. Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu. Reviewed-by: DJ Delorie commit a767fbcff0eefc64cb6b2369a34b5205468dbafd Author: Adhemerval Zanella Date: Wed Jun 10 11:15:35 2026 -0300 math: Sync acosh with CORE-MATH 887cab6f It syncs with CORE-MATH commit 887cab6f. The new tests are from the CORE-MATH acosh worst-cases inputs that trigger the FE_TOWARDZERO issue with the previous implementation, along with the hard-to-round cases from CORE-MATH commits 72febed6 and ce9e99f6. Checked on x86_64-linux-gnu, x86_64-linux-gnu with --disable-multi-arch (so soft FMA implementation is used), i686-linux-gnu (which uses its own acosh implementation), aarch64-linux-gnu, and armv7a-linux-gnueabihf. Reviewed-by: Paul Zimmermann commit 82b710c1900944ea122a3880f542215948fc023d Author: Michael Ford Date: Wed Jun 10 17:24:50 2026 +0200 inet: Remove unused STATIC_NSS define The --enable-static-nss configuration adds -DSTATIC_NSS to CFLAGS for the inet subdirectory, but no source file has referenced the STATIC_NSS macro for quite some time. So remove the dead define. Signed-off-by: Michael Ford Reviewed-by: Adhemerval Zanella commit 21694014388ad278aa03241800d1f0c0a7127ad1 Author: Michael Ford Date: Thu Jun 11 15:58:04 2026 +0200 nss: Remove include from nsswitch.c nsswitch.c no longer references any of the *_SO macros provided by . The only consumer, __nss_shlib_revision, moved to nss_module.c as part of the NSS reorganization in glibc 2.33 (and nss_module.c includes the header unconditionally), but the guarded include was left behind. Signed-off-by: Michael Ford Reviewed-by: Adhemerval Zanella commit 1111fbdd3e7ebed402800bc23e67055eaae0d972 Author: Adhemerval Zanella Date: Wed May 13 08:32:24 2026 -0300 arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792) _dl_runtime_resolve and _dl_runtime_profile only preserved the integer argument registers (r0-r3) across the inner call to _dl_fixup / _dl_profile_fixup. Two related ABI requirements demand more: * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the function being resolved. Recent GCC emits VFP instructions inside the fixup routines, clobbering them, so the resolved function sees corrupted arguments (BZ 34144). * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers reachable through the dynamic linker) must only corrupt integer core registers. IFUNC resolvers, audit modules, and interposed malloc invoked during symbol resolution may also use VFP, even on softfp ABI builds (BZ 15792). Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31 when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup call. Whether VFP is usable is a property of the hardware, not of the ABI glibc was built with, so the decision is gated on AT_HWCAP at runtime in both hardfp and softfp builds; hardfp builds will always find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU correctly skip the save. For _dl_runtime_profile the save area is slipped in just before the bl to _dl_profile_fixup; the outgoing framesizep argument is recomputed to account for the extra frame, and both the fast path (no audit framesize) and the slow path (audit wraps with pltenter/pltexit) traverse the restore before splitting. Checked on arm-linux-gnueabihf. Tested-by: Aurelien Jarno Reviewed-by: Wilco Dijkstra commit 6adb7400fd9de486b5fb3db799c9fabee1ab5786 Author: Adhemerval Zanella Date: Fri Jun 5 13:43:17 2026 +0000 aarch64: Fix static PIE CPU feature detection (BZ 34205) ARCH_INIT_CPU_FEATURES is called from __libc_start_main before _dl_relocate_static_pie, so any code it runs must not rely on relocations being applied yet. Two issues break this under static PIE: 1. The cpu_list table held 'const char *name' members, whose addresses are not link-time constants under PIE and thus require base-relative relocations that are not yet in place. Replace the array of structs with a flat NUL-separated name string and a parallel midr array, removing the pointer relocations. 2. tunable_strcmp pulls in memcmp, which is an IFUNC and is likewise unresolved at this point. Redirect memcmp to __memcmp_generic in the aarch64 dl-symbol-redir-ifunc.h and include it from csu/libc-start.c. Checked on aarch64-linux-gnu. Reviewed-by: Wilco Dijkstra commit 1cba6073e500c7bde9322a2f536fc0c308846c61 Author: Sana Kazi Date: Mon Jun 15 16:37:59 2026 +0200 nptl: open threads comm with O_WRONLY|O_CLOEXEC pthread_setname_np opens the thread's comm file using O_RDWR, but the function only ever writes to it. This causes two distinct problems: 1. Missing O_CLOEXEC: the file descriptor is not marked close-on-exec, so it remains open across fork+exec. A child process that audits its inherited file-descriptor set will encounter an unexpected /proc fd it did not open and may treat this as a security violation and abort. 2. Unnecessary O_RDWR: requesting read+write access when only write access is needed can cause open() to fail under security policies that permit writing to /proc//comm but deny reading it. Fix both issues by replacing O_RDWR with O_WRONLY|O_CLOEXEC Similarly, updated pthread_getname_np to use O_CLOEXEC. Bug-Id: 34192[https://sourceware.org/bugzilla/show_bug.cgi?id=34192] Signed-off-by: Sana Kazi Reviewed-by: Florian Weimer commit 9ed3576e61f7a87eb83d512531566f5e5d6bb032 Author: Yury Khrustalev Date: Tue May 26 11:19:53 2026 +0100 malloc: aarch64: Add ifuncs for malloc functions Introduce ifuncs and resolvers for functions pertinent to the malloc interface on the AArch64 target: malloc, calloc, free, realloc, memalign, valloc, pvalloc, posix_memalign, aligned_alloc, free_sized, free_aligned_sized, malloc_usable_size. A target can define the USE_MULTIARCH_MALLOC macro. In this case it must provide alternative aliases for the malloc functions that point to the ifuncs. This implementation respects the --disable-multi-arch configure flag. If multi-arch support is disabled, the generic aliases are used on aarch64. This patch contains aarch64-specific resolvers. At this moment they return core implementations but in the future they can be changed to support for features, e.g. to handle memory tagging. commit df83fa8813eb53dcb232462a4f6dd00c873115f0 Author: Fabian Rast Date: Thu Jun 11 14:30:37 2026 +0200 rtld: cache cpuid results on the stack for intel dl_init_cacheinfo retrieves various information about cache sizes, using the cpuid instruction on x86. Previously, the same cpuid leaves were queried multiple times. This behavior caused intel_check_word to prominently show up in profiles of dynamic loader startup on the Intel(R) Xeon(R) Gold 6430. The big performance impact could not be reproduced on other Intel cpus. This patch reduces the number of cpuid queries on startup by caching their results on the stack for reuse when searching for a different cache size value. This approach does not change the overall design of the cache enumeration code (repeated calls to handle_* functions). The values are cached on the stack instead of globally (e.g. in the cpu_features global) because they are never needed after early initialization. The cache is only active for Intel cpus, because it has not yet been shown through benchmarks that it meaningfully improves performance for other processors. Signed-off-by: Fabian Rast Reviewed-by: Sunil K Pandey commit 8ae37adb211a71a685f0ef3f9b9e18beb439198f Author: Joseph Myers Date: Wed Jun 10 18:49:53 2026 +0000 Fix -Wconstant-logical-operand error for Hurd Building for Hurd with GCC mainline produces an error in pt-block.c (here MSG_OPTIONS is a macro that may be defined before pt-block.c is included by another source file): In file included from ../sysdeps/mach/htl/pt-block-intr.c:6: ../sysdeps/mach/htl/pt-block.c: In function '__pthread_block_intr': ../sysdeps/mach/htl/pt-block.c:49:42: error: use of logical '&&' with constant operand '1024' [-Werror=constant-logical-operand] 49 | if ((MSG_OPTIONS & MACH_RCV_INTERRUPT) && err == MACH_RCV_INTERRUPTED) | ^~ ../sysdeps/mach/htl/pt-block.c:49:42: note: use '&' for bitwise operation 49 | if ((MSG_OPTIONS & MACH_RCV_INTERRUPT) && err == MACH_RCV_INTERRUPTED) | ^~ | & Fix this, and a similar error in pt-timedblock.c, with an explicit != 0. Tested with build-many-glibcs.py (compilers and glibcs builds) for i686-gnu and x86_64-gnu. commit d8fa402f5edf74b74ef9992b738dce96527e0957 Author: Joseph Myers Date: Wed Jun 10 16:33:27 2026 +0000 Fix -Werror=constant-logical-operand errors in soft-fp Building for sparc64-linux-gnu with GCC mainline produces a series of -Werror=constant-logical-operand errors in soft-fp code, relating to calls to _FP_TO_INT where rsigned is -1 not 0 or 1. Use explicit != 0 in the soft-fp code to avoid these errors. Tested with build-many-glibcs.py (compilers and glibcs builds) for sparc64-linux-gnu with GCC mainline. commit 690472e2a50a523f77992f606724e1c26210af3d Author: Joseph Myers Date: Wed Jun 10 14:01:34 2026 +0000 Fix -Wconstant-logical-operand error in tst-printf-format-skeleton.c Building the glibc testsuite with GCC mainline fails with: In file included from tst-printf-format-skeleton-double.c:33, from tst-printf-format-p-double.c:20: tst-printf-format-skeleton.c: In function 'do_test': tst-printf-format-skeleton.c:308:12: error: use of logical '&&' with constant operand '53' [-Werror=constant-logical-operand] 308 | if (PREC && printf ("prec:%i\n", PREC) < 0) | ^~ tst-printf-format-skeleton.c:308:12: note: use '&' for bitwise operation 308 | if (PREC && printf ("prec:%i\n", PREC) < 0) | ^~ | & cc1: all warnings being treated as errors Fix this using an explicit "!= 0". Tested with build-many-glibcs.py for aarch64-linux-gnu. commit 9cf4dd03bdfd8b4113400e6b56c6d665c3c739ae Author: Zihong Yao Date: Tue Jun 9 03:27:54 2026 +0000 riscv: Keep __memcmpeq alias with RVV memcmp Commit 2efc702628 replaces the generic RISC-V memcmp, which also exports __memcmpeq. A dedicated RISC-V __memcmpeq implementation is expected in a later patch, which is still under review. Keep the alias here so this patch does not temporarily drop the existing __memcmpeq ABI. Tested on a Muse-Pi board with GCC 15.2.0 using `--with-arch=rv64g_zca_zcd --with-abi=lp64d` and `CFLAGS="-march=rv64g_zca_zcd -mabi=lp64d -O2"`. Full make check was run for both multiarch and non-multiarch builds. This also fixes the string/inl-tester link failure caused by the missing __memcmpeq symbol. In both runs, the only FAILs are the unchanged cospi/sinpi/tanpi math test failures. Signed-off-by: Zihong Yao Reviewed-by: Adhemerval Zanella commit 6f072238e972670f8553d6b853bb92b8d0de5691 Author: Brian Jorgensen Date: Tue Jun 9 04:32:01 2026 +0200 fcntl-linux.h : Fix typo in comments. (bug 17119) This commit fixes incorrect comments in set / get macros. Signed-off-by: Brian Jorgensen Reviewed-by: Adhemerval Zanella commit e9325bd7d04aacc45cf39505e279b1ca9de22c08 Author: Florian Weimer Date: Tue Jun 9 07:28:02 2026 +0200 iconv: Suppress intermediate errors with //TRANSLIT (bug 34236) When tentatively converting characters on behalf of __gconv_transliterate, do not create a persistent error. Just produce a local error, and rely on __gconv_transliterate to produce the error if all transliteration options are exhausted. This fixes transliteration of “½” to ASCII, which cannot use the “ 1⁄2 ” alternative. Eventually, the “ 1/2 ” alternative is chosen, but the error sticks. Therefore, iconv exited with status 1 before this change. Adjust iconv/tst-iconv_prog.sh to test both C and en_US.UTF-8 locales. This requires changing the way the ICONV template is defined, so that run_program_env is evaluated multiple times. Fixes commit 9a4b0eaf726f5404c6683d5c7c5e86f61c3f3fbc ("iconv: do not report error exit with transliteration [BZ #32448]"), commit 6cbf845fcdc76131d0e674cee454fe738b69c69d ("iconv: Preserve iconv -c error exit on invalid inputs (bug 32046)"), and bug 34236. Reviewed-by: Aurelien Jarno commit 88099e289d07822cebc7fd40645863d769f5a5ad Author: Josef Johansson Date: Mon Jun 8 17:32:27 2026 +0200 nscd: Typo in comment Fixes: https://sourceware.org/bugzilla/show_bug.cgi?id=34240 Signed-off-by: Josef Johansson Reviewed-by: Florian Weimer commit 4e22f9505703fd88a249d37fb6c8320bd1bbc815 Author: Andreas Schwab Date: Tue Mar 31 10:54:01 2026 +0200 libio: use _IO_have_wbackup for wide streams Fix two wrong uses of _IO_have_backup on a wide stream. commit d0cc9bf859d0434e397530d75a6507f13db79fba Author: Sam James Date: Sat Jun 6 20:32:27 2026 +0100 elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210] dbe5065f2166be20e57a24f246a40d50e001a05d and ae589cb84df10825fc545a45c7007a5f79409bf1 cater for setups where ld.so.conf{,.d} is required to find runtime support libraries, but tst-glibc-hwcaps-prepend-cache clobbers the created ld.so.conf with its own entry. Fix it to instead use the ld.so.conf.d created in ae589cb84df10825fc545a45c7007a5f79409bf1 to co-exist with existing entries. Bug: https://bugs.gentoo.org/976773 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31901 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34210 Tested-by: Andreas K. Hüttel Reported-by: Eli Schwartz Reviewed-by: Andreas K. Hüttel commit 2b6f6710a1ee02b3ac87f3342306d82b3e7d087e Author: Adhemerval Zanella Date: Mon May 25 14:26:43 2026 -0300 elf: Remove inhibit_stack_protector from __ifunc_resolver With 01964c3ec8e fix ifunc resolvers can be fully instrumented with stack protector. Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu built with --enable-stack-protector=all. Reviewed-by: H.J. Lu commit f9a11a380d1e18199444670c0e264e3e6f4182b2 Author: Adhemerval Zanella Date: Mon May 25 15:15:01 2026 -0300 elf: Set up TLS slotinfo for dlopen'd modules before relocation (BZ 34170) An IFUNC resolver in a DSO that is being loaded by dlopen is allowed to read its own TLS storage during the resolver call. After af34b1376a3 ("elf: Initialize static TLS before relocation processing (BZ 34164)") that works for the initial-exec model on every supported architecture. However, it does not work for the dynamic-TLS path (on both -mtls-dialect mode, if the ABI supports both). Both lookup paths index the calling thread's DTV by the new module's l_tls_modid and, on miss, walk GL(dl_tls_dtv_slotinfo_list) to discover the module and lazily allocate its TLS block. The just-loaded DSO is however not yet in that list when its resolver fires, so the lookup faults inside dlopen. This is the direct dlopen analog of BZ 34164. The solution is to reorder dl_open_worker_begin so the slotinfo install happens before the relocation pass. The new order is: 1. resize_scopes, resize_tls_slotinfo, add_to_global_resize (unchanged, still recoverable). 2. update_tls_slotinfo: register the new modules in slotinfo, bump dl_tls_generation, initialise their static TLS images. 3. Relocate the new objects. IFUNC resolvers can now read their own DSO's __thread storage via any TLS model. 4. Demarcation point. 5. update_scopes, _dl_find_object_update. Checked on aarch64-linux-gnu and x86_64-linux-gnu. Reviewed-by: H.J. Lu commit 49244da1102f56af20a5a462a2ec704dd0dd94fa Author: Wilco Dijkstra Date: Wed Apr 1 18:58:27 2026 +0000 malloc: Simplify _int_free_chunk Simplify _int_free_chunk() and always lock if needed. Use _int_free_merge_chunk() for cases that assume the arena has been locked instead. Move the errno save/restore to _int_free_maybe_trim(). Reviewed-by: Yury Khrustalev commit c275c424b324ea525a526812ba2b4a56d47bfe61 Author: Yao Zihong Date: Thu Jun 4 19:39:31 2026 -0500 riscv: Add RVV strrchr for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of strrchr for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__strrchr_vector) is added alongside the generic fallback (__strrchr_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling strrchr(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit bbc3867f8d8f70959cebc7a619e84a1701446948 Author: Yao Zihong Date: Thu Jun 4 19:37:35 2026 -0500 riscv: Add RVV strchr for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of strchr for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__strchr_vector) is added alongside the generic fallback (__strchr_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling strchr(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit 512f99e71d57db800a0e2bc0c8f9f0600dea5ed7 Author: Yao Zihong Date: Thu Jun 4 19:34:33 2026 -0500 riscv: Add RVV memchr for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of memchr for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__memchr_vector) is added alongside the generic fallback (__memchr_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling memchr(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit 496ccfe31239c09fb4ef1efbd084905e2dbb3fea Author: Yao Zihong Date: Thu Jun 4 19:25:00 2026 -0500 riscv: Add RVV memccpy for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of memccpy for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__memccpy_vector) is added alongside the generic fallback (__memccpy_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling memccpy(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit 2efc7026287273b4b3a1ce1a7b27791d3d860a5c Author: Yao Zihong Date: Thu Jun 4 18:28:06 2026 -0500 riscv: Add RVV memcmp for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of memcmp for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__memcmp_vector) is added alongside the generic fallback (__memcmp_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling memcmp(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit 93e6135904eec91f6aaf5500175e7593d260dbe7 Author: Wilco Dijkstra Date: Thu Apr 2 14:51:34 2026 +0000 malloc: Reduce maximum arenas The default maximum arenas is 8 times the number of cores in a 64-bit system. Since modern CPUs have many cores and big servers have 256 cores, this results in excessive number of arenas, which wastes memory. Limit the number of arenas to max (8, ncores) which is less extreme. In the future the limit should be lowered further for large systems. Reviewed-by: Adhemerval Zanella  commit 13dc1040af5a6dd3d582a96fe3931a2f98179a52 Author: Adam Yi Date: Mon May 18 11:21:47 2026 +0800 resolv: reset _u._ext.nscount in __res_iclose [BZ #34154] __res_iclose, when called with FREE_ADDR=true, frees and NULLs every statp->_u._ext.nsaddrs[ns] but does not reset statp->_u._ext.nscount. This breaks the invariant relied on by __res_context_send's cache validation loop in resolv/res_send.c:293-312: when _u._ext.nscount is non-zero, every _u._ext.nsaddrs[ns] corresponding to statp->nsaddr_list[ns].sin_family != 0 is expected to be non-NULL. res_init unconditionally calls __res_iclose(&_res, true) before __res_vinit, so any __res_vinit failure (for example, fopen("/etc/resolv.conf") returning EMFILE under file-descriptor exhaustion, or any allocation failure in __resolv_conf_load, __resolv_conf_allocate, or __resolv_conf_attach before update_from_conf runs) leaves _u._ext.nscount non-zero with all _u._ext.nsaddrs[] NULL. The next name lookup walks the validation loop and dereferences NULL in sock_eq. A DNS lookup may fail after a failed res_init, but it should not segfault. Reset _u._ext.nscount = 0 alongside the existing __resolv_conf_detach call. The next __res_context_send call then re-enters its init block (res_send.c:316-335) and repopulates _u._ext.nsaddrs[] from statp->nsaddr_list[], which __res_iclose leaves untouched. This also lets support/resolv_test.c drop its now-redundant manual reset after __res_iclose(&_res, true). Add a regression test that drops RLIMIT_NOFILE so fopen of /etc/resolv.conf fails with EMFILE inside __res_vinit, then verifies the subsequent gethostbyname does not crash. Signed-off-by: Adam Yi Reviewed-by: Adhemerval Zanella commit 20fffa2c3994d1d5829c08dd67edb94cb605e0ef Author: Alejandro Colomar Date: Sat May 30 12:59:42 2026 +0200 sysdeps/ieee754/ldbl-128ibm-compat/test-printf-chk-ldbl-compat.c: Fix typo Signed-off-by: Alejandro Colomar Reviewed-by: Adhemerval Zanella commit b7e256c32cd2efa5c799111e4e2ffe4ab9ec802f Author: Wilco Dijkstra Date: Tue Mar 10 15:47:26 2026 +0000 malloc: Improve documentation of malloc tunables Update default for tcache_count tunable. Remove existing documentation and mention removal of fastbins in mxfast tunable. Improve wording of hugetlb tunable, including default for AArch64. Reviewed-by: Adhemerval Zanella commit 4a7805d05c944ee18dd8d5c07910e7d99b1ddedd Author: Wilco Dijkstra Date: Tue Jun 2 14:07:05 2026 +0000 malloc: Minor cleanups Merge request2size into checked_request2size. Improve interface of clear_memory. Fix incorrect use of __glibc_unlikely in __libc_calloc. Fix missing tabs. Reviewed-by: Yury Khrustalev commit 0b271861516cb0c736ef2097a1a916caca43dbeb Author: Adhemerval Zanella Date: Tue Jun 2 16:34:01 2026 -0300 support: Also run malloc hugetlb=1 tests when transparent hugepage is 'always' The glibc.malloc.hugetlb=1 is redundant with kernel is n 'always' mode, but the madvise does work, and the tunable should not fail. Suggested-by: Yury Khrustalev Reviewed-by: Yury Khrustalev commit e951752cd0b13e8ec7eae6287b232a3babd28799 Author: Adhemerval Zanella Date: Tue Jun 2 15:05:47 2026 -0300 arm: Fix main-in-dso with non-BFD linkers (BZ 34098) Commit c2d6afb4a010 changed the PIC && !SHARED path of start.S (used by crt1.o and rcrt1.o) to load main via a R_ARM_REL32 data relocation. When main is provided by a shared object, BFD ld synthesizes a canonical PLT entry for it, but other linkers (e.g. mold) do not, producing a broken binary that crashes at startup. Follow the aarch64 approach and reference main through a local __wrap_main that tail-calls it with a branch relocation, which every linker turns into a PLT entry. Checked on armv7a-linux-gnueabihf with and without --enable-default-pie. commit 5879990337c1e37d3ded6bf6d03b8af9737a2d86 Author: Adhemerval Zanella Date: Mon Jun 1 10:00:20 2026 -0300 elf: Fix tst-ifunc-tls-init with --disable-default-pie The test failed with --disable-default-pie because its primary check read the resolver's diagnostic side effect before the resolver had run. In a non-PIE executable the references to the IFUNC (fptr and ifunc_tls) are satisfied through a canonical IPLT entry in the executable itself. Under the default lazy binding that IPLT is resolved on first use, not during startup relocation, so the resolver had not yet run when 'check_sentinel' inspected that value. With a PIE executable (or LD_BIND_NOW=1) the resolver runs eagerly at startup and the check passed. The dlopen path was unaffected because dlopen resolves the data relocation eagerly. This is a test ordering issue: the resolver always reads the initial-exec TLS correctly whenever it runs, so the BZ 34164 fix is not involved. Reorder test_tls_ifunc so that fptr/ifunc_tls force the IFUNC to be resolved before the last_seen_sentinel value is inspected. Checked on x86_64-linux-gnu and i686-linux-gnu with --disable-default-pie. Reported-by: Yury Khrustalev Reviewed-by: Yury Khrustalev commit 7193069543b0883b667d7c14d4b83fa3e8b2e1de Author: Sachin Monga Date: Tue Jun 2 00:44:41 2026 -0500 powerpc64le: Add optimized __memcmpeq for POWER10 __memcmpeq (added in glibc 2.35) was previously an alias to memcmp on POWER10 via strong_alias. However, in the multiarch IFUNC path, this caused __memcmpeq to resolve to the generic C memcmp.c implementation rather than the optimized POWER10 memcmp.S, leaving a significant performance gap. Unlike memcmp, __memcmpeq only needs to return zero or nonzero with no requirement on the sign or magnitude for unequal inputs, allowing a simpler and faster implementation. Performance on POWER10 : 1) __memcmpeq (generic) -> __memcmpeq_power10 The primary motivation - __memcmpeq was resolving to generic C in the multiarch path. - Small data (< 8B to < 512B) : ~52% - 82% improvement. - Bulk (< 16MB to < 256MB) : ~25% - 32% improvement. - Large (1GB) : ~33% improvement 2) memcmp_power10 (optimized .S) -> __memcmpeq_power10: Comparing dedicated __memcmpeq against the optimized memcmp it previously aliased to. - Small data (< 8B to < 256B) : No improvement observed. Real-world workloads predominantly operate on larger buffers - >= 512B : ~9% improvement. - 16MB - 128MB : ~25% - 32% improvement. - 256MB : ~3% improvement. - Large (1GB) : On par. Reviewed-by: Wilco Dijkstra commit c5278a64282f1c1f9a88711bac7b4e1469f851d6 Author: Adhemerval Zanella Date: Mon Jun 1 10:47:23 2026 -0300 arm: Redirect memcpy to __memcpy_arm for loader/static init code After "elf: Initialize TCB and stack-protector before static IFUNC resolvers (BZ 20680, BZ 27582, BZ 28817)", early loader and static initialization code may run before the IFUNC resolvers are processed. The armv7-a supports memcpy, so add a dl-symbol-redir-ifunc.h to redirect the memcpy to to __memcpy_arm implementation. Checked on armv7a-linux-gnueabihf. commit 0458560b5d76d633c4ed9fc5ace64fb89cd6092c Author: Yury Khrustalev Date: Mon Jun 1 13:29:53 2026 +0100 misc: Fix typos in comments commit 7d213541cb194e845fc01e00d7d9bb93d87a6f57 Author: Diego Nieto Cid Date: Sun May 31 16:53:42 2026 -0300 hurd: define SO_TIMESTAMP in socket.h * sysdeps/mach/hurd/bits/socket.h: add SO_TIMESTAMP enum entry and define corresponding preprocessor macro. Message-ID: <20260531195342.1633-1-dnietoc@gmail.com> commit 70be9819b5eb7ed0050cffb45113332f96f5a55f Author: Yury Khrustalev Date: Thu May 21 11:51:57 2026 +0100 malloc: aarch64: Remove broken memory tagging Remove the --enable-memory-tagging configure option along with all associated variables and macros. Removing the glibc.mem.tagging tunable. Remove the memory-tagging makefile variable. Remove the USE_MTAG macro definition and code that is conditionally compiled when this macro is defined. As a result, we change 'mtag_mmap_flags' to 'extra_mmap_prot' that is now always defined. Change of the name due to this being used as part of PROT options in mmap syscalls rather than part of flags. Remove 'mtag_enabled' that would become compile-time false. Also remove any code that would never be compiled when 'mtag_enabled' is false. Remove AArch64-specific code pertinent to memory tagging, that is currently broken, from the core malloc implementation. We keep the assembly code, since we are going to need it in the future. to preserve Git history. Reviewed-by: Wilco Dijkstra commit 7052455f0e85673abebad5d5814e73e22287c081 Author: Adhemerval Zanella Date: Thu May 28 17:30:08 2026 -0300 hesiod: use booleans in parser macro calls The swallow argument in the INT_FIELD and STRING_FIELD macros is used as a boolean, change all callers to use false and true instead of 0 and 1. Reviewed-by: H.J. Lu commit 41e9457c53610c6c79a7e036f61de032686e9ef0 Author: Adhemerval Zanella Date: Thu May 28 17:30:07 2026 -0300 hesiod: fix swapped arguments in service parser The port number in the service file is a decimal number followed by a single slash. Reviewed-by: H.J. Lu commit 808035fdffc3506709eaa2cf0d9f190d08a9a936 Author: Adhemerval Zanella Date: Thu May 28 11:35:34 2026 -0300 math: Fix non-narrowing test build with arg-format conditions auto-libm-test-in shares inputs between narrowing and non-narrowing functions, and some carry arg-format conditions (e.g. "arg-ibm128"). When auto-libm-test-out-fma is regenerated, gen-libm-test.py turns these into TEST_COND_arg_ibm128, which expands via ARG_MANT_DIG to ARG_PREFIX. ARG_PREFIX is only defined for TEST_NARROW, so the non-narrowing fma test failed to build with "ARG_PREFIX_MANT_DIG undeclared". Define TEST_COND_arg_ibm128 to 0 when ARG_FLOAT is not defined, mirroring the existing guard for TEST_COND_ibm128_libgcc; in the non-narrowing case there is no separate argument format, so the condition is always false. Regenerate auto-libm-test-out-fma accordingly. commit b9e893b60ef6bfe3f0add02e9125e1aae58f012c Author: Muhammad Kamran Date: Thu May 28 09:29:33 2026 +0000 aarch64: Use build attributes for asm feature marking When the compiler defines __ARM_BUILDATTR64_FV, emit AArch64 feature-and-bits build attributes for BTI, PAC, and GCS from sysdep.h instead of a GNU property note. Keep the GNU property note as the fallback for older toolchains. Mirror the same marking logic in elf/tst-asm-helper.h so custom test DSOs and assembly tests that cannot include sysdep.h get consistent feature marking. Reviewed-by: Adhemerval Zanella commit bec480cbe64e8d9b91c6bcc283cbf757a225609c Author: Martin Coufal Date: Tue May 26 13:15:27 2026 +0200 misc: add a new test for gethostname Add a simple test that runs in a UTS namespace: checks gethostname after various sethostname values (including empty and HOST_NAME_MAX), verifies ENAMETOOLONG when the buffer is too small for a maximal name, EINVAL when sethostname is given a name longer than HOST_NAME_MAX. Reviewed-by: Adhemerval Zanella commit 9ef37798fa7dc2b10926742e3f3bd304a17a9ad1 Author: Frédéric Bérat Date: Tue May 26 13:29:57 2026 +0200 test: Fix and stabilize tst-wcsmbs-clone-overflow test The test tst-wcsmbs-clone-overflow was initially added to tests-static. However, this causes the test to be unstable because gconv modules dynamically load libc.so. Any discrepancy between the statically linked version and the dynamically loaded one can lead to a crash. By removing the test from tests-static, it relies on dynamic linking, safely bypassing the dlopen crash. Since the test is now dynamically linked, it cannot use the internal thread-local symbol _NL_CURRENT_DATA(LC_CTYPE) because _nl_current_LC_CTYPE is hidden in libc.so, leading to undefined references. Thus, the test now uses newlocale and uselocale, safely extracting the locale data from the returned locale_t object. Furthermore, using newlocale requires the gconv-modules configuration to be built and available so that the ISO8859-1.so module can be dynamically loaded. Otherwise, glibc falls back to the built-in C locale conversions, leaving __shlib_handle as NULL and silently bypassing the reference counter increment. A new Makefile fragment, gen-gconv-modules.mk, is introduced to ensure the gconv-modules are built before the test runs, and an explicit check for __shlib_handle != NULL is added to the test. Reviewed-by: Carlos O'Donell commit 1e7935ae87550323021876f3099bb04aeadd8491 Author: Adhemerval Zanella Date: Wed May 27 16:48:19 2026 -0300 math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183) When d (the exponent difference between z and x*y) is exactly 64, the alignment path shifts z left by 64 bits via (zhi = nz.m, zlo = 0) and decrements d to 0, then takes the inner 'if (d < 64)' branch which evaluates 'rhi << (64 - d)' with d == 0. A shift by 64 of a 64-bit value is UB in C. Add the explicit 'if (d == 0)' empty branch (present in the original musl implementation). Checked on x86_64-linux-gnu with --disable-multi-arch and arm-linux-gnueabihf. Reviewed-by: H.J. Lu commit b20b94006c79d65d75e5bd3a8d14fbcf9cd5bee6 Author: Adhemerval Zanella Date: Thu May 21 13:55:41 2026 -0300 support: Skip malloc hugetlb={1,2} variants when kernel cannot honor them The malloc test variants run with GLIBC_TUNABLES=glibc.malloc.hugetlb=1 exercise transparent huge pages via MADV_HUGEPAGE, which is only meaningful when /sys/kernel/mm/transparent_hugepage/enabled is set to 'madvise' ('always' makes the madvise redundant and 'never' makes it ineffective). The hugetlb=2 variants rely on MAP_HUGETLB, which requires a positive /proc/sys/vm/nr_hugepages. On systems that do not satisfy these prerequisites - including any non-Linux target - those runs only consume CPU time in this case. Add support/support_check_hugetlb.{c,h} exposing: - support_thp_is_madvise: true iff THP is in 'madvise' mode; - support_hugepages_reserved: true iff nr_hugepages > 0; - support_check_malloc_hugetlb: inspects GLIBC_TUNABLES and calls FAIL_UNSUPPORTED when the requested hugetlb mode cannot be honored. Gate the check at compile time so only the variant binaries pay for it. Reviewed-by: DJ Delorie commit eceaece54bf178eb2d9115cfcbd6249239b7556c Author: Adhemerval Zanella Date: Tue May 26 20:04:02 2026 -0300 elf: Re-initialise static TLS after .tdata relocation (BZ 34164) The af34b1376a37fa27e1de9d869ed9493fc569bfa6 (BZ 34164) changed the TLS setup from: relocation loop (applies relocations to .tdata in DSO memory) _dl_allocate_tls_init copies relocated .tdata -> main thread TLS to a new order: _dl_allocate_tls_init copies unrelocated .tdata -> main thread TLS relocation loop (relocates .tdata in DSO memory, but the TLS block has stale copies) This broke file-scope thread-local initialised with the address of a function (for instance the cache structs in libmpfr). Fix it by splitting ELF_DYNAMIC_RELOCATE inside _dl_relocate_object_no_relro into the non-IRELATIVE and IRELATIVE sub-passes (similar as done on static-pie startup by b75ad99d45b) and call _dl_init_static_tls between them. By the time the IFUNC pass fires, .tdata is fully relocated. Checked on x86_64-linux-gnu and aarch64-linux-gnu. Reviewed-by: H.J. Lu commit b26cc4fbb74f516fc2b26bdfe7e524392d940250 Author: Wilco Dijkstra Date: Wed May 6 15:28:25 2026 +0000 Arch64: Add support for SVE2 ifuncs Add support for SVE2 in cpu-features. Minor cleanup of init-arch.h. Reviewed-by: Yury Khrustalev commit c289868492ab811ef4d0a3d3efc4772967f4b8b1 Author: Diego Nieto Cid Date: Tue May 26 22:41:03 2026 -0300 hurd: adjtime: on error return -1 and set errno * sysdeps/mach/hurd/adjtime.c: use __hurd_fail to return errors back to the caller. Message-ID: <20260527014103.10791-1-dnietoc@gmail.com> commit 37318986e74376e1cba83740c17a33d964b6f03b Author: Avinal Kumar Date: Sat Jun 28 00:23:10 2025 +0530 sunrpc/Makefile: Split and sort tests This commit splits and sorts the tests in sunrpc/Makefile. Signed-off-by: Avinal Kumar Reviewed-by: Carlos O'Donell commit b507b6d4c6138bfa3d6ff04ff880dc626c1c3605 Author: Samuel Thibault Date: Tue May 26 23:07:12 2026 +0200 Hurd: restore some SIOC ioctls We do not define struct ifreq_short and ifreq_int, but we do define _IOT_ifreq_short and _IOT_ifreq_int, and need these for sysdeps/gnu/ifaddrs.c and sysdeps/mach/hurd/if_index.c commit 707311226345f87ce6a1536a7d7365ce34b236b3 Author: Samuel Thibault Date: Tue May 26 22:35:55 2026 +0200 Hurd: comment ioctls which cannot currently compile We don't currently have struct ifreq_short, ifreq_int and ifaliasreq, so don't let applications even try to compile these. commit ec98b25af5ae4b6dff24388ce10d0e64a7671363 Author: Samuel Thibault Date: Tue May 26 22:28:49 2026 +0200 Hurd: comment PF_ROUTE/AF_ROUTE defines Comment out the PF_ROUTE and AF_ROUTE defines, since they would be used for PF_ROUTE setsockopts, which are not available on Hurd. commit 59a0de89ba28028f5ec3f32c1da648a0d6f1dfc5 Author: Pino Toscano Date: Tue May 26 22:27:02 2026 +0200 Hurd: comment PF_LINK/AF_LINK defines Comment out the PF_LINK and AF_LINK defines, since they are usually associated with struct sockaddr_dl, which is not available on Hurd. commit c1b589b21cfee55ae3702f2967553d66ee257b51 Author: Stefan Liebler Date: Thu May 21 14:07:24 2026 +0200 s390: Enabling lint-makefiles The s390 specific Makefiles were adjusted to match the required format for scripts/lint-makefiles.sh / scripts/sort-makefile-lines.py. Afterwards the lines were sorted by those scripts. And the testcase lint-makefiles is passing. Reviewed-by: Adhemerval Zanella commit f531cab5891cc71442dcced4abe8ecc6ef15e61f Author: Diego Nieto Cid Date: Wed May 20 23:49:27 2026 +0100 hurd: let the root user raise its priority Check for task_max_priority RPC * config.h.in: add #undef for HAVE_MACH_TASK_MAX_PRIORITY. * sysdeps/mach/configure.ac: use mach_RPC_CHECK to check for task_max_priority RPC in mach_host.defs. * sysdeps/mach/configure: regenerate file. Use task_max_priority when setpriority is called by root * sysdeps/mach/hurd/setpriority.c: clamp the prio argument to the range [-NZERO, NZERO-1] and use task_max_priority when called by root. Message-ID: <8e806c83d8d7b59b2894b4944e4ad82477ecc3cd.1779316637.git.dnietoc@gmail.com> commit 156141a8f341c92d3fde8db336dfd8cfd0cd4950 Author: Etienne Brateau Date: Mon May 25 23:11:42 2026 +0200 hurd: add validations in msync POSIX specs specify that invalid flags shall return EINVAL and that ENOMEM shall be returned in case of address outside of address space or when one or more pages are not mapped. Signed-off-by: Etienne Brateau Message-ID: <20260525211142.131508-1-etienne.brateau@gmail.com> commit 58ae7f8f0c1d7e69adbe07ef374ac65706dda0ba Author: Diego Nieto Cid Date: Mon May 25 22:56:42 2026 +0200 hurd: clamp the setpriority prio argument to the range [-NZERO, NZERO-1] The Open Group Base Specifications Issue 8 getpriority ( https://pubs.opengroup.org/onlinepubs/9799919799/ ) << The nice value is in the range [0,2*{NZERO} -1], while the return value for getpriority() and the third parameter for setpriority() are in the range [-{NZERO},{NZERO} -1]. >> So given that NZERO is defined to 20, we shall use it to clamp to the range specified by POSIX. That range is then mapped to something similar to [0, 2*{NZERO}-1], as specified by POSIX, through the usage of the macro NICE_TO_MACH_PRIORITY and MACH_PRIORITY_TO_NICE. (i.e. [5, 45] ) commit 8560164813862088231d1b37aac200cccf9ae64e Author: Adhemerval Zanella Date: Thu May 21 10:26:31 2026 -0300 intl: Fix tst-gettext under inherited LC_* environment The final block of tst-gettext unsets LC_ALL plus LC_MESSAGES, LC_CTYPE, LC_TIME and LC_NUMERIC, sets LANG=existing-locale, and then expects setlocale (LC_ALL, "") to resolve every category through LANG. Any other LC_* category inherited from the invoking shell (e.g. LC_PAPER, LC_MONETARY) still takes precedence over LANG, and if it points to a locale that is not under the test's LOCPATH the setlocale call fails with ENOENT. Checked on x86_64-linux-gnu. Reviewed-by: Carlos O'Donell commit 8eeed69baffbc57c955f3e0ba5ac5514d9fe72ac Author: Adhemerval Zanella Date: Thu May 21 13:30:47 2026 -0300 nptl: Skip tst-pthread-gdb-attach{, -static} on env mismatches The test previously failed with confusing diagnostics in two situations that are properties of the runtime environment rather than of glibc: 1. find_gdb only checked access(X_OK), which is true for directories too. A 'gdb' directory ahead of /usr/bin in PATH (e.g. one holding gdb python helpers) was therefore returned as the gdb executable, and the subsequent execl failed with errno != ENOENT, causing the test to fail with `numeric comparison failure ... status 256'. 2. The in-tree libthread_db.so.1 is built with -z mark-plt and therefore carries a versioned dependency on GLIBC_ABI_DT_X86_64_PLT in libc.so (see BZ #33212). When the system gdb is linked against a libc older than 2.41, that version is not provided and gdb's dlopen of the in-tree libthread_db.so.1 fails. Thread debugging is then disabled, the gdb script's `thread 1' / `thread 2' commands fail, gdb exits non-zero, and the test reports a generic status mismatch. Two changes: * Require S_ISREG in find_gdb so a directory named 'gdb' on PATH is skipped, falling through to the next candidate. * Before running the real gdb scenario, run a minimal probe script that triggers libthread_db loading (set debug libthread-db 1; set libthread-db-search-path; file /proc/self/exe; start). If the probe output contains `dlopen failed', mark the test UNSUPPORTED with a clear message instead of letting the real run fail. Reviewed-by: Carlos O'Donell commit c056561d31a29d82d89b5a374aea3147fd5a2de3 Author: Matt Turner Date: Sat May 23 12:53:05 2026 -0400 alpha: fix setrlimit compat symbol for negative rlim values besides -1 Old alpha glibc defined rlim_t as signed long, making RLIM_INFINITY equal to LONG_MAX (0x7ffffffffffffffful). The compat symbol __old_setrlimit64 (setrlimit@GLIBC_2.0 and setrlimit64@GLIBC_2.1) was introduced in 0d0bc784ca [BZ #22648] to translate this old RLIM_INFINITY to the kernel's RLIM64_INFINITY (ULONG_MAX) before the prlimit64 syscall, using an exact equality check. Because old rlim_t was signed, any value a caller treats as negative (e.g. -2 = 0xfffffffffffffffe unsigned) is also an "infinity or beyond" value in the old ABI. Such values are >= OLD_RLIM64_INFINITY and should be translated to RLIM64_INFINITY; passing them through unchanged causes prlimit64 to treat them as large finite limits, resulting in unexpected failures (EPERM or silent truncation). Change the equality check to >= OLD_RLIM64_INFINITY in __old_setrlimit64 so that all values the old signed-rlim_t ABI would interpret as infinity-or-more are correctly mapped to RLIM64_INFINITY. No change is made to __old_getrlimit64: prlimit64 returns only exact RLIM64_INFINITY for unlimited resources, so the existing equality check against RLIM64_INFINITY is correct and mirrors the kernel's own rlim64_is_infinity() logic. Fixes: 0d0bc784ca ("Alpha: Add wrappers to get/setrlimit64 to fix RLIM64_INFINITY constant [BZ #22648]") Fixes: https://sourceware.org/bugzilla/show_bug.cgi?id=30992 Reviewed-by: Adhemerval Zanella commit b0f985a21eb55ae9ee3200efabd802aa24744477 Author: Matt Turner Date: Sat May 23 16:18:27 2026 -0400 sh: reload r3 after arg evaluation in INTERNAL_SYSCALL [BZ #34167] r3 is caller-saved. When a function call appears in the args list (e.g. INTERNAL_SYSCALL_CALL(tgkill, __getpid(), tid, sig)), SUBSTITUTE_ARGS evaluates __getpid() before r3 is reloaded, leaving r3=20 (__NR_getpid) instead of __NR_tgkill=270. The trapa then dispatches the wrong syscall and the signal is silently dropped. Fix: declare r3 uninitialised, expand SUBSTITUTE_ARGS (all function calls happen here), then assign the syscall number to r3 with no intervening calls before the trapa. Applies to both INTERNAL_SYSCALL and INTERNAL_SYSCALL_NCS. signal/tst-raise is a regression test for this bug: raise() calls tgkill(__getpid(), tid, sig), which triggers the clobber. Reviewed-by: Adhemerval Zanella commit b75ad99d45b7475eca46353e68f4009f3837c751 Author: Adhemerval Zanella Date: Fri May 22 14:08:13 2026 -0300 elf: Initialize TCB and stack-protector before static IFUNC resolvers (BZ 20680, BZ 27582, BZ 28817) In static linking the IFUNC IPLT (apply_irel for non-PIE, the IRELATIVE phase inside _dl_relocate_static_pie for static-pie) ran before __libc_setup_tls and before _dl_setup_stack_chk_guard. When a resolver is compiled with -fstack-protector(-all) its prologue loads the canary from the TCB (TCB-canary ABIs: x86_64, i386, powerpc, s390) or from __stack_chk_guard (global-var ABIs). On the former the resolver crashed reading an unmapped TCB; on the latter it loaded a zero canary (no crash, but the check is ineffective). The same applies to a resolver that reads any thread-local: it crashes on TCB-canary ABIs and observes a zero-filled slot on the others (BZ 20680). The pointer guard has the same problem (e.g. resolvers that register an atexit handler). Reorder csu/libc-start.c so that ARCH_SETUP_TLS, the stack-protector canary and the pointer guard are set up before any IFUNC resolver runs. For static-pie this requires splitting the existing _dl_relocate_static_pie into two phases so the TCB/canary setup can be interleaved between the non-IRELATIVE and IRELATIVE passes. The historical ARCH_SETUP_IREL / ARCH_APPLY_IREL split (introduced for powerpc so its IFUNC resolvers could read TCB fields like hwcap and at_platform) is no longer required: TLS is now set up before either macro runs. ARCH_APPLY_IREL is removed, ARCH_SETUP_IREL does the work uniformly on every arch, and the powerpc-specific libc-start.h becomes redundant. __libc_setup_tls reaches memcpy / mempcpy via _dl_allocate_tls_init in elf/dl-tls.c, so it requires update ABI specific dl-symbol-redir-ifunc.h with memcpy/memmove. Tests added (each fails pre-fix on TCB-canary ABIs with SIGSEGV; the static-protector variants additionally fail on global-var ABIs with a "resolver_canary != main_canary" diagnostic): elf/tst-ifunc-bz28817 static-pie + TLS in resolver (BZ 28817) elf/tst-ifunc-resolver-protector dynamic elf/tst-ifunc-resolver-protector-static static-pie elf/tst-ifunc-resolver-protector-static-non-pie non-PIE static Checked on aarch64-linux-gnu, arm-linux-gnueabihf, x86_64-linux-gnu, and i686-linux-gnu I also ran the ELF tests on qemu system for loongarch64-linux-gnuf64, powerpc-linux-gnu, powerpc-linux-gnu-power4, powerpc-linux-gnu-soft, powerpc64-linux-gnu, powerpc64le-linux-gnu, riscv64-linux-gnu, and s390x-linux-gnu. Reviewed-by: H.J. Lu commit af34b1376a37fa27e1de9d869ed9493fc569bfa6 Author: Adhemerval Zanella Date: Fri May 22 14:08:12 2026 -0300 elf: Initialize static TLS before relocation processing (BZ 34164) An IFUNC resolver firing during dynamic linker relocation reads its DSO's __thread storage from a zero-filled slot: init_tls() allocates the static TLS block zero-filled, but .tdata is not copied in until the trailing _dl_allocate_tls_init at the end of dl_main, long after the per-object phase 2 resolvers from commit 63b31c05a8a901 have run. A resolver that *writes* TLS is even worse off -- the write is clobbered by that same trailing copy. dl_main (elf/rtld.c): populate the DTV slotinfo, bump dl_tls_generation, and call _dl_allocate_tls_init right after init_tls(), before the relocation loop. _dl_try_allocate_static_tls (elf/dl-reloc.c): drop the "defer-if-not-relocated" branch and always run _dl_init_static_tls inline, so a CHECK_STATIC_TLS allocation triggered mid-relocation initialises the slot before the same object's phase 2 fires. The new tests cheks some scenarios: elf/tst-ifunc-tls-init resolver reads its DSO's IE TLS. elf/tst-ifunc-tls-init-dlopen same, via dlopen. elf/tst-ifunc-tls-write resolver write to TLS must survive to main. Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu. Reviewed-by: H.J. Lu commit e563a57105ffe72e9f8dda13411bf0463812f7e5 Author: Adhemerval Zanella Date: Fri May 22 10:00:05 2026 -0300 x86: Revert "x86: Lower non-temporal copy threshold for Hygon" This version was superseeded by 213ffdfbbae6d4cb4e8dd4a9e3e57c69127620c4. commit 746a560a6296820c6df6eaf2fcc61008ece4b2bb Author: Wilco Dijkstra Date: Fri May 8 11:06:23 2026 +0000 string: Improve test-memchr page cross checks The tests for memchr attempt to check for accidental overreads that cross a page. However they weren't done at the end of a page and don't check for the case where we match right at the end. Add buf1_size/buf2_size to make finding end of buffer easier. Reviewed-by: Yury Khrustalev commit a7b6e534629c821e456955a00cf68bf889a601a8 Author: Thomas Daubney Date: Mon May 18 16:20:53 2026 +0000 Vectorise special cases for SVE log1p(f) This patch adds vectorised special cases for the SVE log functions log1p and log1pf. When built with GCC-15 and executed on a Neoverse V2 platform, the following benchmarking throughput uplifts were measured: log1pf -> 285% speed-up (4.85 ns/element to 1.26 ns/element) log1p -> 117% speed-up (8.25 ns/element to 3.80 ns/element) Note that the numbers here are for the special case path only and that the fast path performance has been maintained. These changes have also maintained the same level of accuracy as before. commit 8ed4c7091529fdc450846c7b726f286fa723eb8d Author: Rocket Ma Date: Wed May 20 20:22:38 2026 -0700 stdio-common: Optimize scanf %ms series array expansion * stdio-common/vfscanf-internal.c: If user explicitly set the maximum size of the string, respect it when reading characters. Instead of always expanding exponentially, try to expand array to the exact size user requested when `user_size < current_size * 2`. Signed-off-by: Rocket Ma Reviewed-by: Adhemerval Zanella commit f7eea1b2585b7b8c1f3ee9646627a9cf03fc33f2 Author: Thomas Daubney Date: Fri May 8 15:58:11 2026 +0000 Vectorise special cases for SVE inverse hyperbolics This patch adds vectorised special cases for the SVE inverse hyperbolic functions atanh, acosh and asinh for single precision floats. It also moves the commonly used inf and nan bit values into the sv_log1pf_inline data struct for resuse. When built with GCC-15 and executed on a Neoverse V2 platform, the following benchmarking throughput uplifts were measured: atanh -> 215% speed-up (5.51 ns/element to 1.75 ns/element) acosh -> 152% speed-up (4.63 ns/element to 1.84 ns/element) asinh -> 51% speed-up (5.00 ns/element to 3.31 ns/element) Note that the numbers here are for the special case path only and that the fast path performance has been maintained. Reviewed-by: Adhemerval Zanella commit 54abc8566fea592e795cb443949266ef206462a8 Author: zombie12138 Date: Tue May 5 22:38:01 2026 -0700 x86: Fix non-temporal memset unreachable on AMD Zen 3/4/5 On AMD Zen 3/4/5 with ERMS, the non-temporal memset path is unreachable because rep_stosb_threshold is set to SIZE_MAX (vectorized loop is faster than ERMS on these CPUs), but the non-temporal code path is nested inside the rep_stosb branch. The existing rescue logic at the Avoid_STOSB check only covers the case where the CPU lacks ERMS hardware support. It does not cover AMD Zen 3+ where ERMS is supported but deliberately unused for performance reasons. Extend the condition to also lower rep_stosb_threshold when: - The user has not explicitly set x86_rep_stosb_threshold (respect tunables) - rep_stosb_threshold is higher than memset_non_temporal_threshold (NT gated) This makes the non-temporal path reachable for large memset operations, providing ~2x speedup on pre-faulted buffers larger than L3 cache. Tested on AMD Ryzen 7 8745HS (Zen 4): - Pre-faulted 64MB memset: 2.02 ms -> 0.94 ms (2.15x faster) - First-touch 64MB memset: 19.3 ms -> 21.3 ms (11% regression, expected: kernel clear_page cache warming bypassed by NT stores) * sysdeps/x86/dl-cacheinfo.h (dl_init_cacheinfo): Extend rep_stosb_threshold lowering condition to cover AMD Zen 3/4/5 where ERMS is supported but stosb is disabled via threshold. Signed-off-by: zombie12138 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34129 Reviewed-by: Adhemerval Zanella commit 97bd3b3d56ed867e7a545ce3501991a92df0d1bb Author: Xiang Gao Date: Fri May 8 14:04:10 2026 +0800 libio: Ignore doallocate for open_memstream and open_wmemstream [BZ #34019] setvbuf (stream, NULL, _IOFBF, 0) takes a special path in _IO_setvbuf: if the byte-oriented buffer base is NULL, it calls _IO_DOALLOCATE and returns without invoking the stream setbuf hook. For open_wmemstream, the byte-oriented buffer base is NULL although the wide result buffer has already been initialized in _wide_data. As a result, this path calls _IO_wdefault_doallocate, which may replace the wide buffer managed by open_wmemstream. Install an open_wmemstream-specific doallocate hook that leaves the growable result buffer unchanged. Add a regression test for this path. Install a narrow memstream doallocate hook as well. It keeps both memstream vtables consistent (generic stdio allocation must not replace the growable result buffer). Signed-off-by: Xiang Gao Reviewed-by: Adhemerval Zanella commit b1ab27286e0ae80820dd9a24ceac6eaae0a911a2 Author: Xiang Gao Date: Fri May 8 14:04:09 2026 +0800 libio: Ignore setbuf for open_memstream and open_wmemstream [BZ #34019] open_memstream and open_wmemstream manage an internal growable buffer. The default setbuf hook can reset that buffer, breaking the assumptions used by the string stream overflow paths. Install setbuf hooks that leave the internal buffer unchanged, and add regression test cases for the narrow and wide cases, based on the reproducer in BZ #34019. Checked on x86_64 with no regression in the libio tests. Reported-by: Rocket Ma Signed-off-by: Xiang Gao Reviewed-by: Adhemerval Zanella commit 213ffdfbbae6d4cb4e8dd4a9e3e57c69127620c4 Author: xiejiamei Date: Sat May 9 07:56:28 2026 +0000 x86: Lower non-temporal copy threshold for Hygon Benchmarks on Hygon processors show that the default non-temporal threshold is higher than ideal for large copy workloads. As a result, memcpy and memmove may continue to use the temporal copy path for longer than is beneficial, increasing cache pollution and reducing throughput for large copies. Lower the copy non-temporal threshold to 3/8 of the shared cache size per thread on Hygon. This allows the non-temporal copy path to be selected earlier while leaving the memset non-temporal threshold unchanged. Signed-off-by: xiejiamei Reviewed-by: H.J. Lu commit 994a4378785e3c2187d1b44e5e98d97eb2369882 Author: Daan De Meyer Date: Mon May 18 07:39:33 2026 +0000 elf: Don't crash in dlsym when tail-called from a constructor [BZ #34156] If a shared library's constructor calls dlsym and discards the result, the compiler is free to lower the call to a tail jump. The dynamic linker then resolves the apparent caller to ld.so's own link map, which has no l_scope, and crashes in _dl_lookup_symbol_x dereferencing the NULL scope pointer. Tail-call optimization is a legal C transformation and there is no way for the dynamic linker to recover the real caller from the elided frame. Detect the situation by its observable effect -- a link map with no l_scope -- and fall back to the main program's link map, the same treatment used when the caller's address is otherwise unrecognized. The check is written against l->l_scope rather than against _dl_rtld_map directly because dl-sym-post.h is also compiled into libc.so, where _dl_rtld_map is not visible (it lives only in ld.so). Add dlfcn/tst-dlsym-ctor exercising the pattern. Without the fix the test SIGSEGVs during dlopen; with the fix dlopen returns cleanly. Signed-off-by: Daan De Meyer Reviewed-by: Adhemerval Zanella commit 566135bb77a6dc2748bd0bf5dc3cfb348df748ff Author: Avinal Kumar Date: Mon May 18 15:48:00 2026 +0530 SHARED-FILES: Update gettext sync record Update the gettext section to reflect the 2026 sync with GNU gettext 1.0 (through commit 2ebbdd0e2). Add intl/eval-plural.h which was missing from the shared files list. Signed-off-by: Avinal Kumar Reviewed-by: Adhemerval Zanella commit 8aa4a704314e6039bf1efbc1d8d57bb095956862 Author: Avinal Kumar Date: Mon May 18 15:44:52 2026 +0530 intl: Fix undefined pointer behaviour In _nl_find_msg (dcigettext.c), outbuf was computed as freemem + sizeof(size_t) before checking whether freemem_size is large enough. When freemem is NULL (initial state), this is undefined behaviour i.e arithmetic on a null pointer. Move the outbuf assignment after the size check where freemem is guaranteed to be a valid allocation. In read_alias_file (localealias.c), after realloc the old string_space pointer is dangling. The expression new_pool - string_space subtracts a valid pointer from a dangling one, which is undefined behaviour per ISO C 23. Rewrite as new_pool + (map[i].alias - string_space) so both operands of the subtraction point into the same (old) object before string_space is reassigned. Based on GNU gettext commits 695429040 and 2ebbdd0e2. Original author: Bruno Haible Signed-off-by: Avinal Kumar Reviewed-by: Adhemerval Zanella commit 209ad6ff9da8ffaac891c610b31a5b8dabe97e36 Author: Adhemerval Zanella Date: Wed May 20 08:47:25 2026 -0300 Fix hurd bootstrap after 4c6f92daead Hurd bootstrap with build-many-glibc.py fails for i686-gnu since 4c6f92daead7aa989ae1b7c67760f81a3550f044: In file included from zic.c:16: private.h:849:1: error: static declaration of ‘mempcpy’ follows non-static declaration 849 | mempcpy(void *restrict s1, void const *restrict s2, size_t n) | ^~~~~~~ In file included from ../include/string.h:60, from private.h:222: ../string/string.h:432:14: note: previous declaration of ‘mempcpy’ with type [...] 432 | extern void *mempcpy (void *__restrict __dest, | ^~~~~~~ The libc-symbols.h already defined some HAVE_*, but timezone files are built with -D_ISOMAC. Remove its usage and only define _ and N_ macros if not already defined. Checked on x86_64-linux-gnu and with a build-many-glibcs.py build for i686-gnu. Reviewed-by: H.J. Lu Reviewed-by: Paul Eggert commit 999fa30b3616beed08da30ab25971860ab9116ea Author: Adhemerval Zanella Date: Tue May 19 10:23:56 2026 -0300 elf: Use dl_scratch_buffer for LD_LIBRARY_PATH copy in _dl_init_paths _dl_init_paths used strdupa to make a mutable copy of LD_LIBRARY_PATH for fillin_rpath to tokenize. The env block is attacker-controllable and Linux allows individual variables up to MAX_ARG_STRLEN (32 * PAGE_SIZE = 128 KB), so the strdupa can push tens of KB onto the loader's startup stack on top of the env block that already sits on the initial stack. With a reduced RLIMIT_STACK the doubled copy overflows before main () is reached. Replace the strdupa with a dl_scratch_buffer: short paths stay in the 256-byte inline area, longer ones spill to anonymous mmap (malloc is not yet available during _dl_init_paths). Two follow-on changes make the new scratch lifetime safe against _dl_signal_error: * Count entries directly off the const LD_LIBRARY_PATH and allocate __rtld_env_path_list.dirs *before* the scratch is live. That way the larger of the two heap allocations the loader controls signals its OOM with no scratch to leak. * Convert fillin_rpath to return bool instead of calling _dl_signal_error internally on per-entry malloc failure. Its only caller in the LLP path now frees the scratch first and then signals the error from a clean state. decompose_rpath, the other caller, is updated symmetrically. This also fixes a pre-existing leak in fillin_rpath's OOM path, where the to_free heap copy from expand_dynamic_string_token was not released before the _dl_signal_error. Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu. Reviewed-by: H.J. Lu commit 3215ea5c45f0192af27a8fa5ffbc9b417f8cc72b Author: Adhemerval Zanella Date: Tue May 19 10:23:55 2026 -0300 elf: Use dl_scratch_buffer for DST expansion in _dl_map_object_deps The expand_dst macro in _dl_map_object_deps performs an unbounded alloca via DL_DST_REQUIRED, which scales with the link map's l_origin length plus the count of dynamic-string tokens in the input string. When a DT_NEEDED entry carries several DSTs and the link map sits in a deep directory, the resulting allocation grows to several kilobytes -- enough to overflow a PTHREAD_STACK_MIN thread that calls dlopen. Convert the macro to a static function that draws from a caller- owned dl_scratch_buffer, so oversized expansions land on the heap (or anonymous mmap during early startup) instead of the stack. The scratch buffer is reused across DT_NEEDED, DT_AUXILIARY, and DT_FILTER entries of the same map and freed once dependency expansion completes. A new regression test, tst-dst-needed-minstack, builds a wrapper library that inherits a five-DST SONAME from a leaf module, deploys it under a deep temporary directory, and dlopens it from a PTHREAD_STACK_MIN thread. Without the fix the dlopen overflows the thread stack and crashes; with the fix the dlopen returns cleanly (with or without a successful load). Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu. Reviewed-by: H.J. Lu commit 3e3b621910d4d7981ed4a88d8f0c8a4ecf26becc Author: Adhemerval Zanella Date: Tue May 19 10:23:54 2026 -0300 elf: Replace alloca with dl_scratch_buffer in _dl_load_cache_lookup The alloca added by commit ccdb048d ("Fix recursive dlopen") to snapshot the matched cache entry before __strdup runs through interposable malloc is sized by best_len, which can reach PATH_MAX. On PTHREAD_STACK_MIN threads that's enough to overflow the stack mid-dlopen. Use dl_scratch_buffer with DL_SCRATCH_NO_MALLOC: short entries stay in the 256-byte inline area, longer ones spill to anonymous mmap rather than to interposable malloc. The recursive-dlopen invariant is preserved. New container test elf/tst-dl-cache-long-path constructs a ~3.4 KB deep directory, populates ld.so.cache with that entry, and dlopens from a PTHREAD_STACK_MIN thread under deliberate stack pressure; reliably SIGSEGVs against the alloca-based code and passes with the fix. Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu. Reviewed-by: H.J. Lu commit 26ed1cb8ca8aa676f3eea6d617ddab0275f4da5d Author: Adhemerval Zanella Date: Tue May 19 10:23:53 2026 -0300 elf: Replace alloca/VLA with dl_scratch_buffer in dl-load.c is_trusted_path_normalize, print_search_path, and open_path used alloca or a VLA to hold a path scratch buffer sized by user-controlled inputs (an RPATH directory length, or max_dirnamelen + max_capstrlen + namelen). On the worst case that consumes up to PATH_MAX bytes of stack per call, which can overflow a PTHREAD_STACK_MIN-sized stack mid-dlopen when combined with the loader's other on-stack scratch (struct filebuf, etc.). Replace those allocations with dl_scratch_buffer. As a small cleanup, print_search_path now takes the scratch buffer from its caller (open_path's buffer is already large enough -- max_dirnamelen + max_capstrlen + namelen with namelen >= 1 covers the max_dirnamelen + max_capstrlen + 1 print_search_path requires), so LD_DEBUG=libs no longer pays for an extra allocation per open_path invocation. A new test elf/tst-dl-path-buf exercises the relevant paths -- dlopen via DT_RPATH, open_path failure cleanup, dlopen with an over-long name, dlopen from a PTHREAD_STACK_MIN thread. Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu. Reviewed-by: H.J. Lu commit f86b51dd6afa868fe75e114c7c004d708d096a7a Author: Adhemerval Zanella Date: Tue May 19 10:23:52 2026 -0300 support: Add use_stack_min option to support_small_thread_stack_size It allows it to return PTHREAD_STACK_MIN if defined. Checked on x86_64-linux-gnu and with a build for i686-gnu. Suggested-by: H.J. Lu Reviewed-by: H.J. Lu commit 4e3489bd2ae1dad3ba751a2f685723b1dd60fdd4 Author: Adhemerval Zanella Date: Tue May 19 10:23:51 2026 -0300 elf: Add dl_scratch_buffer, a loader-side scratch buffer Several loader code paths need a short-lived scratch buffer sized by attacker-influenced inputs (RPATH entries, ld.so.cache strings, etc.). The available primitives are all unsuitable: - alloca is unbounded and can overflow PTHREAD_STACK_MIN stacks. - is unaware of __minimal_malloc: a malloc'd spill freed during early loader startup silently leaks because __minimal_free only releases the most-recent allocation. - A few paths cannot route through the interposable malloc at all -- ld.so.cache lookup in particular, because an interposed user malloc may recursively call dlopen and __munmap the cache mapping mid-copy (commit ccdb048d, "Fix recursive dlopen"). Add a loader-side analogue of : a 256-byte inline area for the common case, with spill to malloc by default or to anonymous mmap when __minimal_malloc is active or the caller passes DL_SCRATCH_NO_MALLOC. Mmap spills are tagged " glibc: loader scratch" via __set_vma_name for /proc/self/maps visibility. On OOM dl_scratch_buffer_allocate raises a loader error via _dl_signal_error and does not return. The one-shot contract (no second allocate without an intervening free) is enforced by an assertion in _dl_scratch_buffer_allocate. No functional change in this commit; consumers are added separately. Reviewed-by: H.J. Lu commit 1233e256f231ed3b2c421fa87b8f8b4ab3f77075 Author: Yury Khrustalev Date: Tue May 19 14:37:13 2026 +0100 malloc: Small fix for code readability A couple of small fixes for code readability, no functional change. - Add missing comments for #endif statements. - Move inclusion of string.h from malloc.c to calloc-clear-memory.h where it is actually used. - Re-order alias definitions for malloc functions. Reviewed-by: Adhemerval Zanella commit aadbf5a10acb8c3ebfebe2e245f46e7f44797aa3 Author: Stefan Liebler Date: Mon May 11 15:22:11 2026 +0200 s390: Adjust configure check for static-pie support. With the previous approach, the configure check fails for lld in version >=19. While binutils and lld 18 is placing the R_390_IRELATIVE relocation in .rela.plt and emits DT_JMPREL pointing to it, newer lld versions puts the R_390_IRELATIVE relocation in .rela.dyn and therefore there is also no DT_JMPREL entry and the configure check claims that lld does not support static-pie. The R_390_IRELATIVE relocation is also processed fine in .rela.dyn, thus the configure check is adjusted. Now the configure checks that it exists a R_390_IRELATIVE relocation at all. If the R_390_IRELATIVE relocation lands in .rela.plt, it ensures that there is DT_JMPREL pointing to it. Otherwise there should be a .rela.dyn section. commit aa56ccb98b701680ad48431fea2a1966bac7fa31 Author: Andreas Schwab Date: Tue May 19 11:45:41 2026 +0200 nss_files: use booleans in parser macro calls The swallow argument in the INT_FIELD and STRING_FIELD macros is used as a boolean, change all callers to use false and true instead of 0 and 1. commit 66efdda2f8bce2680f5984a6bd5e488a9b528ead Author: Andreas Schwab Date: Tue May 19 11:39:15 2026 +0200 nss_files: fix swapped arguments in service parser The port number in the service file is a decimal number followed by a single slash. commit dee4e2446f09ab2f2d125f5021b93e22c50fa6e5 Author: Paul Eggert Date: Mon May 18 14:43:09 2026 -0700 Regenerate 'configure' * configure: Regenerate from configure.ac, which was updated in the recent commit 'Simplify tzdb-related configuration'. commit 3237d63b8462764e282cd8de79a02558071d4348 Author: Weihong Ye Date: Mon May 18 16:25:46 2026 +0000 AArch64: Optimize memcmp for Kunpeng 950 with SVE Key optimizations: - Use SVE predication for branch-free handling of short inputs and tails - Use 4-way loop unrolling to maximize pipeline utilization - Optimize mismatch detection with early exit logic Benchmark (bench-memcmp, generic -> this patch): - Small (0-128B): 15% - 50% speedup - Medium (129-1024B): 21% - 50% speedup - Large (2048-4096B): 28% - 50% speedup Note: regressions may be observed in edge cases where offsets are near 4K boundaries. These instances are rare and the overall performance gain remains significantly positive. Also add IFUNC support for memcmp and correct the first-line comment in memcpy_kunpeng950.S. commit d420b69b8134c55fe46a755d370bd007df725e03 Author: Paul Eggert Date: Wed May 13 11:08:35 2026 -0700 Simplify tzdb-related configuration tzdb 2026b no longer needs -Wno-discarded-qualifiers or -Wno-unused-variable. From a suggestion by Joseph Myers in: https://sourceware.org/pipermail/libc-alpha/2026-May/177312.html * configure.ac (config-cflags-wno-discarded-qualifiers): Remove. * timezone/Makefile (CFLAGS-zic.c): Remove -Wno-unused-variable, $(config-cflags-wno-discarded-qualifiers). Reviewed-by: Adhemerval Zanella commit 4c6f92daead7aa989ae1b7c67760f81a3550f044 Author: Paul Eggert Date: Wed May 13 11:08:34 2026 -0700 timezone: sync to tzdb 2026b Sync tzselect, zdump, zic to tzdb 2026b. This fixes some buffer and integer overflows in zic, adds new zic options -D, -m and -u inspired by FreeBSD, and raises zic’s maximum number of abbreviation bytes per timezone from 50 to 256. This patch incorporates the following tzdb source code changes: f9d30685 Output a minimal time zone designation table 37a4d178 Fix zic overflow bug with too-large offsets 4392f2dc zic now checks for signals more often 99a08a66 Fix zic buffer overflow when computing TZ d63b9287 zic: keep needed last transition to new type d005045d Pacify clang -Wunterminated-string-initialization e67b08d3 Port to C23 strchr macro 3d4b4e46 Add zic.c overflow commentary d9101b88 zic now a bit safer for overflows near 2**63 b23fa8e0 zic now allows more than 50 leap seconds 4ff518d2 Increase TZ_MAX_CHARS from 50 to 256 75d3b73b New -DTZ_RUNTIME_LEAPS=0 build-time option 87343c6e TZ_MAX_TIMES must be at least 310 now fc8f1b68 Simplify int_fast32_t definition on C89 platforms 24581465 Remove TZDEFRULES ("posixrules") from localtime.c fc708427 zic now warns about -p b09a3f23 Port TWOS_COMPLEMENT to signed-magnitude hosts 56b7a24a Make sure 2**31 - 1 is signed 9068ab78 zic no longer generates utoff == -2**31 cb6f9b3b Omit unnecessary L suffixes c37fbc32 Clarify when ‘__attribute__((pure))’ is a hack 859690a7 Fix some unsequenced/reproducible commentary 9c772ca7 Port to POSIX.1-2001 fflush 10f93018 Omit no-op transitions when Rule+Zone cancel a0b09b52 Fix unlikely backslash bug in scripts 2cbd3a71 Allow builder to override GRANDPARENTED c7257626 not used at → used outside faed4bd3 Clarify vs getauxval df08e6a1 Port mode_t (and gid_t, uid_t) to MS-Windows 6127d375 New zic option -u, inspired by FreeBSD 813c9ee0 New zic option -m, inspired by FreeBSD 987ea89c New zic option -D, inspired by FreeBSD cc377b07 Simplify mkdir situation cd994a90 Simplify !HAVE_POSIX_DECLS situation 052ddf76 Minor gettext macro improvements d9018f1c Refactor duplicate duplicate-option code 8d65db97 Prefer fdopen to umask in zic d7edca6e Omit “'”s from zic usage message a09ba7a5 getopt returns -1 (not EOF) on failure e22d410c zic now uses is_digit f57cadda Always invoke umask at start 242a8338 Fix mode_t issues on MS-Windows 2fecd606 MKDIR_UMASK → MKDIR_PERMS refactoring 90ef088a Move static_assert to top level 41576478 Port better to platforms lacking mempcpy 90a08d3e * private.h: Include stddef.h early enough aa8b35fe Simplify port to NetBSD struct __state cd2fddf7 Port to -DHAVE_SYS_STAT_H=0 -DHAVE_POSIX_DECLS=0 8470e759 Pacify GCC 15 -Wunterminated-string-initialization 8817d42f Prefer mempcpy to doing it by hand 87abb113 Tighten security checks on TZ values c87f0918 Use strnlen 07f7f31a Fix preprocessor indenting 3adf4123 Add offtime_r à la FreeBSD and NetBSD b807a31e Don’t depend on ‘true’ for tzselect ddffc800 * zic.c: Fix misspelled comment (thanks to Jonathan Wakely). 7063d08c Fix bug with -d RELATIVE -t ABSOLUTE e8920e76 Rename emalloc to xmalloc. e8e1a3d2 NetBSD defines STD_INSPIRED functions 3411494c Define _CRT_DECLARE_NONSTDC_NAMES for MS-Windows 7c909166 Define NOMINMAX for MS-Windows 24a4d97f 'zdump -' now reads from stdin e6d6bc3e Pacify gcc -Wsuggest-attribute=format sans snprintf in zdump 99557862 TZNAME_MAXIMUM defaults to 254, not 255 fe5be99d Be more consistent about macro true/false vs 1/0 31f483a1 Remove dependency of asctime on strftime 7ef7ed06 Simplify timeoff redefinition 1bd67a4b Move MKTIME_MIGHT_OVERFLOW definition 67f7e8ab Pacify GCC 15ish -Wzero-as-null-pointer-constant 535a4e8b Pacify GCC 15ish -Wleading-whitespace=blanks 0706ef0b Move iinntt definition ea814e99 strftime %s no longer is limited to time_t range 41e5344e Fix bug near the year 2**31 - 1 - 1900 4e1de249 Pacify gcc -Wsuggest-attribute=const ebd2ed92 Don’t define _FILE_OFFSET_BITS if _TIME_BITS 26a649a1 Improve zdump overflow checking 9c8221d7 * private.h: Fix timeoff comment. 9db906a0 Switch from RFC 8536 to 9636 for documentation af54a9e8 Port better to glibc when used internally there Checked on x86_64-linux-gnu. Reviewed-by: Adhemerval Zanella commit 08e963f675d017ae8d64bd7191bcb2183201211c Author: xiejiamei Date: Sat May 9 14:23:09 2026 +0800 x86: Lower non-temporal copy threshold for Hygon Benchmarks on Hygon processors show that the default non-temporal threshold is higher than ideal for large copy workloads. As a result, memcpy and memmove may continue to use the temporal copy path for longer than is beneficial, increasing cache pollution and reducing throughput for large copies. Lower the copy non-temporal threshold to 3/8 of the shared cache size per thread on Hygon. This allows the non-temporal copy path to be selected earlier while leaving the memset non-temporal threshold unchanged. Signed-off-by: xiejiamei commit 64efa1451b5239d955141259cacd56a58899be3e Author: Rocket Ma Date: Wed May 13 09:12:42 2026 -0700 libio: Fix fmemopen_write on appending mode (BZ 34006) * libio/fmemopen.c: Reference pos the variable instead of c->pos. On the edge case, one byte should be written at the end of buffer, instead of returning error. Signed-off-by: Rocket Ma Reviewed-by: Adhemerval Zanella commit 63b31c05a8a901562ba9228d254156e436682c1b Author: Adhemerval Zanella Date: Thu May 14 11:27:08 2026 -0300 elf: Defer all IRELATIVE relocations until after PLT setup When a shared library is built with -z lazy and its IFUNC resolver calls a PLT function, the dynamic linker can crash. The resolver runs while the PLT stubs still hold their raw ELF virtual addresses — l_addr has not yet been added — so the call branches to an unmapped address. The old code deferred IRELATIVE entries only to the end of the relocation range currently being processed (via the r2/end2 scan-ahead mechanism in elf_dynamic_do_Rel). This was sufficient only when both IRELATIVE and the JMP_SLOT entries for the PLT functions it needs are in the same section. On x86-64, aarch64, arm, i386 and most other targets, a file-scope initialiser of the form int (*fptr)(void) = some_ifunc; causes the linker to place R_*_IRELATIVE in .rela.dyn, while JMP_SLOT entries for any PLT calls made by the resolver live in .rela.plt. Processing .rela.dyn before .rela.plt means the resolver fires before the PLT is usable, regardless of where within .rela.dyn IRELATIVE appears. Fix this by splitting IRELATIVE processing into a separate, explicitly deferred pass. In elf/do-rel.h: - Remove the r2/end2 variables and the post-loop IRELATIVE re-scan from elf_dynamic_do_Rel. IRELATIVE entries are now always skipped in the non-bootstrap path. - Add a new elf_dynamic_do_Rel_irelative function that scans a relocation range and calls elf_machine_rel/elf_machine_lazy_rel for IRELATIVE and ifunc relocations. In elf/dynamic-link.h, update _ELF_DYNAMIC_DO_RELOC to use a two-phase approach for non-bootstrap builds unconditionally (regardless of whether ranges[1].size is zero): Phase 1+2: elf_dynamic_do_Rel over .rela.dyn then .rela.plt — processes everything except IRELATIVE/STT_GNU_IFUNC. Phase 3+4: elf_dynamic_do_Rel_irelative over .rela.dyn then .rela.plt — processes only IRELATIVE, by which point all PLT stubs are valid. This guarantees that IRELATIVE resolvers can call PLT stubs safely regardless of which section the linker placed R_*_IRELATIVE in. Add ELF_MACHINE_IRELATIVE to the architectures that were missing it so the new skip logic in elf_dynamic_do_Rel is compiled for all targets. This patch addresses the binutils BZ 13302 [1] from the glibc side, and also fixes the mold-reported issue [2], which shows that IFUNC relocation placement and processing can work differently across ABIs. I checked on all ABIs that support IFUNC (x86_64, i686, aarch64, arm, loongarch, powerpc, riscv, s390, and sparc), some via qemu-system. [1] https://sourceware.org/bugzilla/show_bug.cgi?id=13302 [2] https://github.com/rui314/mold/issues/1550 Reviewed-by: H.J. Lu commit 17a79a51208c5648fe70983085833bf15d83d0f1 Author: Wilco Dijkstra Date: Thu Apr 2 13:56:10 2026 +0000 malloc: Remove dynamic mmap/trim threshold [BZ #30769] v2: Update documentation Whenever a large mmap is released the mmap and trim thresholds are updated. As a result these thresholds grow ever larger which means huge allocations are always served by arenas rather than mmap. The thresholds can end up as large as an arena, which completely stops all trimming of the top block. Remove the code completely - the default thresholds seem way too low for modern 64-bit targets, but they can be increased seperately. Reviewed-by: Adhemerval Zanella commit bb91c88af78e9f862728623b60fb68d3610a4b79 Author: Avinal Kumar Date: Tue May 5 16:58:25 2026 +0530 intl: Fix memory leak in _nl_find_domain on allocation failure When _nl_explode_name() returns -1 (out of memory) and the locale was resolved through an alias, _nl_find_domain() returns immediately without freeing the locale copy allocated earlier. Similarly, when _nl_make_l10nflist() returns NULL, the 'goto out' skips the alias_value free. Fix by nesting the _nl_make_l10nflist() call and its result handling inside 'if (mask != -1)' instead of returning early. Move the normalized_codeset free inside the same block. Both failure paths now fall through to the unconditional alias_value free at the end. Imported from GNU gettext commit 10eafd9e5. Original author: Bruno Haible Signed-off-by: Avinal Kumar Reviewed-by: Adhemerval Zanella commit 5ce8201bf5c38e84d0c65e51d9acdd743e69d483 Author: Avinal Kumar Date: Tue May 5 20:41:42 2026 +0530 intl: Remove pre-C99 fallbacks from plural-exp.c glibc requires C11 since 2022, making pre-C99 compatibility paths in plural-exp.c dead code: - init_germanic_plural(): With C99+, GERMANIC_PLURAL is initialized at compile time and this function is never called. Remove the function and the INIT_GERMANIC_PLURAL macro. - HAVE_STRTOUL guard: Protected strtoul() usage with a manual digit-parsing fallback. strtoul is in C89 and glibc provides it. Remove the guard and the fallback loop. Imported from GNU gettext commits ab5990532 and c1d84d656. Original author: Bruno Haible Signed-off-by: Avinal Kumar Reviewed-by: Adhemerval Zanella commit 9985b162d86b636b8ca55ce1ff0744dc58717498 Author: Avinal Kumar Date: Tue May 5 20:41:41 2026 +0530 intl: Remove PRI_MACROS_BROKEN from loadmsgcat.c PRI_MACROS_BROKEN was a workaround for AIX 4, where inttypes.h did not properly define the PRI* format macros (PRId8, PRIu32, etc.). glibc has never supported AIX, the macro was always hardcoded to 0 under _LIBC, making it a dead code. GNU gettext removed this in commit 267f61670 ("Drop portability to AIX 4"), since no supported system has broken PRI macros post-C99. Based on GNU gettext commit 267f61670. Original author: Bruno Haible Signed-off-by: Avinal Kumar Reviewed-by: Adhemerval Zanella commit 6f837cdeddb2b2e4e9260b659a9e69e1e4c9f79a Author: Avinal Kumar Date: Tue May 5 20:41:40 2026 +0530 intl: Remove IN_LIBGLOCALE dead code Remove all IN_LIBGLOCALE conditional blocks from intl/. libglocale was a proposed API from 2005 that was never completed or shipped. The macro is never defined in glibc or in current GNU gettext, making every #ifdef IN_LIBGLOCALE block dead code. GNU gettext removed these in commits starting from 2023. Removing them from glibc reduces noise and eases future syncs with gettext. Imported from GNU gettext commit d6a6801c1. Original author: Bruno Haible Signed-off-by: Avinal Kumar Reviewed-by: Adhemerval Zanella commit d093102297b8ba326b946b544f52af31ba6d1135 Author: Muhammad Kamran Date: Mon May 18 14:03:02 2026 +0000 AArch64: simplify __libc_arm_za_disable failure path The failure tail of __libc_arm_za_disable only leads to __libc_fatal, so it does not need to preserve call frame state. Remove the PAC prologue, frame setup, saved cntd value, stack stores, and associated CFI directives from the fatal path, leaving only the required SME state shutdown and fatal call. Add tst-sme-za-disable-fail to exercise the abort path by providing a TPIDR2 block with non-zero reserved bytes and checking that the process terminates with SIGABRT and the expected fatal message. commit d9981b54396038bb85f3b2db7b68de1f6755530b Author: Adhemerval Zanella Date: Fri May 15 11:07:26 2026 -0300 stdio-common: Silence clang -Wfortify-source warning in tst-vfscanf-bz34008 clang does not recognize the 'm' scanf specifier and incorrectly warns that the buf argument may overflow. Suppress the warning with the clang-specific DIAG_* macros. commit 1172d0e9cfed3b9c3d225b83898c71cd18879688 Author: Adhemerval Zanella Date: Wed May 13 16:18:19 2026 -0300 elf: Batch program-header reads in _dl_map_segments (oversight fix) The fix for BZ 26577 ("Fix stack overflow in _dl_map_object_from_fd with large e_phnum") removed the alloca for the program-header table and introduced a streaming iterator (dl_pt_load_iterator) so segments could be walked without staging the entire table on the stack. That patch batched reads correctly in _dl_map_object_scan_phdrs (the first walk, which collects PT_DYNAMIC/PT_TLS/PT_GNU_* metadata), but overlooked the second walk in _dl_map_segments: _dl_pt_load_iterator_next issued one pread64 per program header to find the next PT_LOAD entry. For an object with N program headers this added N redundant per-phdr syscalls on every dlopen / loader startup -- regardless of whether the table had already been read by open_verify into struct filebuf. Unify both walks behind a single batched helper, _dl_pt_load_iterator_phdr_at: - When the program header table fits in the bytes already read by open_verify into fbp->buf (the common case for nearly all shared objects), all phdr accesses are served from that buffer with no syscall at all. - Otherwise, up to FILEBUF_SIZE / sizeof(ElfW(Phdr)) program headers are read into fbp->buf with a single pread64; subsequent indices in the same window hit the buffer. Both _dl_map_object_scan_phdrs and _dl_pt_load_iterator_next now go through this helper, eliminating the separate batching logic in _dl_map_object_scan_phdrs. struct filebuf moves from dl-load.c to dl-load.h so the inline iterator in dl-map-segments.h can reach fbp->buf. The filebuf size is also bumped to ensure the cached fast path triggers for all observed binaries. A survey of an Ubuntu 24.04 installation (scanning /usr) shows: Candidate files : 465834 ELF files inspected : 11624 glibc-linked binaries : 10164 Minimum e_phnum : 5 Maximum e_phnum : 14 Average e_phnum : 11.37 Median e_phnum : 11.0 shows e_phnum capped at 14 (for instance gcc's cc1, lto1, perl, and gdb). The previous FILEBUF_SIZE of 832 on 64-bit fit only 13 program headers after the ELF header (64 + 13*56 = 792), so 64-bit binaries with 14 phdrs missed the cached path. FILEBUF_SIZE is bumped from 512/832 to 640/1024 (32-bit / 64-bit) -- enough for at least 16 program headers on either ABI, leaving headroom over the observed maximum. For a typical shared library where open_verify's initial read covers the program header table, this reduces _dl_map_segments from N preads to 0. For a worst-case e_phnum that does not fit in fbp->buf, reads drop from N to ceil(N / phdrs_per_buf) -- the same cost _dl_map_object_scan_phdrs already pays. No functional change. Tested on x86_64-linux-gnu, aaarch64-linux-gnu, and i686-linux-gnu. Reviewed-by: H.J. Lu commit 3bd334037e6316ec3db14d7123ce4e7a8bc7ec77 Author: Adhemerval Zanella Date: Thu May 14 19:02:10 2026 -0300 elf: Fix 785a028ab70 for PTHREAD_STACK_MIN platforms Due a missing ';'. commit 785a028ab70da332bf0d573c7fc3d7bb0c4f7273 Author: Adhemerval Zanella Date: Thu May 14 17:20:02 2026 -0300 elf: Fix elf/tst-bz26577-minstack.c on hurd Hurd does not defined PTHREAD_STACK_MIN, use support_small_thread_stack_size instead. Checked on a x86_64-gnu build. commit 389ecf52bc75e6378b2881415b03f3c00a3ef891 Author: Shamil Abdulaev Date: Wed May 13 07:52:40 2026 +0200 libio: Fix race in _IO_new_file_init_internal initialization order [BZ #33785] _IO_new_file_init_internal linked the new stream into _IO_list_all before setting fp->_fileno to -1. A concurrent thread that walks _IO_list_all (for example via fflush (NULL)) could observe the stream with an uninitialized _fileno before initialization completed. Set _fileno = -1 before _IO_link_in so the stream is fully initialized when it becomes visible in the global list. This is the residual concurrency defect noted at the end of commit b657f72fa3 ("libio: Fix deadlock between freopen, fflush (NULL) and fclose (bug 24963)"). Add libio/tst-file-init-race exercising concurrent fopen/fclose and fflush (NULL) to detect regressions. Signed-off-by: Shamil Abdulaev Reviewed-by: Florian Weimer commit 1cc165baed20b6589ef2f2c8c0e0415139bbb151 Author: Frédéric Bérat Date: Wed Apr 29 13:26:38 2026 +0200 test: Add gconv refcount leak test for swscanf Add a new internal test, `tst-wcsmbs-clone-overflow`, to verify correct gconv module reference counting. The Makefile is updated to include this test in the `tests-internal` list and ensure it runs with generated locales. This test specifically checks that the `__counter` for `gconv_fcts->towc` does not leak references when `swscanf` is used with a stack-allocated wide character stream. It ensures that `_IO_wstrfile_fclose_stack` properly decrements the module reference counter, preventing a module from staying loaded indefinitely due to unreleased references. Assisted-by: LLM Reviewed-by: Adhemerval Zanella commit 0981c03c2752b5f12ede24e6e696d5a29f7c6396 Author: Frédéric Bérat Date: Wed Apr 29 15:53:51 2026 +0200 libio: Fix gconv module reference counter overflow in swscanf The swscanf family of functions creates a wide-oriented FILE stream on the stack. Initialization of this stream invokes `_IO_fwide`, which clones the global locale's gconv transformation steps via `__wcsmbs_clone_conv`. This increments the reference counter (`__counter`) of the gconv module. Because the FILE stream is stack-allocated, `fclose` cannot be called, and so `__gconv_release_step` is never invoked. The counter leaks, eventually hitting the 32-bit integer overflow limit and aborting the process. To resolve this, we introduce `_IO_wstrfile_fclose_stack`, a dedicated cleanup function for stack-allocated FILE streams. This function invokes `_IO_FINISH` and correctly releases the gconv steps via `__gconv_release_step` without attempting to `free` the FILE pointer. This cleanup function is then hooked into all variants of swscanf right before they return. Reviewed-by: Adhemerval Zanella commit 18ff9235eb08fd54a8aec0e25c4cb17727edf8f0 Author: Adhemerval Zanella Date: Fri May 8 15:59:22 2026 -0300 elf: Eliminate alloca for program-header table in the ELF loader The ELF loader allocates the program-header table on the stack with alloca(e_phnum * sizeof(ElfW(Phdr))) in two places: once in open_verify to call elf_machine_reject_phdr_p, and again in _dl_map_object_from_fd to scan segment types. Both fall back to alloca only when the table does not fit in the initial fbp->buf read; for a crafted ELF with e_phnum == 0x7FFF this means up to ~1.8 MB (32767 × 56 bytes on a 64-bit host) on the stack in each call, with no guard against the combination exhausting the available stack space. A latent variant of this problem exists even for ordinary shared libraries when dlopen is called from a thread running with PTHREAD_STACK_MIN stack (16 KB on Linux). The nptl/tst-minstack-exit test demonstrates that glibc code paths must operate correctly under minimum-stack conditions; loading a shared library with even a modest number of program headers can overflow the remaining stack through the alloca-based phdr table. This patch eliminates both allocas by replacing them with a single _dl_map_object_scan_phdrs function that reads program headers in fixed-size chunks into the existing fbp->buf scratch buffer (512 B on 32-bit, 832 B on 64-bit) using pread. When all headers fit within the bytes already captured by open_verify's initial read() call (the common case), no extra syscall is needed. This should be the case for most of the ELF objects and should not required additional syscalls. The slow path issues as many pread calls as necessary without any stack growth proportional to e_phnum. The elf_machine_reject_phdr_p interface is redesigned around a new struct dl_machine_phdr_info and on MIPS this captures the PT_MIPS_ABIFLAGS entry in-flight, so the compatibility check in elf_machine_reject_phdr_p no longer needs to re-scan the program-header table. Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu. NB: this patch depends on https://sourceware.org/pipermail/libc-alpha/2026-May/177239.html Reviewed-by: H.J. Lu commit fdd1684c85f24e1df05da1a10ae5b80fe5bf2a18 Author: Adhemerval Zanella Date: Thu May 7 18:04:05 2026 -0300 elf: Fix stack overflow in _dl_map_object_from_fd with large e_phnum (BZ 26577) The _dl_map_object_from_fd uses a VLA (loadcmds[l->l_phnum]) whose size is proportional to e_phnum. A crafted ELF with e_phnum == 0x7FFF allocates ~1.5 MB (32767 × 48 bytes on 64-bit machine) on the stack, which adds to the previous ~1.75 MB alloca for the phdr table that precedes it. This patch follow Florian's suggestion [1] to use a two-pass approach (collect-then-map) with a single-pass struct dl_pt_load_iterator that precomputes the metadata needed by _dl_map_segments (p_align_max, has_holes, first/last segment bounds, nloadcmds) and then yields one struct loadcmd at a time through _dl_pt_load_iterator_next, holding at most one loadcmd on the stack at a time. The same iterator is threaded through _dl_map_segments in dl-map-segments.h. The main complex part is the test, which adds python-generated crafted ET_DYN that has e_phnum == 0x7FFF: one PT_LOAD covering the ELF header so the loader exercises the full iterator path, and the remaining headers PT_NULL. The test runs two subtests under a reduced stack limit (phdr alloca + 1 MB headroom ≈ 2.75 MB, well below the 3.25 MB the unfixed VLA code requires). Checked on aarch64-linux-gnu, x86_64-linux-gnu, and i686-linux-gnu. [1] https://sourceware.org/pipermail/libc-alpha/2026-February/175136.html Reviewed-by: H.J. Lu commit ba305d8268530a20eb537b9880e744c6eed233f9 Author: Avinal Kumar Date: Mon May 4 22:52:06 2026 +0530 intl: Add tests for plural expression hardening The first test checks for stack overflow. It uses a plural expression nested 5000 levels deep using the !(1-(...)) pattern. The parser accepts it (below YYMAXDEPTH=10000), but evaluation exeeds EVAL_MAXDEPTH=100 and falls back to index 0 instead of crashing with SIGSEGV. The second test checks for division by zero in plural expression. The expression (n!=1)+1/(n!=1729) triggers 1/0 for n=1729. msgfmt only validates 0<= n <= 1000, so the .mo file is accepted. Evaluation returns PE_INTDIV and falls back instead of raising SIGFPE. Adaptations from gettext to glibc: - gettext's plural-3 embeds the nested expresion as a literal string. This test uses an AWK script (plural-depth.awk) to generate the same expression. - gettext uses LANGUAGE= (empty) with LC_ALL=ll and its own locale setup. glibc requires a real locale for setlocale() or else the "C" locale override in dcigettext.c ignores LANGUAGE entirely. The tests are derived from GNU gettext's plural-3 (commit 021348871a22) and plural-4 (commit 429ba6c6b835), adapted to glibc's test framework. Original author: Bruno Haible Signed-off-by: Avinal Kumar Reviewed-by: Adhemerval Zanella commit e7f5359db75ac4713b8c45bd4213264c0a26bc06 Author: Avinal Kumar Date: Mon May 4 22:52:05 2026 +0530 intl: Import plural expression hardening from GNU gettext The plural expression evaluator plural_eval() in eval-plural.h uses unbounded recursion, which can cause a stack overflow crash with deeply nested expressions in malicious .mo files. This is particularly dangerous on threads with small stacks (musl libc default: 128 KB, AIX 7 default: 96 KB, glibc after ulimit -s 260: ~3919 recursions max). Additionally, division by zero in plural expressions triggers raise(SIGFPE), which is not multithread-safe, catching SIGFPE requires per-process signal handlers that race with other threads. Fix both by importing the hardening from GNU gettext: - Replace unbounded plural_eval() with depth-limited plural_eval_recurse() (EVAL_MAXDEPTH=100), returning a struct eval_result with status instead of a bare unsigned long. - Return PE_INTDIV status on division by zero instead of raising SIGFPE. Remove the architecture-specific INTDIV0_RAISES_SIGFPE macro and the conditional #include . - Update plural_lookup() in dcigettext.c to handle the new return type, falling back to index 0 on any evaluation failure. Based on GNU gettext commits ef37a1540 and 726bfb1d1. Discussed on: https://sourceware.org/pipermail/libc-alpha/2023-October/152010.html Original author: Bruno Haible Signed-off-by: Avinal Kumar Reviewed-by: Adhemerval Zanella commit c2d6afb4a010a46e0fc73bb4619db9c3796a3077 Author: Adhemerval Zanella Date: Fri Apr 24 10:49:23 2026 -0300 arm: Enable static-pie support (BZ 34098) It requires proper gcc support [1], and without proper compiler support the arm configure disable static-pie support. The start.S requires some adjustment to avoid loading main from the GOT. Checked on arm-linux-gnueabihf with and without the gcc patch applied. [1] https://gcc.gnu.org/pipermail/gcc-patches/2022-July/598610.html Reviewed-by: Yury Khrustalev Reviewed-by: Sam James commit b28ffb926f34934a19c5e853504bdc8a8d57137f Author: Andreas Schwab Date: Sun May 10 11:57:34 2026 +0200 riscv: redirect strlen in early startup __tunables_init calls strlen before ifunc relocations have been set up, redirect it to __strlen_generic. commit c20e60e3507ac1fd859131e81ac237a663267c45 Author: Peter Collingbourne Date: Fri May 8 19:53:24 2026 +0200 resolv, rt: Change some extern inline functions to static inline The following functions: __aio_create_helper_thread __aio_start_notify_thread __gai_create_helper_thread __gai_start_notify_thread are declared as extern inline, but no translation unit provides their real definitions. This can lead to a link failure if the functions are not inlined. Fix it by declaring them as static inline instead. Reviewed-by: Florian Weimer commit 9b8ff36d0c881bfa08dfece10df89b1c199b23ee Author: Yao Zihong Date: Tue May 5 16:22:29 2026 -0500 riscv: Add RVV strncmp for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of strncmp for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__strncmp_vector) is added alongside the generic fallback (__strncmp_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling strncmp(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit d62f110fd1d158ca912f944072fe5750b6f09155 Author: Yao Zihong Date: Tue May 5 16:12:37 2026 -0500 riscv: Add RVV strcmp for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of strcmp for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__strcmp_vector) is added alongside the generic fallback (__strcmp_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling strcmp(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit 37ee8868dc4ba4941030881c3050e04d0435670d Author: Yury Khrustalev Date: Wed May 6 13:29:56 2026 +0100 support: add support_ptr_after_free Some tests use pointers after the associated memory has been freed. On targets that support memory tagging, using such pointers even for test purposes might be impossible. To work around this, we add new function that would allow to clear a pointer in a target-specific way. We modify 3 relevant malloc tests: tst-malloc-backtrace, tst-tcfree3, and tst-safe-linking. Reviewed-by: Wilco Dijkstra commit 839898777226a3ed88c0859f25ffe712519b4ead Author: Rocket Ma Date: Fri Apr 17 23:48:41 2026 -0700 stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] * stdio-common/vfscanf-internal.c: When enlarging allocated buffer with format %mc or %mC, glibc allocates one byte less, leading to user-controlled one byte overflow. This commit fixes BZ #34008, or CVE-2026-5450. Reviewed-by: Carlos O'Donell Signed-off-by: Rocket Ma Reviewed-by: H.J. Lu commit 1a70b352c3b4f54661cf93545ddb506a3531e3e7 Author: Uros Bizjak Date: Wed May 6 17:07:54 2026 +0200 i386: Replace inline asm rotates in pointer_guard with stdc_rotate_{left,right} Use the C23 rotation helpers instead of inline assembly for pointer mangling and demangling on i386. The PTR_MANGLE and PTR_DEMANGLE macros previously used rol/ror inline asm with a constant rotation of 9. Replace these with stdc_rotate_left and stdc_rotate_right operating on uintptr_t, preserving the exact rotation count via 2 * sizeof (uintptr_t) + 1. This change removes inline assembly, improves portability and readability and lets the compiler select optimal code generation. No functional change intended. Signed-off-by: Uros Bizjak Reviewed-by: Adhemerval Zanella commit 63545c6d2c5c5a9b5259761b23eb6996bb71187f Author: Uros Bizjak Date: Wed May 6 17:05:46 2026 +0200 x86_64: Replace inline asm rotates in pointer_guard with stdc_rotate_{left,right} Use the C23 rotation helpers instead of inline assembly for pointer mangling and demangling on x86_64. The PTR_MANGLE and PTR_DEMANGLE macros previously used rol/ror inline asm with a constant rotation of 2 * LP_SIZE + 1. Replace these with stdc_rotate_left and stdc_rotate_right operating on uintptr_t, preserving the exact rotation count via 2 * sizeof (uintptr_t) + 1. This change removes inline assembly, improves portability and readability and lets the compiler select optimal code generation. No functional change intended. Signed-off-by: Uros Bizjak Reviewed-by: Adhemerval Zanella commit f7623844a710fcd483a4d8fbc99a901977cf76b8 Author: Uros Bizjak Date: Wed May 6 16:35:54 2026 +0200 stdlib: Add internal stdc_rotate_left implementation It follows the C2y N3367 proposed interface, along with some tests imported from gnulib (and adapted to glibc libsupport). Signed-off-by: Uros Bizjak Reviewed-by: Adhemerval Zanella commit 6b9135f75b941520493f57adca6f63a93c0197d7 Author: Carlos O'Donell Date: Thu May 7 10:41:36 2026 -0400 Drop "(C) YYYY" from DCO'd contributions. Contributions made under DCO use a generic statement to indicate that the file has copyright, but that statement does not need to include a year. Remove the year to avoid the work required to update that statement to include future years as such updates are not required. commit ef3bfb5f910011f3780cb06aa47e730035f53285 Author: Rocket Ma Date: Fri May 1 20:39:07 2026 -0700 libio: Fix ungetwc operating on byte stream [BZ #33998] * libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one character, it accidently compare the wchar to push back with the last char from byte stream, instead of wide stream. Under specific coding, attacker may exploit this to leak information. This commit fix bug 33998, or CVE-2026-5928. Signed-off-by: Rocket Ma Reviewed-by: Carlos O'Donell commit 79dbb41f159a4defe75f59a8f491d136236d1f7a Author: Uros Bizjak Date: Wed May 6 15:15:35 2026 +0200 stdlib: add missing stdc_rotate_right_ull alias when builtin is available When __builtin_stdc_rotate_right is supported, glibc defines type-specific aliases for several unsigned integer types (uc, us, ui, ul), but omits the unsigned long long variant. This leads to an inconsistency between the builtin-backed path and the generic fallback, where unsigned long long is handled. Add the missing stdc_rotate_right_ull macro mapping to stdc_rotate_right(__x, __n) to complete the set of type-specific helpers and ensure consistent API coverage across all supported unsigned integer types. No functional change for existing users; this only exposes the expected alias for unsigned long long. Fixes: 331c7a4cd0ee ("stdbit: Fix builtin name used in __glibc_has_builtin check for rotate_right") Signed-off-by: Uros Bizjak commit 331c7a4cd0ee9b3788b459a9039248597628bf41 Author: Uros Bizjak Date: Wed May 6 11:21:39 2026 +0200 stdbit: Fix builtin name used in __glibc_has_builtin check for rotate_right The __glibc_has_builtin check in include/stdbit.h incorrectly refers to ___builtin_stdc_rotate_right (with three leading underscores) instead of the correct __builtin_stdc_rotate_right (two leading underscores). As a result, the builtin is not detected even when supported by the compiler. Fix the spelling to use __builtin_stdc_rotate_right consistently in both the feature test and the corresponding comment. Fixes: 4adae8550a7a ("stdlib: Add internal stdc_rotate_right implementation") Signed-off-by: Uros Bizjak Reviewed-by: Adhemerval Zanella commit d6a8c9d62f16a41b9cc43d31ce5994424e1e778e Author: Yury Khrustalev Date: Wed Apr 15 14:40:17 2026 +0100 misc: fix lint-makefiles failures Reviewed-by: Wilco Dijkstra commit 07122a9d8d4597321e77d97f9ba18c11a42d8b5b Author: Yao Zihong Date: Thu Apr 30 15:15:36 2026 -0500 riscv: Add RVV strlen for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of strlen for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__strlen_vector) is added alongside the generic fallback (__strlen_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling strlen(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit 55873e86e1861ffe010a83455ac7eb5df239ec3e Author: Florian Weimer Date: Mon May 4 17:18:38 2026 +0200 support: Improve tst-support_descriptors compatibility with containers If /dev/null is bind-mounted, /dev and /dev/null are on different devices, so the expected failure has an additional line describe the device change. Reviewed-by: Carlos O'Donell commit 2c12af53da75c0bea7a6df374fabdfabd5ed8153 Author: Jiho Lee Date: Wed Apr 29 10:00:14 2026 +0900 localedata: update LC_ADDRESS and LC_NAME for ko_KR Update the South Korean (ko_KR) locale to reflect official standards: - LC_ADDRESS: Follow the Large-to-Small hierarchy (Country, Postcode, City, Road, Recipient) as per Korea Post guidelines. (https://www.koreapost.go.kr/kpost/subIndex/135.do?pSiteIdx=125) - LC_NAME: Follow the standard Korean order (Surname + Given Name) without Western-style salutations or tabs. * localedata/locales/ko_KR (LC_ADDRESS): Update postal_fmt. * localedata/locales/ko_KR (LC_NAME): Update name_fmt to "%f%g". Signed-off-by: Jiho Lee Reviewed-by: Arjun Shankar commit ef2e5453b166b9339fd92b685c10312b423be7eb Author: Joseph Myers Date: Fri May 1 00:26:05 2026 +0000 Use Linux 7.0, MPC 1.4.1 in build-many-glibcs.py Tested with build-many-glibcs.py (host-libraries, compilers and glibcs builds). commit efb343f3311dfc941d08b136e7b1282684742310 Author: xiejiamei Date: Wed Apr 29 08:20:30 2026 +0000 x86: Enable Prefer_No_AVX512 for Hygon model 0x8 Extend the Prefer_No_AVX512 tuning to cover Hygon model 0x8. Benchmarks on Hygon platforms show that EVEX implementations are often more profitable than AVX512 paths. The existing logic already enables Prefer_No_AVX512 for model 0x7. Apply the same preference to model 0x8 to ensure consistent IFUNC selection behavior across newer Hygon processors. Signed-off-by: xiejiamei Reviewed-by: H.J. Lu commit 4fd40bba95f666470b5e40ed6aca641f5e46d2e6 Author: Rocket Ma Date: Thu Apr 23 09:09:23 2026 -0700 stdio-common: Fix overflow registering modifier [BZ #34086] * stdio-common/reg-modifier.c: The wchar in str can be greater or equal than 0, and less or equal than UCHAR_MAX, that means, we need a buffer with UCHAR_MAX + 1 elements, so that user input will not overflow __printf_modifier_table. Signed-off-by: Rocket Ma Reviewed-by: Adhemerval Zanella commit 842ad56879c8abe4ff8bc6ccc5097d2755e52527 Author: Petr Menšík Date: Thu Oct 16 16:18:23 2025 +0200 Return different exit codes when gai_result is > -100 Make the result checkable from the command line even without verbose mode. Keep original exit status 2 for name not found error. But report other errors by exit status greater than 10. For too high values make it return 2 as before. Signed-off-by: Petr Menšík Reviewed-by: Adhemerval Zanella commit d0e06e8254a4aa93ab3f612a206a5ca0116c8cc6 Author: Petr Menšík Date: Thu Oct 16 16:18:21 2025 +0200 nss: Add verbose flag to getent tool Unlike older hosts database served by gethostbyname, getaddrinfo call can return varying return codes. Those codes can be vital for providing reason why name resolution on the system did not return address. Even when getent tool is usually present on every small container image, there is often no helpful tool to show getaddrinfo errors. This simple change adds verbosity flag to getent. With that it can provide more details about the reason of the failure. It can help to obtain information whether the name queried exists or does not have address of requested types only. The only database where this will help is ahosts* variants. I have not found any kind of test to expand with new verbose flag. But I think this would be very useful on various limited system, where bind-utils is not installed by default. Besides, sometimes getaddrinfo call can return different information than DNS protocol itself. Example of usage: nss/getent -v ahosts com. This will tell you the name exists, but has no address. Signed-off-by: Petr Menšík Reviewed-by: Adhemerval Zanella commit ddd5c8b0b477420ea2c4ff4cadd2a9c9521f437b Author: Shamil Abdulaev Date: Thu Apr 30 02:37:39 2026 +0300 hugepages: close fd on error path in __get_thp_mode If __read_nocancel fails or overflows the buffer, the function returned without closing the /sys/kernel/mm/transparent_hugepage/enabled fd. Found while investigating BZ #34083. Signed-off-by: Shamil Abdulaev Reviewed-by: H.J. Lu commit dbc2b380fac027fed5db6ae864e4accf9f82a3fd Author: Collin Funk Date: Tue Apr 28 19:08:33 2026 -0700 Update link in SECURITY.md. The cve.mitre.org site is an archive that redirects users to cve.org. The linked about page has also been removed, so this patch changes it to reference the current equivalent on cve.org. Reviewed-by: Florian Weimer commit ddc825d1b3279754068264a9d274bf21c97ec680 Author: Dmitry Kovalenko Date: Tue Apr 28 15:25:30 2026 -0300 locale: memory leak in newlocale [BZ #25770] It is a fix for memory leak in the function 'newlocale' (the real name is __newlocale). There is not released a memory for the local buffer 'locale_path'. https://sourceware.org/bugzilla/show_bug.cgi?id=25770 --- Patch was tested on Ubuntu 24.04. My 'LOCPATH' environment variable is "/snap/code/193/usr/lib/locale". With an original (system) libc I have the following problem: #0 0x7d5c3aafc778 in realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85 #1 0x7d5c394b05f2 in __argz_add_sep string/argz-addsep.c:34 #2 0x7d5c39439bdb in __newlocale locale/newlocale.c:111 #3 0x7d5c370e58fc (/lib/x86_64-linux-gnu/libp11-kit.so.0+0x1098fc) (BuildId: 1cbcd6ac7e0ff0259eb3acc14d556d2c1ec00cdc) #4 0x7d5c3b14571e in call_init elf/dl-init.c:74 #5 0x7d5c3b145823 in call_init elf/dl-init.c:120 #6 0x7d5c3b145823 in _dl_init elf/dl-init.c:121 #7 0x7d5c3b15f59f (/lib64/ld-linux-x86-64.so.2+0x1f59f) (BuildId: 1c8db5f83bba514f8fd5f1fb6d7be975be1bb855) SUMMARY: AddressSanitizer: 46 byte(s) leaked in 1 allocation(s). When I run with my corrected libc, through runtest.sh , all is OK. Signed-off-by: Dmitry Kovalenko Co-authored-by: Florian Weimer commit c82c07ff288e249aee11be45c8f2864476f5a8e4 Author: Shamil Abdulaev Date: Fri Apr 24 00:48:17 2026 +0300 README: fix stale bug-reporting URL [BZ #34094] The URL https://www.gnu.org/software/libc/bugs.html now redirects to a page with no bug-reporting instructions. Point to the glibc wiki Bugzilla Procedures page instead. Signed-off-by: Shamil Abdulaev Reviewed-by: H.J. Lu commit f071e2b4a0b20880fa2ff2a4defd9b59d31d91b6 Author: Shamil Abdulaev Date: Tue Apr 28 13:34:09 2026 -0300 manual: clarify _FILE_OFFSET_BITS Y2038 implications [BZ #34095] The existing paragraph warning about _FILE_OFFSET_BITS default changes due to Y2038 is correct but confusing, as it does not explicitly state why time_t concerns affect _FILE_OFFSET_BITS. Clarify that _TIME_BITS=64 (needed for Y2038 safety) requires _FILE_OFFSET_BITS=64, so when systems migrate to 64-bit time_t by default, _FILE_OFFSET_BITS will also need to default to 64, even for applications that do not handle large files. This addresses the confusion noted in the bug report while keeping the warning in place, as the transitive dependency makes it relevant to the _FILE_OFFSET_BITS documentation. Signed-off-by: Shamil Abdulaev commit d6cb0f9de4e3c12bf88183b9bf07b9eaebc53677 Author: Rocket Ma Date: Fri Apr 24 10:27:59 2026 -0700 misc: Optimize getusershell.c * misc/getusershell.c: Completely rewrite the unit. Only allocate one big buffer to store shell names. Add a missing unit test. The new implementation read the whole file into one buffer, and wipe out every byte but shell names. Later when addressing shell names from first shell, jump to next '\0' and then jump to next '/'. This could reduce memory footprint and shall improve some performance. Signed-off-by: Rocket Ma Reviewed-by: Adhemerval Zanella commit 40a42fc187c50312b333b6c36da622169affb71b Author: Carlos O'Donell Date: Tue Apr 28 07:43:21 2026 -0400 advisories: Update GLIBC-SA-2026-0012 metadata Update Vulernable-Commit based on glibc-2.1.9000 tag for the old releases. commit 86020ddf3453ef50bdce8375e4842d1c2ab1d35e Author: Carlos O'Donell Date: Tue Apr 28 07:39:11 2026 -0400 advisories: Update GLIBC-SA-2026-0012 Update GLIBC-SA-2026-0012 with similar language from GLIBC-SA-2026-0011. commit 82f067fd526a242ac004f99a97a0ebbd36254aa2 Author: Carlos O'Donell Date: Mon Apr 27 17:22:49 2026 -0400 Add advisory text for CVE-2026-5435 Reviewed-by: Siddhesh Poyarekar commit 82d9303976c74c337ef67dda10bf08c2b28aedac Author: Stefan Liebler Date: Thu Apr 23 14:43:33 2026 +0200 Remove EXIT_UNSUPPORTED in stdlib/test-bz22786 if path is NULL With commit 6c3a8a9d868a8deddf0d6dcc785b6d120de90523 (2018-08-25), the test used xmalloc instead of malloc and therefore removed the path == NULL check as xmalloc is printing an error message and exit with a fail in this case. On s390-32 this was always a FAIL instead of UNSUPPORTED, thus the previous behaviour was re-enabled with commit 3bad2358d67d371497079bba4f8eca9c0096f4e2 five days later on 2018-08-30. Therefore, we don't know if this also happens on other systems. While removing s390-32 with commit b01debcd8f5229860b3224ea135b1b8456281cee I've adjusted the comment and Adhemerval asked whether this can also happen on other systems with little physical memory. We've decided to remove the EXIT_UNSUPPORTED in this extra commit instead of the large s390-32 removal one. See libc-alpha: https://inbox.sourceware.org/libc-alpha/20260409085102.3475867-1-stli@linux.ibm.com/T/#m28b5375bef4cfb10729b93c7e658b91a14b07b85 If this change leads to test fails somewhere, please add a comment about your used system and revert this commit. Nowadays path is allocated with support_blob_repeat_allocate which returns an empty struct in case of malloc/mmap is not able to allocate enough memory. All other tests using support_blob_repeat_allocate (stdlib/tst-strtod-overflow.c, support/tst-support_blob_repeat.c and string/tst-memmove-overflow.c) are properly checking the start or size field directly or indirectly via TEST_COMPARE_BLOB. While the test support/tst-support_blob_repeat.c just prints a warning if allocating the large mappings is not possible, the other tests exit with UNSUPPORTED. At least for the realpath-part, the commit 855a67c3cc81be4fc806c66e3e01b53e352a4e9f introduced support_accept_oom handling. According to the discussion: https://inbox.sourceware.org/libc-alpha/8a1fd5b2-5118-498e-babf-e46c0e6d1cdf@redhat.com/ Agreed, test-bz22786 can use a lot of memory. OK. These convert OOM to UNSUPPORTED for the test if there isn't enough memory. In case of not enough memory while allocating path, this change would lead to a segmentation fault instead of UNSUPPORTED. As this is inconsistent compared to the second realpath-part and also to the other tests using support_blob_repeat_allocate, I would prefer keeping UNSUPPORTED if path is NULL. Nevertheless, I've posted this patch for discussion as promised while reviewing the s390-32 removal patch. Reviewed-by: Adhemerval Zanella commit db5b939311710bd6cb9506cd7f61de054d3bdcee Author: Siddhesh Poyarekar Date: Mon Apr 27 18:29:26 2026 -0400 Document CVE-2026-6238 Signed-off-by: Siddhesh Poyarekar commit ce6b8627eb617926da1c93fe73c33117acef905b Author: Yury Khrustalev Date: Thu Apr 16 14:53:58 2026 +0100 tests: misc: Use new tunable handling for BTI and GCS tests Use new way of handling test tunables for BTI and GCS tests. Fix tests that would fail when ambient GLIBC_TUNABLES variable is used with the aarch64_gcs tunable. Reviewed-by: Adhemerval Zanella commit 7a330377656f240dd899af0c0b8ffbd48d79ea88 Author: Yury Khrustalev Date: Thu Apr 16 14:53:29 2026 +0100 tests: time: Use new tunable handling Use new way of handling test tunables in the time folder. Reviewed-by: Adhemerval Zanella commit e08a2a3c8a82c4fb7ad16642a784d04900e07946 Author: Yury Khrustalev Date: Thu Apr 16 14:52:47 2026 +0100 tests: nptl: Remove unused code from makefile There is no test named tst-pthread-proc-maps. Reviewed-by: Adhemerval Zanella commit fdfca46c38865fd336ff9cd4c7f8a7c20d08e6bf Author: Yury Khrustalev Date: Thu Apr 16 14:52:17 2026 +0100 tests: nptl: Use new tunable handling Use new way of handling test tunables in the nptl folder. Reviewed-by: Adhemerval Zanella commit d24b6b046c0ab7c4651f53c406cc7f4a033710bf Author: Yury Khrustalev Date: Thu Apr 16 14:50:17 2026 +0100 tests: misc: Use new tunable handling Use new way of handling test tunables in the misc folder. Reviewed-by: Adhemerval Zanella commit c65a27262a10f3616106354441298a43ada1c96b Author: Yury Khrustalev Date: Thu Apr 16 14:49:31 2026 +0100 tests: gmon: Use new tunable handling Use new way of handling test tunables in the gmon folder. Reviewed-by: Adhemerval Zanella commit bd9c1e5730bb3283ba48dca2862ff970f2edc0c3 Author: Yury Khrustalev Date: Thu Apr 16 14:48:31 2026 +0100 tests: elf: Use new tunable handling Use new way of handling test tunables in the elf folder. Reviewed-by: Adhemerval Zanella commit 5ea36b2cf4a0cbf8995e2ea82bf7485ce627e32a Author: Yury Khrustalev Date: Thu Apr 16 14:38:02 2026 +0100 tests: Allow tests to append tunables Many tests use Glibc tunables, and the values of the tunables are provided via the GLIBC_TUNABLES env variable. Tests set it in makefiles using tst-foo-ENV = GLIBC_TUNABLES=tunable=value This overwrites environment for this test, so if another env var is set elsewhere, one of these changes would be lost. The correct way should be to append to test's environment: tst-foo-ENV += GLIBC_TUNABLES=tunable=value However, if two or more tunables need to be set for the same test, the 'tunable=value' part should be appended to previously defined GLIBC_TUNABLES env variable, and it's not easy to achieve this via existing tools available for tests. Additionally, there are cases when it is useful to set ambient env var GLIBC_TUNABLES in order to apply it to most of the tests except those that require specific tunables. The existing mechanism that relies on tst-foo-ENV would always override the ambient env var even when it is not desirable. To address all of this, in this commit we add support for using constructs like tst-foo-TUNABLES += tunable=value Using this, the test will receive appropriate GLIBC_TUNABLES contents, and if there is an ambient env var GLIBC_TUNABLES, its value will be prepended to the env var used by the test. Even if the ambient env var contains the same tunable that is used by a test, the test's value will override the ambient value, and the test will be executed correctly. Additionally, we support cases when tests must have specific value of the GLIBC_TUNABLES env var (ignoring any ambient value): tst-foo-TUNABLES-only += tunable=value The existing mechanism that uses tst-foo-ENV will continue to work, however if the same test uses both, the new mechanism will override the old one. Additional benefit is that the code in makefiles becomes shorter. We also change tunable handling for malloc tests in this commit. Reviewed-by: Adhemerval Zanella commit 1c21e96d4f4ecbadf70156ce9ace5426c4686ef8 Author: Collin Funk Date: Mon Apr 13 14:18:57 2026 -0700 posix: fix false regex match with backrefs and $ anchor This fixes the $ anchor being ignored in the following grep command: $ grep -E '^(.?)(.?).?\2\1$' <<< ab ab However, the regular expression should only match palindromes. This patch is mostly copied from a commit in Gnulib from Jim Meyering [1], and a followup commit by Paul Eggert [2]. It was found by Ed Morton in GNU sed [3]. [1] https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=8c22765403cc34e87ad953cb3f6901e723c937f5 [2] https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=8b627431703c7e7d762f9e3174336d66b558314a [3] https://bugs.gnu.org/68725 Reviewed-by: Adhemerval Zanella commit 5880459251e74f2471a5a45c90aa6494756ac4bf Author: Peter Bergner Date: Thu Apr 23 08:31:11 2026 -0500 riscv: Remove duplicte memcpy redirect Aplying a patch added a duplicate redirect of memcpy to memcpy_generic. Remove it. Signed-off-by: Peter Bergner commit 81eb2bb5ef4385fe792b506178fad92efc9908a3 Author: Yao Zihong Date: Tue Apr 21 14:58:10 2026 -0500 riscv: Add RVV memcpy for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of memcpy for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__memcpy_vector) is added alongside the generic fallback (__memcpy_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling memcpy(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit d4c66edeef6ced8fd15af0b3bfdadfb80501e96e Author: Yury Khrustalev Date: Wed Mar 25 10:04:19 2026 +0000 support: add support_address_diff function Some malloc tests compare pointers meaning to compare addresses. On AArch64, the 64-bit value of the pointer may contain metadata along with the values of the address. In order to correctly compare addresses, we add new function for AArch64 target that will use the AArch64 64 SUBP (subtract pointer) instruction when it is available. This instruction uses the 56-bit addresses ignoring top-byte metadata. Best implementation is selected using ifunc resolver. On other targets and also on AArch64 when MTE is not available this function defaults to PTR_DIFF defined in libc-pointer-arith.h. Three malloc tests are modified accordingly: - tst-memalign-2.c - tst-memalign-3.c - tst-realloc.c Reviewed-by: Wilco Dijkstra commit 969cc1df8f467ce3367149628da426692c774083 Author: Carlos O'Donell Date: Tue Apr 21 12:17:02 2026 -0400 advisories: Reject GLIBC-SA-2026-0008 Reviewed-by: Siddhesh Poyarekar commit 979e4dc4a0ce4f242f5d075d58048ba6f7f1c9e2 Author: Carlos O'Donell Date: Tue Apr 21 12:16:29 2026 -0400 advisories: Document rejection process in README. Reviewed-by: Siddhesh Poyarekar commit 40fb13ac3de0dbd792d9fe09230dc0d0d4cde444 Author: Yao Zihong Date: Mon Apr 20 16:19:08 2026 -0500 riscv: Add RVV strcpy for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of strcpy for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__strcpy_vector) is added alongside the generic fallback (__strcpy_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling strcpy(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit 79a7d01c9e91cd00f0acdd8d93b2ed852c70ae1f Author: Stefan Liebler Date: Tue Apr 21 14:50:15 2026 +0200 s390: Remove Wno-CFLAGS for rtld.c/dl-load.c/dl-reloc.c While review of s390-32 removal, Adhemerval asked if those CFLAGS are still necessary: https://inbox.sourceware.org/libc-alpha/20260409085102.3475867-1-stli@linux.ibm.com/T/#me5120906445f3941031e29c3a093f1699eae77b4 According to the git-history, the first s390-Makefile was introduced back in 2000-08-02 with those CFLAGS. The same are also included now and past in i386-Makefile. But I haven't found a reason why those were added in the past and if it was really necessary on s390. I assume it was with old GCCs most likely due to inclusion of dl-machine.h. This patch removes those CFLAGS. If needed, we have to circumvent the issues again. At least I've used current GCCs 12.5, 13.4, 14.3, 15.2 and gcc-head to successfully build current glibc on s390-64 with -O2, -O3 and -Os without such warnings. Reviewed-by: Florian Weimer commit e3e8f814e53d32da99db03ac38ed3af86651b233 Author: Carlos O'Donell Date: Mon Apr 20 16:37:20 2026 -0400 advisories: Fix spelling mistake in GLIBC-SA-2026-0009. commit 9895db657ad9e19b1fb2d7716b00d0e6f84f1c32 Author: Carlos O'Donell Date: Mon Apr 20 14:08:57 2026 -0400 Add advisory text for CVE-2026-5450 commit da3863e62e8ff1abc6b92cfe6d899ca3e80c8c4b Author: Siddhesh Poyarekar Date: Fri Apr 10 12:52:11 2026 -0400 Document CVE-2026-5358 and CVE-2026-5928 Signed-off-by: Siddhesh Poyarekar commit 2ff2565df78160b392b120793d6d1aac2d716701 Author: Pierre Blanchard Date: Wed Apr 15 08:32:44 2026 +0000 AArch64: Implement AdvSIMD and SVE powr(f) routines Vector variants of the new C23 powr routines. These provide same maximum error error as pow by virtue of relying on shared approximation techniques and sources. Note: Benchmark inputs for powr(f) are identical to pow(f). Performance gain over pow on V1 with GCC@15: - SVE powr: 10-12% on subnormal x, 12-13% on x < 0. - SVE powrf: 15% on all x < 0. - AdvSIMD powr: for x < 0, 40% if x subnormal, 60% otherwise. - AdvSIMD powrf: 4% on x subnormals or x < 0. commit 4794e84a2f7899a4868f84a89feb55f9d5f8bb52 Author: Pierre Blanchard Date: Wed Apr 15 08:32:43 2026 +0000 benchtests: add libmvec powr inputs They are identical to the libmvec pow ones. commit 51c406920601eb04fb0e7c9340ed385afc7f6cc0 Author: Pierre Blanchard Date: Wed Apr 15 08:32:42 2026 +0000 benchtests: add libmvec powrf inputs They are identical to the libmvec powf ones. commit 3f97be129d805f8616842802e102b77ac2cd7558 Author: Pierre Blanchard Date: Wed Apr 15 08:32:41 2026 +0000 AArch64: Improve AdvSIMD and SVE pow(f). Optimize handling of subnormal x and/or negative x. Some cleanup in attributes, macros and improving overall consistency. Move core computation to header Introduce config parameter to turn sign_bias on/off. Performance improvement on V1 with GCC@15: - AdvSIMD pow: 10-15% on subnormals. - AdvSIMD powf: 30 to 70% on subnormals or x < 0, <=3% on x > 0. - SVE pow: 10-15% on subnormals, <=3% otherwise. - SVE powf: no significant variations in codegen/perf. commit ed1eed7da7a0d0c9cf01c9c387f55ac0da16d285 Author: Adhemerval Zanella Date: Thu Apr 16 14:28:49 2026 -0300 io: Consolidate ftw implementation Remove wordsize-64 and arch-specific implementations, for ABIs when off_t is the same as off64_t (__OFF_T_MATCHES_OFF64_T) the ftw64.c will create the requires aliases. The ftw.c implementation is moved to ftw-common.c to simplify the __OFF_T_MATCHES_OFF64_T usage. commit b9a2dea54abd1c5db9773a92c97dd3202bbaec62 Author: Adhemerval Zanella Date: Thu Apr 16 10:43:41 2026 -0300 io: Consolidate fts implementation Remove wordsize-64 and arch-specific implementations, for ABIs when off_t is the same as off64_t (__OFF_T_MATCHES_OFF64_T) the fts64.c will create the requires aliases. The fts.c implementation is moved to fts-common.c to simplify the __OFF_T_MATCHES_OFF64_T usage. commit 9b5e9799b6af76e91b29334310ecd32096b274c2 Author: Yao Zihong Date: Wed Feb 18 15:12:09 2026 -0600 riscv: Add RVV strcat for both multiarch and non-multiarch builds This patch adds an RVV-optimized implementation of strcat for RISC-V and enables it for both multiarch (IFUNC) and non-multiarch builds. The implementation integrates Hau Hsu's 2023 RVV work under a unified ifunc-based framework. A vectorized version (__strcat_vector) is added alongside the generic fallback (__strcat_generic). The runtime resolver selects the RVV variant when RISCV_HWPROBE_KEY_IMA_EXT_0 reports vector support (RVV). Currently, the resolver still selects the RVV variant even when the RVV extension is disabled via prctl(). As a consequence, any process that has RVV disabled via prctl() will receive SIGILL when calling strcat(). Co-authored-by: Hau Hsu Co-authored-by: Jerry Shih Signed-off-by: Yao Zihong Reviewed-by: Peter Bergner commit 575ae6063d52e75ddb87b8adf5e9842f595b8f99 Author: Stefan Liebler Date: Thu Apr 9 10:47:10 2026 +0200 CONTRIBUTED-BY: Adjustments regarding s390-32, s390-64 After removing the files in s390-32 subfolder, we can also remove the entries in CONTRIBUTED-BY file. The entries for s390-64 files were adjusted to fit to the new paths. Reviewed-by: Adhemerval Zanella commit 2388cad009b773587e2dd9523d4db32085b18288 Author: Stefan Liebler Date: Thu Apr 9 10:47:09 2026 +0200 s390: Move files out of s390-64 folders All the files in subfolders s390/s390-64 in sysdeps directory are moved up to the s390/ ones. If necessary the files were merged with the existing ones. sysdeps/s390/preconfigure.ac was updated to reflect the removal of s390-64 subdirectory. Reviewed-by: Adhemerval Zanella commit 63c3de1386f5321f2343c338ddf263cef254e4a1 Author: Stefan Liebler Date: Thu Apr 9 10:47:08 2026 +0200 s390: Switch to common-code headers The removal of s390-32 allows us to switch to common-code headers instead of providing s390-64 specific headers: from sysdeps/unix/sysv/linux/s390/bits/environments.h to bits/environments.h -> We now only have a 64bit environment. from sysdeps/s390/s390-64/bits/wordsize.h to sysdeps/wordsize-64/bits/wordsize.h -> All macros are defined equal from sysdeps/unix/sysv/linux/s390/bits/utmp.h to bits/utmp.h -> On s390-64, __WORDSIZE_TIME64_COMPAT32 is defined to 0, then the 64bit part of both headers is identical from sysdeps/unix/sysv/linux/s390/bits/utmpx.h to sysdeps/gnu/bits/utmpx.h -> On s390-64, __WORDSIZE_TIME64_COMPAT32 is defined to 0, then the 64bit part of both headers is identical from sysdeps/unix/sysv/linux/s390/bits/timesize.h to bits/timesize.h -> __TIMESIZE is defined to 64 in both cases from sysdeps/unix/sysv/linux/s390/bits/procfs-id.h to sysdeps/unix/sysv/linux/bits/procfs-id.h -> The typedefs for __pr_uid_t and __pr_gid_t on s390-64 are equal in both files. No need for an extra s390-specific header file anymore. from sysdeps/unix/sysv/linux/s390/bits/procfs-extra.h to sysdeps/unix/sysv/linux/bits/procfs-extra.h -> Get rid of the "32-bit variants so that BFD can read 32-bit core files." Furthermore it turned out that there is a hardcoded implementation independent of procfs-extra.h in /bfd/elf32-s390.c: elf_s390_grok_prstatus(), elf_s390_grok_psinfo(). Reviewed-by: Adhemerval Zanella commit b01debcd8f5229860b3224ea135b1b8456281cee Author: Stefan Liebler Date: Thu Apr 9 10:47:07 2026 +0200 s390: Remove s390-32 specific code in non s390-32 specific files This patch removes s390-32 specific code in either common-code files or shared files between s390-64 and s390-32. Such code was guarded with preprocessor guards which check the size of __WORDSIZE or __ELF_NATIVE_CLASS and of course the existance of __s390x__ and __s390__ macros. Note, that if __s390x__ is defined then __s390__ is also defined. This patch also adjust guards for __s390__ only to __s390x__ to make clear that those are still needed. Futhermore the macro names for ifunc variants were adjusted from XYZ_Z900_G5 to XYZ_Z900 as G5 is a pre 64bit machine. On s390-32 we've used the special assembler directive to enable zarch instructions: .machinemode "zarch_nohighgprs" As this is not needed on s390-64 anymore as zarch is enabled by default, just drop those lines. Furthermore we do not check for HWCAP_S390_ZARCH and HWCAP_S390_HIGH_GPRS anymore. Just simplify those checks for e.g. stfle- or cuXY-instructions. The 32/64 abi-variants and the corresponding abi-conditions are now also removed from the s390 Makefiles and thus we now only generate a single gnu/stubs.h and gnu/lib-names.h file instead of also having the different ones for both abi-variants. After removing process_elf32_file in s390 readelflib.c, ldconfig is only recognizing 64bit ELF files for ld.so.cache. Various comments mentioning s390 (with meaning s390-32) were removed/adjusted. Reviewed-by: Adhemerval Zanella commit 3d7ad79969aae201c072e7457738afee5868e5fa Author: Stefan Liebler Date: Thu Apr 9 10:47:06 2026 +0200 s390: Remove support for s390-32. The linux 6.19 release has removed support for compat syscalls on s390x. Therefore s390-linux-gnu (31bit) configuration was deprecated with glibc 2.43: commit 638d437dbf9c68e40986edaa9b0d1c2e72a1ae81 "Deprecate s390-linux-gnu (31bit)" While deprecation, the build-many-glibcs.py script has already removed s390 (31bit). Now explicitely exit with an error in sysdeps/s390/preconfigure if somebody tries to build glibc for s390 (31bit). Furthermore all s390-32 specific files are removed. Reviewed-by: Adhemerval Zanella commit bb5c2cc2ebefc960fe389dd2e4619042e8ca6078 Author: WANG Rui Date: Mon Apr 20 10:54:13 2026 +0000 elf: Add test for THP alignment of large load segments Add a new test to verify that large executable PT_LOAD segments are mapped at addresses aligned to the THP size when the glibc tunable glibc.elf.thp=1 is enabled and the system is configured to use THP in "always" mode. The test loads a shared object with a sufficiently large executable segment via dlopen and inspects /proc/self/maps to check that the mapping address is aligned to the THP page size reported by the kernel. The test is skipped if the THP size cannot be determined or if THP is not enabled in "always" mode. Signed-off-by: WANG Rui Reviewed-by: Wilco Dijkstra  commit 12df33b81e6797da79836a166daab018f0de08f7 Author: mengqinggang Date: Mon Mar 23 15:16:57 2026 +0800 Fix 'cbaud_to_speed' defined but not used on LA32 cbaud_to_speed defined without condition, but used if TEST_COMPAT (libc, GLIBC_2_0, GLIBC_2_42) If the condition is not met, a defined but not used warning will be issued. Define cbaud_to_speed if TEST_COMPAT (libc, GLIBC_2_0, GLIBC_2_42) is true. Reviewed-by: Adhemerval Zanella commit 0664c8e276120a241d89e4ff65bdcb971cda2a08 Author: Carlos O'Donell Date: Fri Apr 17 18:17:14 2026 -0400 localedata: Consistently use one space after 'category' Follow up to 7202604656071f778011e5c745ceb02ce941cb4b to make the category format consistent with all other locales. commit 7202604656071f778011e5c745ceb02ce941cb4b Author: Garccez Date: Thu Apr 16 23:21:52 2026 -0300 localedata: Add Hunsrickisch locale for Brazil (hrx_BR) Signed-off-by: Garccez Reviewed-by: Carlos O'Donell commit af73752b981a4dddf79e1b49f32aaf957d85a627 Author: Garccez Date: Thu Apr 16 23:21:51 2026 -0300 locale: Define Hunsrik (hrx) in iso-639.def Signed-off-by: Garccez Reviewed-by: Carlos O'Donell commit 76fabd4141b5d0fe5612b925b8bf97a7502aea4f Author: Carlos O'Donell Date: Fri Apr 17 17:12:48 2026 -0400 advisories: Update GLIBC-SA-2026-0007. Update NEWS to include GLIBC-SA-2026-0007. commit 1d10f6cd6df37bd820f1eb225eb658fd1cd4a480 Author: Carlos O'Donell Date: Tue Apr 14 13:59:39 2026 -0400 ga_IE: Add DCO header. Commit 96e91d9e3cdde3de58d3a2b712952429643dee55 was under DCO. commit d6f08d1cf027f4eb2ba289a6cc66853722d4badc Author: Florian Weimer Date: Thu Apr 16 19:13:43 2026 +0200 Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046) Follow the example in iso-2022-jp-3.c and use the __count state variable to store the pending character. This avoids restarting the conversion if the output buffer ends between two 4-byte UCS-4 code points, so that the assert reported in the bug can no longer happen. Even though the fix is applied to ibm1364.c, the change is only effective for the two HAS_COMBINED codecs for IBM1390, IBM1399. The test case was mostly auto-generated using claude-4.6-opus-high-thinking, and composer-2-fast shows up in the log as well. During review, gpt-5.4-xhigh flagged that the original version of the test case was not exercising the new character flush logic. This fixes bug 33980. Assisted-by: LLM Reviewed-by: Carlos O'Donell commit ef044cc6d79c5646b521569417da890154ea1813 Author: WANG Rui Date: Tue Apr 14 15:26:58 2026 +0000 loongarch: Enable THP-aligned load segments by default on 64-bit On LoongArch64 Linux, aligning ELF load segments to Transparent Huge Page (THP) boundaries provides consistent performance benefits for large binaries by reducing TLB pressure and improving instruction fetch efficiency. Enable THP-based load segment alignment by default on LoongArch64 by setting `glibc.elf.thp=1` during startup. Define the default THP page size for load segment alignment on LoongArch64 as 32MB. This allows the dynamic loader to apply THP-friendly alignment without requiring the `glibc.elf.thp` tunable to be explicitly set. Benchmarks Machine: Loongson 3A6000 (LoongArch64) Kernel: 6.18.13 CONFIG_READ_ONLY_THP_FOR_FS=y CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y Workload 1: building Cargo 1.93.0 Rustc: nightly-2026-02-26 Without patch With patch instructions 3,690,358,948,176 3,690,301,774,568 cpu-cycles 4,233,025,766,760 4,035,866,635,741 itlb-misses 9,708,829,532 2,700,014,717 time elapsed 302.40 s 289.68 s Instructions remain essentially unchanged. iTLB misses drop by about 72%, reducing CPU cycles by about 4.7% and wall time by about 4.2%. Workload 2: building Linux kernel v7.0-rc1 LLVM: 21.1.8 Without patch With patch instructions 14,163,739,876,387 14,169,418,598,675 cpu-cycles 19,231,890,317,741 16,851,494,928,181 itlb-misses 91,142,010,440 90,779,245 time elapsed 1022.09 s 893.22 s Instructions remain roughly the same. iTLB misses drop from about 91B to about 90M (roughly 99.9% reduction), reducing CPU cycles by about 12% and wall time by about 12.6%. Reviewed-by: caiyinyu Signed-off-by: WANG Rui commit 2f9fc3fba6562c888204159c09d654cb3499e38b Author: WANG Rui Date: Tue Apr 14 15:24:39 2026 +0000 elf: Align large load segments to PMD huge page size for THP Mapping segments that are at least the size of a PMD huge page to huge-page-aligned addresses helps make them eligible for Transparent Huge Pages (THP). This patch introduces a Linux-specific helper, `_dl_map_segment_align`, to determine an appropriate maximum alignment for ELF load segments based on the system THP policy. The optimization is enabled only when the glibc tunable `glibc.elf.thp=1` is set and THP is configured to be used unconditionally. The optimization depends on Linux kernel support for file-backed THP, specifically: * `CONFIG_READ_ONLY_THP_FOR_FS` (available since Linux kernel 5.4), and * `CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS`. When enabled, the helper queries the default THP page size and uses it to align sufficiently large load segments that are already properly aligned in both virtual address and file offset (e.g., zero). For eligible segments, the alignment is bumped to the THP page size, which improves THP eligibility, reduces TLB pressure, and improves performance for large objects. To avoid excessive address space padding on systems with very large THP sizes, the alignment is capped at 32MB. The optimization is applied only to non-writable segments, matching typical THP usage. Signed-off-by: WANG Rui Reviewed-by: Wilco Dijkstra commit f9933bf832d4ea4bb1b21db435e61324c05b7b10 Author: WANG Rui Date: Tue Apr 14 15:17:46 2026 +0000 tunables: Add glibc.elf.thp tunable for THP-aware segment alignment Introduce a new tunable, `glibc.elf.thp`, to control Transparent Huge Page (THP) aware alignment of ELF loadable segments. When set to `1`, the dynamic loader will attempt to align sufficiently large `PT_LOAD` segments to the PMD huge page size when mapping them. This increases the likelihood that the kernel backs these mappings with Transparent Huge Pages. The default value is `0`, which preserves the traditional page-sized alignment and keeps existing behavior unchanged. On systems without THP support, or when THP is disabled in the kernel, enabling this tunable has no effect. Reviewed-by: Wilco Dijkstra Signed-off-by: WANG Rui commit 88c3f481de92808499464fa7e2ac1e9fce9d649c Author: WANG Rui Date: Tue Apr 14 15:16:07 2026 +0000 elf: Introduce _dl_map_segment_align hook for segment alignment tuning Introduce a new helper function, _dl_map_segment_align, to allow architecture-specific adjustment of ELF load segment alignment during object mapping. The generic ELF loader now calls this hook when determining the maximum segment alignment. The generic implementation is a no-op and preserves existing behavior. This provides a well-defined extension point for architectures that need to adjust segment alignment policies (for example, to improve mapping efficiency or enable platform-specific optimizations) without embedding such logic directly in the generic loader. Reviewed-by: Wilco Dijkstra Signed-off-by: WANG Rui commit 6696ad38796586e1cf0ea9e9acaafae5cebce559 Author: WANG Rui Date: Tue Apr 14 15:14:33 2026 +0000 elf: Remove redundant _dl_map_segments declaration from dl-load.h The function `_dl_map_segments` is defined in ``, which provides the canonical implementation (optionally overridden by sysdeps variants). All call sites include `` directly, so declaring `_dl_map_segments` in `dl-load.h` is unnecessary. Keeping a static prototype in `dl-load.h` can trigger -Wunused-function errors when the header is included by translation units that do not include `` and do not reference `_dl_map_segments`. Since glibc builds with `-Werror`, this results in build failures [1]. Remove the redundant declaration from `dl-load.h` to avoid these spurious warnings and keep the declaration colocated with the definition as intended. [1] https://ci.linaro.org/job/tcwg_glibc_build--master-aarch64-precommit/4624/artifact/artifacts/artifacts.precommit/notify/mail-body.txt Reviewed-by: Wilco Dijkstra Signed-off-by: WANG Rui commit 0d6295e2034a2bbfa4a5f0f52d2fe8eed677c80b Author: Samuel Thibault Date: Thu Apr 16 01:24:11 2026 +0200 mach: Fix tst-default-domain link It links nisdomain.os directly, which uses __libc_lock_lock, thus __gsync_wait from libmachuser commit fd156a609c37253062d5830aa55f21044df8ff21 Author: H.J. Lu Date: Fri Apr 10 12:14:39 2026 +0800 elf: Remove _dl_process_pt_note _dl_map_object_from_fd and rtld_setup_main_map have for (ph = &l->l_phdr[l->l_phnum]; ph != l->l_phdr; --ph) switch (ph[-1].p_type) { case PT_NOTE: _dl_process_pt_note (l, fd, &ph[-1]); break; case PT_GNU_PROPERTY: _dl_process_pt_gnu_property (l, fd, &ph[-1]); break; } _dl_process_pt_note is empty, except for sysdeps/x86/dl-prop.h: static inline void __attribute__ ((unused)) _dl_process_pt_note (struct link_map *l, int fd, const ElfW(Phdr) *ph) { const ElfW(Nhdr) *note = (const void *) (ph->p_vaddr + l->l_addr); _dl_process_property_note (l, note, ph->p_memsz, ph->p_align); } Since all current CET enabled binaries have PT_GNU_PROPERTY, we can drop _dl_process_pt_note. This fixes BZ #34064. Signed-off-by: H.J. Lu Reviewed-by: Adhemerval Zanella commit 04531a789b24bae8fe5cb90a0173b5a414e22e84 Author: Michael Kelly Date: Wed Apr 15 19:03:09 2026 +0100 hurd: __adjtime() to support NULL delta whilst returning olddelta. This is required to obtain the remaining time of day adjustment without altering the required adjustment. Message-ID: <20260415180318.109742-4-mike@weatherwax.co.uk> commit e1ca9dea05d879c69cc9772253382f77efe627ef Author: Michael Kelly Date: Wed Apr 15 22:18:52 2026 +0200 hurd: __adjtime(): struct timeval and time_value_t are not identical. 'struct timeval' and 'struct time_value' have different types for the microseconds component: int and long int. Casting one to the other leads to negative numbers not being preserved properly within the called code. Message-ID: <20260415180318.109742-3-mike@weatherwax.co.uk> commit 4821a3e0bc867bb8a75a9621f6ec3ca4c5e01b43 Author: Michael Kelly Date: Wed Apr 15 22:15:39 2026 +0200 hurd: Make adjtime reject out-of-range tv_usec values commit 02d9614158a491dbaf9450572d652884cf34a719 Author: Wilco Dijkstra Date: Mon Apr 13 12:52:36 2026 +0000 malloc: Remove unused aliases for malloc symbols Malloc defines a lot of aliases which are unused, not exported and not needed. Reviewed-by: H.J. Lu Reviewed-by: DJ Delorie commit 263efd544542c8fd991d8b483d69da5ca60b3181 Author: Samuel Thibault Date: Wed Apr 15 00:39:16 2026 +0200 hurd: Fix looking up /dev/tty/ (BZ 34070) We need to keep the heading / to properly get an ENOTDIR, and set file_name rather than change the retryname content. Also, *result is normally used for the startdir. commit f85ca9fbda500c3ff8934f38e815a5deceff177f Author: Carlos O'Donell Date: Tue Apr 14 13:32:42 2026 -0400 localedata: Consistently use one space after 'category' Consistently use one space after catgory keyword in all 352 locales. We adjust gen_unicode_ctype.py to emit the same format for i18n_ctype. This makes the files more consistent for command line tooling to manipulate. commit 96e91d9e3cdde3de58d3a2b712952429643dee55 Author: Charlotte Mcmenamin Date: Sat Apr 11 00:14:03 2026 +0100 Fix Irish date format. The locales en_GB and en_IE use a date format of "%d//%m//%y", as this is the most common shorthand format in both countries. However the ga_IE locale does not conform to this. The format "%d.%m.%y" is not commonly used in either the ROI or the UK, and the forward-slash separator is the most common in both languages when used in both countries. This can be verified by checking the CLDR data for Irish: https://www.unicode.org/cldr/charts/48/verify/dates/ga.html Signed-off-by: Charlotte Mcmenamin Reviewed-by: Carlos O'Donell commit d8997716a1ca22cf038eac86ed286830ba9818cc Author: DJ Delorie Date: Wed Apr 1 17:52:25 2026 -0400 nss: fix __get_default_domain logic Fix logic bug in __nss_get_default_domain that prevents proper initialization. Because this function is not exposed, the test case must link against the object directly. Bug origin commit: 64d1e08ea822bf47cb2796ad0f727136227f983c Co-authored-by: Florian Weimer Reviewed-by: Frédéric Bérat commit ee5d1db2a81468413fbf7c82779ffa782f429d1a Author: H.J. Lu Date: Mon Apr 13 10:46:42 2026 +0800 abilist.awk: Handle weak unversioned defined symbols After commit f685e3953f9a38a41bbd0a597f9882870cee13d5 Author: H.J. Lu Date: Wed Oct 29 09:49:57 2025 +0800 elf: Don't set its DT_VERSYM entry for unversioned symbol ld no longer assigns version index 1 to unversioned defined symbol. For libmachuser.so, "objdump --dynamic-syms" reports: 0000dd30 w DF .text 000000f8 processor_start instead of 0000dd30 w DF .text 000000f8 (Base) processor_start Also allow NF == 6 for weak unversioned dynamic symbols. This fixes BZ 33650. Signed-off-by: H.J. Lu Reviewed-by: Sam James commit 39f9e193ab907fa87b1933491b0d9d7395ef4217 Author: H.J. Lu Date: Sun Apr 12 20:35:58 2026 +0800 sysdeps/unix/sysv/linux: Sort and put one test per line Sort and put one test per line in sysdeps/unix/sysv/linux/Makefile. Signed-off-by: H.J. Lu Reviewed-by: Sam James commit dfb150f3aadd93118a78ef9e19c2663f0e1994b7 Author: Adhemerval Zanella Date: Mon Mar 9 17:11:12 2026 -0300 math: Add fast-path to fma For normal numbers there is no need to issue scalbn, the fma can set the exponend directly. Performance-wise on x86_64-linux-gnu without multi-arch it shows a latency improvement of ~5% and throughput of %7 (and sligth more for ABIs witht tail-call optimization). Checked on x86_64-linux-gnu and i686-linux-gnu with --disable-multi-arch. Reviewed-by: Wilco Dijkstra commit 7594b4e5a75d41e891782aa7e3fb51924f6840cb Author: Lucas Chollet Date: Wed Apr 1 14:21:39 2026 +0200 posix: Add POSIX aliases to some spawn functions Both `posix_spawn_file_actions_add{,f}chdir` functions are now fully defined by POSIX-2024, this patch adds both functions as aliases of the already existing `posix_spawn_file_actions_add{,f}chdir_np` GNU extensions. This makes glibc more compliant in regards to POSIX-2024. Signed-off-by: Lucas Chollet Reviewed-by: Adhemerval Zanella commit a7fc50a5407d119014aa5660f5d1c299ac231148 Author: Rocket Ma Date: Wed Apr 1 01:09:59 2026 -0700 manual: update recent malloc tunable defaults manual/tunables.texi: update glibc.malloc.tcache_count to 16, in sync with source code; fix a typo in glibc.mem.decorate_maps tunable Signed-off-by: Rocket Ma Reviewed-by: Adhemerval Zanella commit cd1b1c1035171c9281922acc9670a7a50415f71e Author: Xiang Gao Date: Thu Apr 2 14:25:44 2026 +0800 libio: Fix wide stream backup buffer leak on fclose [BZ #33999] This patch fixes a memory leak when ungetwc is used on a wide oriented stream. The backup buffer was never freed on fclose, causing a memory leak per ungetwc/fclose call. The leak has two causes: In iofclose.c, for wide streams (fp->mode > 0), _IO_new_fclose never calls _IO_free_wbackup_area. Fixed by adding the missing call. In wgenops.c, _IO_wdefault_finish checks fp->_IO_save_base (the narrow field, always NULL for wide streams) instead of fp->_wide_data->_IO_save_base, and uses a bare free() that leaves _IO_save_end and _IO_backup_base dangling. Replace the hand-rolled cleanup with _IO_have_wbackup/_IO_free_wbackup_area, which handles backup-mode switching and clears all three pointers. This was independently reported by Rocket Ma [1], whose patch corrects the condition but still uses the manual free path. Apply the same _IO_have_backup condition in genops.c for consistency. Tested by: make test t=libio/tst-wbackup-leak [1] https://patchwork.sourceware.org/project/glibc/patch/20260323171742.1039768-1-marocketbd@gmail.com/ Signed-off-by: Xiang Gao commit 75d3fd11fdd4f0aec8e5632d51a693b53f95038e Author: WANG Rui Date: Tue Apr 7 14:04:28 2026 +0000 hugepages: Move THP helpers to generic hugepages abstraction The helpers for determining the default transparent huge page size and THP mode are currently implemented in malloc-hugepages. However, these interfaces are not malloc-specific and are also needed by other subsystems (e.g. the dynamic loader for segment alignment). Introduce a new generic hugepages abstraction and move the THP mode detection, default THP page size probing, and hugepage configuration helpers there. The malloc code now calls into the generic helpers instead of duplicating the sysfs parsing. There is no functional change. This is a pure refactoring to make the THP detection reusable outside of malloc. Reviewed-by: Wilco Dijkstra Signed-off-by: WANG Rui commit 1b2f868fb4958fd59875695c1828d9804b116dc2 Author: Florian Weimer Date: Tue Apr 7 10:49:13 2026 +0200 resolv: Run tst-getaddrinfo-eai-again in a network namespace This ensures that the test does not accidentally use a name server running on 127.0.0.1. Tested-by: Frédéric Bérat Reviewed-by: Frédéric Bérat commit 4ffc76bb0eba8a46a45a1a98811d769d0ca8627a Author: Samuel Thibault Date: Mon Apr 6 04:03:38 2026 +0200 htl: Fix SEM_FAILED type commit 99303f387179332d64e5ee34a6b58e82a523bae5 Author: Adhemerval Zanella Date: Mon Feb 16 18:15:45 2026 +0000 io: Use gnulib fts implementation (BZ 22944, BZ 20331) This patch synchronizes the glibc fts implementation with the latest version from gnulib (as of 2026-02-16). The primary motivation is to address limitations in the legacy glibc implementation, most notably BZ 22944, where fts fails with an ENAMETOOLONG error when traversing very long paths or deeply nested directory trees. The gnulib implementation dynamically reallocates path buffers and uses openat/fchdir optimizations, effectively lifting the MAXPATHLEN limitation. The gnulib implementation also added extra features, which are used by different GNU projects (coreutils, diffutils): * FTS_TIGHT_CYCLE_CHECK: used to enable a strict, immediate cycle-detection algorithm during a file system traversal. This is done internally using a hash table: every time the traversal enters a directory, it records the directory's device and inode (dev/ino) pair in the hash table, and before entering any directory, fts checks the hash table. * FTS_CWDFD: instead of actually changing the process's current working directory, it maintains a virtual current working directory using file descriptors. The file descriptor is store at the fts_cwd_fd field and all subsequent file operations are performed relative to this file descriptor using *at functions. * FTS_DEFER_STAT: performance-oriented flag that instructs the file tree traversal engine to delay fetching file metadata. When the flag is used, fts skips the immediate stat call. Instead, it marks the entry with a special internal state (FTS_NSOK and FTS_STAT_REQUIRED). The actual stat call is pushed down the line and executed by fts_read right before the application actually accesses the entry. * FTS_VERBATIM: fts_open accept and use the path strings exactly as they were provided in the arguments array without slash trimming. * FTS_MOUNT: it restrict the file tree walk to a single file system. Hopefully,it would allow some GNU projects to use the glibc implementation instead of pulling the gnulib one. It requires some changes to keep compatibility, compared to gnulib: * The new required fields are added at the end of FTS structure, and the new FTS flags are adjusted to avoid change FTS_NAMEONLY/FTS_STOP (even though they are marked as private). * The FTSENT uses a flexible array (fts_name), so two adjustments are required: the two new members (fts_fts and fts_dirp) are place *before* the struct and the fts_statp is now always allocated and accounted (the gnulib implementation uses an alwyas allocated member). Checked on x86_64-linux-gnu and i686-linux-gnu. commit 4adae8550a7a70383f5cee0527ee914a09409d39 Author: Adhemerval Zanella Date: Tue Mar 31 13:41:08 2026 -0300 stdlib: Add internal stdc_rotate_right implementation It follows the C2y N3367 proposed interface, along with some tests imported from gnulib (and adapted to glibc libsupport). Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: Collin Funk commit 49ed3efdd38e7744d458ea2b1965587d7635a449 Author: Wilco Dijkstra Date: Thu Mar 12 14:10:11 2026 +0000 AArch64: Remove unused MIDR entries Remove the now unused eMAG MIDR check and unused entries from cpu_list[]. Reviewed-by: Adhemerval Zanella  commit d43c0b008eb04208403421f3a40752b2c55b650b Author: Wilco Dijkstra Date: Thu Mar 12 14:09:49 2026 +0000 AArch64: Remove eMAG memset ifunc As a cleanup remove the eMAG ifunc for memset. Reviewed-by: Adhemerval Zanella  commit 87083d062a80f7d4a24f80148dd7bc139a9c16d1 Author: Wilco Dijkstra Date: Thu Mar 12 14:08:10 2026 +0000 AArch64: Remove eMAG memchr ifunc As a cleanup remove the eMAG ifunc for memchr. Reviewed-by: JiangNing OS commit 2ff134eb634098ae62ae1ebc02209c88298f0da2 Author: Mike Kelly Date: Wed Apr 1 20:49:33 2026 +0100 hurd: Interrupted RPC returning EINTR when server has actually changed state. An interrupted RPC call can return EINTR whilst the RPC is still in progress on the server. Some RPC calls have permanent consequences (eg. a write() to append data to a file) but a caller seeing EINTR should expect that no state has changed. The signal thread now stores the server's reply (which it already waited for) as the interrupted thread's reply. Message-ID: <20260401194948.90428-3-mike@weatherwax.co.uk> commit 4932f9d1fcc0b3375b8ea39c8dc7abc542932f56 Author: Mike Kelly Date: Wed Apr 1 20:49:32 2026 +0100 hurd: alterations to MSG_EXAMINE interface (intr-msg.h) MSG_EXAMINE has been broadened to allow the signal thread (for example) to access additional arguments that are passed to interruptible RPCs in other threads. All architecture specific variants of intr-msg.h now comply with the revised interface and the single user of MSG_EXAMINE (report-wait.c) adjusted accordingly. Message-ID: <20260401194948.90428-2-mike@weatherwax.co.uk> commit e87c151130216f5c62f0e172e3eaebbc4a5d794a Author: Wilco Dijkstra Date: Wed Apr 1 12:15:21 2026 +0000 malloc: Show hugetlb tunable default in --list-tunables Update the hugetlb tunable default in elf/dl-tunables.c so it is shown as 1 with /lib/ld-linux-aarch64.so.1 --list-tunables. Move the intitialization of thp_mode/thp_pagesize to do_set_hugetlb() and avoid accessing /sys/kernel/mm if DEFAULT_THP_PAGESIZE > 0. Switch off THP if glibc.malloc.hugetlb=0 is used - this behaves as if DEFAULT_THP_PAGESIZE==0. Fix the --list-tunables testcase. Reviewed-by: DJ Delorie commit 418581126ac40ca18e381c990e0a2768aec21c51 Author: Adhemerval Zanella Date: Tue Feb 24 10:59:54 2026 -0300 io: ftw: Use state stack instead of recursion (BZ 33882) The current implementation of ftw relies on recursion to traverse directories (ftw_dir calls process_entry, which calls ftw_dir). In deep directory trees, this could lead to a stack overflow (as demonstrated by the new tst-nftw-bz33882.c test). This patch refactors ftw to use an explicit, heap-allocated stack to manage directory traversal: * The 'struct ftw_frame' encapsulates the state of a single directory level (directory stream, stat buffer, previous base offset, and current state). * The ftw_dir is rewritten to use a loop instead of recursion and an iterative loop to enable immediate state transitions without function call overhead. The patch also cleans up some unused definitions and assumptions (e.g., free-clobbering errno) and fixes a UB when handling the ftw callback. Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: DJ Delorie commit 996885ecd8bb6e0ee62fb261cdddbc6757006808 Author: Adhemerval Zanella Date: Mon Mar 30 13:30:17 2026 -0300 math: Sync sinh from CORE-MATH The CORE-MATH e756933f improved the error bound in the fast path for x_0 <= x < 1/4, along with a formal proof [1]. Checked on x86_64-linux-gnu, i686-linux-gnu, aaarch64-linux-gnu, and arm-linux-gnueabihf. [1] https://core-math.gitlabpages.inria.fr/sinh.pdf commit 7cc1f7683ba87a5f7f64900df9e62b495c83ac07 Author: Xi Ruoyao Date: Thu Mar 26 18:54:08 2026 +0800 testsuite: fix test-narrowing-trap failure on platforms where FE_INVALID is not defined I didn't realize it can be undefined at all instead of simply unsupported :(. Signed-off-by: Xi Ruoyao Reviewed-by: Adhemerval Zanella commit 4b73af327e98c23d04938301ec2d5583ea9e696c Author: Siddhesh Poyarekar Date: Mon Mar 30 13:26:16 2026 -0400 Document CVE-2026-4046 Signed-off-by: Siddhesh Poyarekar commit cd5fda114ece002945ace3d54a8f80a4f67d1fbb Author: Sajan Karumanchi Date: Thu Mar 26 09:21:30 2026 +0000 x86_64: Prefer EVEX512 code-path on AMD Zen5 CPUs Introduced a synthetic architecture preference flag (Prefer_EVEX512) and enabled it for AMD Zen5 (CPUID Family 0x1A) when AVX-512 is supported. This flag modifies IFUNC dispatch to prefer 512-bit EVEX variants over 256-bit EVEX variants for string and memory functions on Zen5 processors, leveraging their native 512-bit execution units for improved throughput. When Prefer_EVEX512 is set, the dispatcher selects evex512 implementations; otherwise, it falls back to evex (256-bit) variants. The implementation updates the IFUNC selection logic in ifunc-avx2.h and ifunc-evex.h to check for the Prefer_EVEX512 flag before dispatching to EVEX512 implementations. This change affects six string/memory functions: - strchr - strlen - strnlen - strrchr - strchrnul - memchr Benchmarks conducted on AMD Zen5 hardware demonstrate significant performance improvements across all affected functions: Function Baseline Patched Avg Avg Avg Max Variant Variant Baseline Patched Change Improve (ns) (ns) % % ------------+----------+----------+-----------+----------+--------+-------- STRCHR evex evex512 16.408 12.293 25.08% 37.69% STRLEN evex evex512 16.862 11.436 32.18% 56.74% STRNLEN evex evex512 18.493 11.762 36.40% 64.40% STRRCHR evex evex512 15.154 10.874 28.24% 44.38% STRCHRNUL evex evex512 16.464 12.605 23.44% 45.56% MEMCHR evex evex512 9.984 8.268 17.19% 39.99% Additionally, a tunable option (glibc.cpu.x86_cpu_features.preferred) is provided to allow runtime control of the Prefer_EVEX512 flag for testing and compatibility. Reviewed-by: Ganesh Gopalasubramanian Reviewed-by: H.J. Lu commit 6abe432ec4aa1456151be8f9567c4d68f41d68f7 Author: Adhemerval Zanella Date: Fri Mar 27 14:02:30 2026 -0300 math: Fix lgammaf regression on i686 The new test from 19781c2221 triggers a failure on i686: testing float (without inline functions) Failure: lgamma (0x3.12be38p+120): errno set to 0, expected 34 (ERANGE) Failure: lgamma_upward (0x3.12be38p+120): errno set to 0, expected 34 (ERANGE) Use math_narrow_eval on the multiplication to force the expected precision. Checked on i686-linux-gnu. commit e6f161143bbb67312d74e19ba414367f50e7ba78 Author: Adhemerval Zanella Date: Fri Mar 27 13:57:51 2026 -0300 math: Use polydd_cosh instead of polydd on cosh This is similar to original CORE-MATH code and why the function exists. Checked on x86_64-linux-gnu, i686-linux-gnu, aarch64-linux-gnu, and arm-linux-gnueabihf. commit e0270d5e4122ed3b60bb304bd5e4ffe9cab546fb Author: Carlos O'Donell Date: Tue Mar 24 09:24:45 2026 -0400 localedata: Add disclaimer to files contributed with assignment Add the FSF's disclaimer to bi_VU, C, gbm_IN, hif_FJ, sah_RU, sm_WS, and to_TO which were created under copyright assignment (not DCO). This change ensures that all 352 localedata files have either the FSF disclaimer or the related DCO text we are using e.g. ab_GE. Link: https://inbox.sourceware.org/libc-alpha/80426eb7-70cd-4178-8fda-51d590aa38d4@redhat.com/ Link: https://inbox.sourceware.org/libc-alpha/20130220215701.B263F2C0A7@topped-with-meat.com/ Link: https://inbox.sourceware.org/libc-alpha/87pmtq54hs.fsf@oldenburg.str.redhat.com/ Reviewed-by: Collin Funk commit 2528b5d2e6f860a7d67efeb238168a179f930678 Author: Carlos O'Donell Date: Fri Mar 27 08:08:19 2026 -0400 advisories: Update GLIBC-SA-2026-0005 and GLIBC-SA-2026-0006. Update advisories with Fix-Commit information for 2.43.9000 and 2.44. Update NEWS with advisory entries. commit e10977481f4db4b2a3ce34fa4c3a1e26651ae312 Author: Carlos O'Donell Date: Fri Mar 20 17:14:33 2026 -0400 resolv: Check hostname for validity (CVE-2026-4438) The processed hostname in getanswer_ptr should be correctly checked to avoid invalid characters from being allowed, including shell metacharacters. It is a security issue to fail to check the returned hostname for validity. A regression test is added for invalid metacharacters and other cases of invalid or valid characters. No regressions on x86_64-linux-gnu. Reviewed-by: Adhemerval Zanella commit 4a97c1230227db346dcfcd4c6634f6245c9f7c7e Author: Florian Weimer Date: Wed Mar 25 10:44:13 2026 +0100 Use #!/usr/bin/python3 in remaining Python scripts Some distributions ban the /usr/bin/python path in their build systems due to the ambiguity of whether it refers to Python 2 or Python 3. Python 2 has been out of support for many years, and glibc has required Python 3 at build time for a while. So it seems safe to switch the remaining scripts over to /usr/bin/python3. Reviewed-by: Adhemerval Zanella commit 9091a473325459fcab1cb79341fd59f31f5f9def Author: mengqinggang Date: Mon Mar 23 15:28:23 2026 +0800 LoongArch: Add new files for LA32 in sysdeps/unix/sysv/linux/loongarch/ilp32 Add implies, abilist, c++-types and syscall files. commit ade878605da9c997911382ea43f202f5cc44953d Author: mengqinggang Date: Mon Mar 23 15:28:22 2026 +0800 LoongArch: Add support for LA32 in sysdeps/unix/sysv/linux/loongarch commit 706a2ca2ecf0c7a9508350ab565b7e0f524163fb Author: mengqinggang Date: Mon Mar 23 15:28:21 2026 +0800 LoongArch: Add new file for LA32 in sysdeps/loongarch/ilp32 commit e228970623bf3d4e09f54a1d6db61f90f651ec97 Author: mengqinggang Date: Mon Mar 23 15:28:20 2026 +0800 LoongArch: Add support for LA32 in sysdeps/loongarch/fpu Move the loongarch64 implementation to sysdeps/loongarch/lp64/fpu. commit 81e6ad75b07d45af275b971fd047add0c1b395da Author: mengqinggang Date: Mon Mar 23 15:28:19 2026 +0800 LoongArch: Add support for LA32 in sysdeps/loongarch commit 52746049154be156de6d500c7cc5bfdafc074cbe Author: Xi Ruoyao Date: Tue Mar 24 15:22:59 2026 +0800 LoongArch: fix missing trap for enabled exceptions on narrowing operation The libc_feupdateenv_test macro is supposed to trap when the trap for a previously held exception is enabled. But libc_feupdateenv_test_loongarch wasn't doing it properly: the comment claims "setting of the cause bits" would cause "the hardware to generate the exception" but that's simply not true for the LoongArch movgr2fcsr instruction. To fix the issue, we need to call __feraiseexcept in case a held exception is enabled to trap. Reviewed-by: caiyinyu Signed-off-by: Xi Ruoyao commit 47b306376cc273b9a35c7dd4e2f6eedcc3701661 Author: mengqinggang Date: Tue Mar 24 15:48:38 2026 +0800 nptl: Fix nptl/tst-cancel31 fail sometimes tst-cancel31 fail on la32 qemu-system with a single-core system sometimes. IF the test and a infinite loop run on a same x86_64 core, the test also fail sometimes. taskset -c 0 make test t=nptl/tst-cancel31 taskset -c 0 ./a.out (a.out is a infinite loop) After writeopener thread opens the file, it may switch to main thread and find redundant files. pthread_cancel and pthread_join writeopener thread before support_descriptors_check. Reviewed-by: Carlos O'Donell commit 9f5f18aab40ec6b61fa49a007615e6077e9a979b Author: Carlos O'Donell Date: Fri Mar 20 16:43:33 2026 -0400 resolv: Count records correctly (CVE-2026-4437) The answer section boundary was previously ignored, and the code in getanswer_ptr would iterate past the last resource record, but not beyond the end of the returned data. This could lead to subsequent data being interpreted as answer records, thus violating the DNS specification. Such resource records could be maliciously crafted and hidden from other tooling, but processed by the glibc stub resolver and acted upon by the application. While we trust the data returned by the configured recursive resolvers, we should not trust its format and should validate it as required. It is a security issue to incorrectly process the DNS protocol. A regression test is added for response section crossing. No regressions on x86_64-linux-gnu. Reviewed-by: Collin Funk commit eb1fb45c8b2309f23ed91e3225ce84ef963f8aea Author: Carlos O'Donell Date: Fri Mar 20 15:45:52 2026 -0400 Add advisory text for CVE-2026-4438 Explain the security issue and set the context for the vulnerability to help downstreams get a better understanding of the issue. Reviewed-by: Adhemerval Zanella commit e539926124a257435e79b190854a73a39d891889 Author: Carlos O'Donell Date: Fri Mar 20 15:44:33 2026 -0400 Add advisory text for CVE-2026-4437 Explain the security issue and set the context for the vulnerability to help downstreams get a better understanding of the issue. Reviewed-by: Collin Funk commit 8f326d6c179d74e2f8cb3a0db90bde7c1c94005b Author: Joseph Myers Date: Mon Mar 23 14:03:19 2026 +0000 Use binutils 2.46, MPC 1.4.0 in build-many-glibcs.py Note that MPC 1.4.0 has moved from .tar.gz to .tar.xz distribution. Tested with build-many-glibcs.py (host-libraries, compilers and glibcs builds). commit cd013efb933680917c418f19c95b37d6838cd6fb Author: Xi Ruoyao Date: Thu Mar 19 16:33:22 2026 +0800 LoongArch: feclearexcept: skip clearing CAUSE The comment explaining the reason to clear CAUSE does not make any sense: it says the next "CTC" instruction would raise the FP exception of which both the CAUSE and ENABLE bits are set, but LoongArch does not have the CTC instruction. LoongArch has the movgr2fcsr instruction but movgr2fcsr never raises any FP exception, different from the MIPS CTC instruction. So we don't really need to care CAUSE at all. Signed-off-by: Xi Ruoyao commit 89edb2e8c6a711caf9832be723446566f0c1d3d2 Author: Adhemerval Zanella Netto Date: Sat Mar 21 08:11:06 2026 -0600 riscv: Resolve calls to memcpy using memcpy-generic in early startup This patch from Adhemerval sets up the ifunc redirections so that we resolve memcpy to memcpy_generic in early startup. This avoids infinite recursion for memcpy calls before the loader is fully initialized. Tested-by: Jeff Law commit a604d62daa90a72a1d77452b0052465c9eafbc14 Author: Zihong Yao Date: Fri Mar 20 16:43:08 2026 -0500 riscv: Treat clang separately in RVV compiler checks Detect clang explicitly and apply compiler-specific version checks for RVV support. Signed-off-by: Zihong Yao Reviewed-by: Peter Bergner commit 19781c22211c6db827eefc240cb6724b5512fc6b Author: Adhemerval Zanella Date: Fri Mar 20 17:17:19 2026 +0000 math: Fix spurious overflow and missing errno for lgammaf It syncs with CORE-MATH 9a75500ba1831 and 20d51f2ee. Checked on aarch64-linux-gnu. commit e8ece2e66b22201e3ece2f9ffb230321910fbedb Author: Yury Khrustalev Date: Fri Mar 20 12:34:57 2026 +0000 misc: Fix a few typos in comments commit e5ef7b3c850c6aa621aa0a0b36540571f647d730 Author: Adhemerval Zanella Date: Thu Mar 19 13:36:04 2026 -0300 math: Sync lgammaf with CORE-MATH It removes some unnecessary corner-case checks and uses a slightly different binary algorithm for the hard-case database binary search. Checked on aarch64-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, i686-linux-gnu, and x86_64-linux-gnu. commit d752bd63986bf5be359d75f4e268e0cd9b254e70 Author: Adhemerval Zanella Date: Thu Mar 19 13:31:10 2026 -0300 math: Sync tgammaf with CORE-MATH It adds a minor optimization on fast path. Checked on aarch64-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, i686-linux-gnu, and x86_64-linux-gnu. commit 5c28a3cf9f05481290509a27506d08734d1e7587 Author: Martin Coufal Date: Thu Mar 19 14:09:22 2026 +0100 Makefile: add allow-list for failures Enable adding known failures to allowed-failures.txt and ignore failures in case they are in the list. In case the allowed-failures.txt does not exist, all failures lead to a failed status as before. When the file is present, failures of listed tests are ignored and reported on stdout. If tests not in the allowed list fail, summarize-tests exits with status 1 and reports the failing tests. The expected format of allowed-failures.txt file is: # Reviewed-by: Florian Weimer commit d398b76bb8329fcd68a6f9f840a2f2a71d481a3a Author: Adhemerval Zanella Date: Mon Mar 2 16:07:34 2026 -0300 string: Add fallback implementation for ctz/clz The libgcc implementations of __builtin_clzl/__builtin_ctzl may require access to additional data that is not marked as hidden, which could introduce additional GOT indirection and necessitate RELATIVE relocs. And the RELATIVE reloc is an issue if the code is used during static-pie startup before self-relocation (for instance, during an assert). For this case, the ABI can add a string-bitops.h header that defines HAVE_BITOPTS_WORKING to 0. A configure check for this issue is tricky because it requires linking against the standard libraries, which create many RELATIVE relocations and complicate filtering those that might be created by the builtins. The fallback is disabled by default, so no target is affected. Reviewed-by: Wilco Dijkstra commit 057e7c9aa1578964712ed01e9f7e986412d9fe6c Author: Wilco Dijkstra Date: Mon Mar 16 14:24:32 2026 +0000 AArch64: Remove prefer_sve_ifuncs Remove the prefer_sve_ifuncs CPU feature since it was intended for older kernels. Current distros all use modern Linux kernels with improved support for SVE save/restore, making this check redundant. Reviewed-by: Yury Khrustalev commit 729fe686d1ab52a5edc618e2dbe06b31739219db Author: Dev Jain Date: Mon Mar 16 19:06:27 2026 +0000 This reverts commit 6e8f32d39a57aa1f31bf15375810aab79a0f5f4b. First off, apologies for my misunderstanding on how madvise(MADV_HUGEPAGE) works. I had the misconception that doing madvise(p, 1, MADV_HUGEPAGE) will set VM_HUGEPAGE on the entire VMA - it does not, it will align the size to PAGE_SIZE (4k) and then *split* the VMA. Only the first page-length of the virtual space will VM_HUGEPAGE'd, the rest of it will stay the same. The above is the semantics for all madvise() calls - which makes sense from a UABI perspective. madvise() should do the proposed thing to only the length (page-aligned) which it was asked to do, doing any more than that is not something the user is expecting. Commit 6e8f32d39a57 tries to optimize around the madvise() call by determining whether the VMA got madvise'd before. This will work for most cases except the following: if check_may_shrink_heap() is true, shrink_heap() re-maps the shrunk portion, giving us a new VMA altogether. That VMA won't have the VM_HUGEPAGE flag. Reverting this commit, we will again mark the new VMA with VM_HUGEPAGE, and the kernel will merge the two into a single VMA marked with VM_HUGEPAGE. This may be the only case where we lose VM_HUGEPAGE, and we could micro-optimize by extending the current if-condition with !check_may_shrink_heap. But let us not do this - this is very difficult to reason about, and I am soon going to propose mmap(MAP_HUGEPAGE) in Linux to do away with all these workarounds. Reviewed-by: Adhemerval Zanella  commit 68d9acdb615ee66d45ae5e3815f332276d28b8cd Author: DJ Delorie Date: Tue Feb 17 18:00:50 2026 -0500 elf: factor out ld.conf parsing Reviewed-by: Adhemerval Zanella Reviewed-by: Yury Khrustalev commit ebb12ffa3e895487dbd5cf9d19a858dadd29ef83 Author: Adhemerval Zanella Date: Thu Mar 12 11:21:12 2026 -0300 x86: Fix tanh ifunc selection The inclusion of generic tanh implementation without undefining the libm_alias_double (to provide the __tanh_sse2 implementation) makes the exported tanh symbol pointing to SSE2 variant. Reviewed-by: DJ Delorie commit c7a7bfe54e7d7cf6ff21114dacdeeb543c378dc2 Author: Adhemerval Zanella Date: Thu Mar 12 11:21:11 2026 -0300 x86_64: Add cosh with FMA The cosh shows an improvement of about ~35% when building for x86_64-v3. Reviewed-by: DJ Delorie commit f05c4907a273081833a5b6983492e4393dce4327 Author: Adhemerval Zanella Date: Thu Mar 12 11:21:10 2026 -0300 math: Consolidated common definition/data for cosh/sinh/tanh Common data definitions are moved to e_coshsinh_data, cosh only data is moved to e_cosh_data, sinh to e_sinh_data, and tanh to e_tanh_data. Reviewed-by: DJ Delorie commit e658f359352a27de8e9d5c4bcfdfaf48db25f391 Author: Adhemerval Zanella Date: Thu Mar 12 11:21:09 2026 -0300 math: Use tanh from CORE-MATH The current implementation precision shows the following accuracy, on three ranges ([-DBL_MAX,-10], [-10,10], [10,DBL_MAX]) with 10e9 uniform randomly generated numbers for each range (first column is the accuracy in ULP, with '0' being correctly rounded, second is the number of samples with the corresponding precision): * Range [-DBL_MAX, -10] * FE_TONEAREST 0: 10000000000 100.00% * FE_UPWARD 0: 10000000000 100.00% * FE_DOWNWARD 0: 10000000000 100.00% * FE_TOWARDZERO 0: 10000000000 100.00% * Range [-10, -10] * FE_TONEAREST 0: 4059325526 94.51% 1: 231023238 5.38% 2: 4618531 0.11% * FE_UPWARD 0: 2106654900 49.05% 1: 2145413180 49.95% 2: 40847554 0.95% 3: 2051661 0.05% * FE_DOWNWARD 0: 2106618401 49.05% 1: 2145409958 49.95% 2: 40880992 0.95% 3: 2057944 0.05% * FE_TOWARDZERO 0: 4061659952 94.57% 1: 221006985 5.15% 2: 12285512 0.29% 3: 14846 0.00% * Range [10, DBL_MAX] * FE_TONEAREST 0: 10000000000 100.00% * FE_UPWARD 0: 10000000000 100.00% * FE_DOWNWARD 0: 10000000000 100.00% * FE_TOWARDZERO 0: 10000000000 100.00% The CORE-MATH implementation is correctly rounded for any rounding mode. The code was adapted to glibc style and to use the definition of math_config.h (to handle errno, overflow, and underflow). Performance-wise, it shows: latency master patched improvement x86_64 109.7420 184.5950 -68.21% x86_64v2 109.1230 187.1890 -71.54% x86_64v3 99.4471 49.1104 50.62% aarch64 43.0474 32.2933 24.98% armhf-vpfv4 41.0954 35.8473 12.77% powerpc64le 27.3282 22.7134 16.89% reciprocal-throughput master patched improvement x86_64 42.5562 158.1820 -271.70% x86_64v2 42.5734 159.2560 -274.07% x86_64v3 35.9899 24.2877 32.52% aarch64 24.7660 22.8466 7.75% armhf-vpfv4 27.0251 25.8150 4.48% powerpc64le 11.7350 11.2504 4.13% * x86_64: gcc version 15.2.1 20260112, Ryzen 9 5900X, --disable-multi-arch * aarch64: gcc version 15.2.1 20251105, Neoverse-N1 * armv7a-vpfv4: gcc version 15.2.1 20251105, Neoverse-N1 * powerpc64le: gcc version 15.2.1 20260128, POWER10 Checked on x86_64-linux-gnu, aarch64-linux-gnu, and powerpc64le-linux-gnu. Reviewed-by: DJ Delorie commit a702a425d062503095d18444a672d9e0b9341e81 Author: Adhemerval Zanella Date: Thu Mar 12 11:21:08 2026 -0300 math: Remove the SVID error handling from sinh It improves throughput from 8 to 18% and latency from 1 to 10%, dependending of the ABI. Reviewed-by: DJ Delorie commit 106f8c2ed68a95724c3eb81785091f0d0d7b6374 Author: Adhemerval Zanella Date: Thu Mar 12 11:21:07 2026 -0300 math: Use sinh from CORE-MATH The current implementation precision shows the following accuracy, on three ranges ([-DBL_MAX,-10], [-10,10], [10,DBL_MAX]) with 10e9 uniform randomly generated numbers for each range (first column is the accuracy in ULP, with '0' being correctly rounded, second is the number of samples with the corresponding precision): * Range [-DBL_MAX, -10] * FE_TONEAREST 0: 10000000000 100.00% * FE_UPWARD 0: 10000000000 100.00% * FE_DOWNWARD 0: 10000000000 100.00% * FE_TOWARDZERO 0: 10000000000 100.00% * Range [-10, -10] * FE_TONEAREST 0: 3169388892 73.79% 1: 1125270674 26.20% 2: 307729 0.01% * FE_UPWARD 0: 1450068660 33.76% 1: 2146926394 49.99% 2: 697404986 16.24% 3: 567255 0.01% * FE_DOWNWARD 0: 1449727976 33.75% 1: 2146957381 49.99% 2: 697719649 16.25% 3: 562289 0.01% * FE_TOWARDZERO 0: 2519351889 58.66% 1: 1773434502 41.29% 2: 2180904 0.05% * Range [10, DBL_MAX] * FE_TONEAREST 0: 10000000000 100.00% * FE_UPWARD 0: 10000000000 100.00% * FE_DOWNWARD 0: 10000000000 100.00% * FE_TOWARDZERO 0: 10000000000 100.00% The CORE-MATH implementation is correctly rounded for any rounding mode. The code was adapted to glibc style and to use the definition of math_config.h (to handle errno, overflow, and underflow). Performance-wise, it shows: latency master patched improvement x86_64 101.0710 129.4710 -28.10% x86_64v2 101.1810 127.6370 -26.15% x86_64v3 96.0685 48.5911 49.42% aarch64 41.4229 22.3971 45.93% armhf-vpfv4 42.8620 25.6011 40.27% powerpc64le 29.2630 13.1450 55.08% reciprocal-throughput master patched improvement x86_64 42.6895 105.7150 -147.64% x86_64v2 42.7255 104.7480 -145.17% x86_64v3 39.6949 25.9087 34.73% aarch64 26.0104 19.2236 26.09% armhf-vpfv4 29.4362 23.6350 19.71% powerpc64le 12.9170 8.34582 35.39% * x86_64: gcc version 15.2.1 20260112, Ryzen 9 5900X, --disable-multi-arch * aarch64: gcc version 15.2.1 20251105, Neoverse-N1 * armv7a-vpfv4: gcc version 15.2.1 20251105, Neoverse-N1 * powerpc64le: gcc version 15.2.1 20260128, POWER10 Checked on x86_64-linux-gnu, aarch64-linux-gnu, and powerpc64le-linux-gnu. Reviewed-by: DJ Delorie commit 514129fad2afdb0453c1d26fe1e53a9690fe6594 Author: Adhemerval Zanella Date: Thu Mar 12 11:21:06 2026 -0300 math: Remove the SVID error handling from cosh It improves throughout from 3.5% to 9%. Reviewed-by: DJ Delorie commit 291fc87155d91c9faeac66e28f81ef2f50873d61 Author: Adhemerval Zanella Date: Thu Mar 12 11:21:05 2026 -0300 math: Use cosh from CORE-MATH The current implementation precision shows the following accuracy, on three ranges ([-DBL_MAX,-10], [-10,10], [10,DBL_MAX]) with 10e9 uniform randomly generated numbers for each range (first column is the accuracy in ULP, with '0' being correctly rounded, second is the number of samples with the corresponding precision): * Range [-DBL_MAX, -10] * FE_TONEAREST 0: 10000000000 100.00% * FE_UPWARD 0: 10000000000 100.00% * FE_DOWNWARD 0: 10000000000 100.00% * FE_TOWARDZERO 0: 10000000000 100.00% * Range [-10, -10] * FE_TONEAREST 0: 3291614060 76.64% 1: 1003353235 23.36% * FE_UPWARD 0: 2295272497 53.44% 1: 1999675198 46.56% 2: 19600 0.00% * FE_DOWNWARD 0: 2294966533 53.43% 1: 1999981461 46.57% 2: 19301 0.00% * FE_TOWARDZERO 0: 2306015780 53.69% 1: 1988942093 46.31% 2: 9422 0.00% * Range [10, DBL_MAX] * FE_TONEAREST 0: 10000000000 100.00% * FE_UPWARD 0: 10000000000 100.00% * FE_DOWNWARD 0: 10000000000 100.00% * FE_TOWARDZERO 0: 10000000000 100.00% The CORE-MATH implementation is correctly rounded for any rounding mode. The code was adapted to glibc style and to use the definition of math_config.h (to handle errno, overflow, and underflow). Performance-wise, it shows: latency master patched improvement x86_64 52.1066 126.4120 -142.60% x86_64v2 49.5781 119.8520 -141.74% x86_64v3 45.0811 50.5758 -12.19% aarch64 19.9977 21.7814 -8.92% armhf-vpfv4 20.5969 27.0479 -31.32% powerpc64le 12.6405 13.6768 -8.20% reciprocal-throughput master patched improvement x86_64 18.4833 102.9120 -456.78% x86_64v2 17.5409 99.5179 -467.35% x86_64v3 18.9187 25.3662 -34.08% aarch64 10.9045 18.8217 -72.60% armhf-vpfv4 15.7430 24.0822 -52.97% powerpc64le 5.4275 8.1269 -49.73% * x86_64: gcc version 15.2.1 20260112, Ryzen 9 5900X, --disable-multi-arch * aarch64: gcc version 15.2.1 20251105, Neoverse-N1 * armv7a-vpfv4: gcc version 15.2.1 20251105, Neoverse-N1 * powerpc64le: gcc version 15.2.1 20260128, POWER10 Checked on x86_64-linux-gnu, aarch64-linux-gnu, and powerpc64le-linux-gnu. Reviewed-by: DJ Delorie commit e0e34185e5d497f8d70d65e2d659c52c32361a9a Author: Samuel Thibault Date: Mon Mar 16 13:18:03 2026 +0100 nptl/htl: Add missing AC_PROVIDES commit d2298311af24bc599e17975846d040df66a97ccd Author: Samuel Thibault Date: Mon Mar 16 12:20:45 2026 +0100 nptl/htl: Fix confusion over PTHREAD_IN_LIBC and __PTHREAD_NPTL/HTL The last uses of PTHREAD_IN_LIBC is where it should have been __PTHREAD_NPTL/HTL. The latter was not conveniently available everywhere. Defining it from config.h makes things simpler. commit dd5ebf3ed84f230d1a9e6141619be0e617bd6bb5 Author: Samuel Thibault Date: Mon Mar 16 10:13:59 2026 +0100 nptl: Drop comment about PTHREAD_IN_LIBC nptl is now always in libc. commit f5ed4272da40cb87e1698bc0f810e43c9de35990 Author: Samuel Thibault Date: Sun Mar 15 21:50:02 2026 +0000 elf: directly call dl_init_static_tls htl can now have it directly in ld.so commit f6143a7848098a1d4fe4340dd6f375cf0cb9d2db Author: Samuel Thibault Date: Sun Mar 15 18:27:12 2026 +0100 resolv: Move libanl symbols to libc on hurd too commit 62d3f3a10f9b35bd08fa4b5b6b5239a50c96c82d Author: Samuel Thibault Date: Sun Mar 15 21:21:15 2026 +0100 elf: Drop librt.so from localplt-built-dso It's always empty now. commit 85a1155a02d83adf6cd84a29b673881eb665e9e6 Author: Samuel Thibault Date: Sat Mar 14 23:35:00 2026 +0000 rt: Move librt symbols to libc on hurd too commit 0608f46fc6a1eb8ce27180c270054fa9ff23e990 Author: Samuel Thibault Date: Sat Mar 14 21:00:12 2026 +0000 htl: Use pthread_rwlock for libc_rwlock Like nptl does, so we really get rwlock behavior. commit 5f11203d345fd4e0634689529dcbb21ab18939eb Author: Samuel Thibault Date: Sat Mar 14 17:59:08 2026 +0000 mach: Add __mach_rwlock_* We cannot use pthread_rwlock for these until we have reimplemented pthread_rwlock with gsync, so fork __libc_rwlock off for now. commit 9da7ad6d74700811c9b4c82b5f5eb555e39241a7 Author: Adhemerval Zanella Date: Fri Mar 13 11:25:59 2026 -0300 configure: Remove extra ')' from b4c110022c commit b4c110022ce44406d5c8d75a96d68d2949006050 Author: Adhemerval Zanella Date: Fri Mar 13 10:05:07 2026 -0300 configure: Fix bootstrap build after 570c46d36b (BZ 33985) The 570c46d36b make libgcc_s to be defined for have-cc-with-libunwind=noi (default for gcc builds) without taking into consideration that the compiler can link against -lgcc_s (defined by have-libgcc_s). Checked with a build-many-glibc.py for x86_64-linux-gnu. commit fe8b5b2c55f1001372161875b71918c895b79760 Author: Arjun Shankar Date: Wed Mar 4 12:36:04 2026 +0100 linux: Fix aliasing violations and assert address in __check_pf (bug #33927) The Linux implementation of __check_pf retrieves interface data via make_request, which queries the kernel via netlink. The IFA_ADDRESS received from the kernel's RTM_NEWADDR netlink message is (a) type-punned via pointer-casting leading to strict aliasing violations, and (b) dereferenced assuming that it is non-NULL. This commit removes the strict-aliasing violations using memcpy, and adds an assert that the address is indeed non-NULL before dereferencing it. Reported-by: Siteshwar Vashisht Reviewed-by: Sam James Reviewed-by: Adhemerval Zanella commit d3c8dce086ca59952904a0d244e5b3db7b42a7bd Author: Collin Funk Date: Wed Mar 11 21:57:20 2026 -0700 x86: Don't left shift negative values GCC warns about this with -Wshift-negative-value: In file included from ../sysdeps/x86/cpu-features.c:24: ../sysdeps/x86/dl-cacheinfo.h: In function ‘get_common_cache_info’: ../sysdeps/x86/dl-cacheinfo.h:913:45: warning: left shift of negative value [-Wshift-negative-value] 913 | count_mask = ~(-1 << (count_mask + 1)); | ^~ ../sysdeps/x86/dl-cacheinfo.h:930:45: warning: left shift of negative value [-Wshift-negative-value] 930 | count_mask = ~(-1 << (count_mask + 1)); | ^~ This is because C23 § 6.5.8 specifies that this is undefined behavior. We can cast it to unsigned which would be equivelent to UINT_MAX. Reviewed-by: H.J. Lu commit 5d89e7c47cc9d27475e086dedbeecc69be82aa74 Author: Adhemerval Zanella Date: Wed Feb 25 15:31:16 2026 -0300 Support loading libunwind instead of libgcc_s The 'unwind-link' facility allows glibc to support thread cancellation and exit (pthread_cancel, pthread_exiti, backtrace) by dynamically loading the unwind library at runtime, preventing a hard dependency on libgcc_s within libc.so. When building with libunwind (for clang/LLVM toolchains [1]), two assumptions in the existing code break: 1. The runtime library is libunwind.so instead of libgcc_s.so. 2. libgcc relies on __gcc_personality_v0 to handle unwinding mechanics. libunwind exposes the standard '_Unwind_*' accessors directly. This patch adapts `unwind-link` to handle both environments based on the HAVE_CC_WITH_LIBUNWIND configuration: * The UNWIND_SONAME macro now selects between LIBGCC_S_SO and LIBUNWIND_SO. * For libgcc, it continues to resolve `__gcc_personality_v0`. * For libunwind, it instead resolves the standard _Unwind_GetLanguageSpecificData, _Unwind_SetGR, _Unwind_SetIP, and _Unwind_GetRegionStart helpers. * unwind-resume.c is updated to implement wrappers for these accessors that forward calls to the dynamically loaded function pointers, effectively shimming the unwinder. Tests and Makefiles are updated to link against `$(libunwind)` where appropriate. Reviewed-by: Sam James [1] https://github.com/libunwind/libunwind commit 570c46d36bc9123597a601e500d9d7661d71247b Author: Adhemerval Zanella Date: Wed Feb 25 15:31:14 2026 -0300 configure: Repurpose have-cc-with-libunwind for clang support The `have-cc-with-libunwind` check (and its corresponding macro HAVE_CC_WITH_LIBUNWIND) was historically specific to IA64, intended to supplement libgcc with libunwind. Since this logic is unused in current GCC configurations, this patch repurposes it to support clang-based toolchains that utilize LLVM's libunwind instead of libgcc_s. The configure script now detects if the compiler natively supports unwinding via `-lunwind`. Additionally, when this mode is enabled, `-lclang_rt.builtins` is explicitly added to the `libgcc_eh` definition. This is necessary because `links-dso-program` otherwise fails to link due to a missing `__gcc_personality_v0` symbol. It appears that clang does not automatically link the builtins providing this personality routine when `rlink-path` is actively used during the build. Reviewed-by: Sam James commit 79942df7c5ceae3468dd15af61bba288447ffe9f Author: Adhemerval Zanella Date: Wed Feb 25 15:31:13 2026 -0300 configure: Parametrize runtime libraries to support compiler-rt Historically, the build system has hardcoded references to `-lgcc` and `-lgcc_eh`, explicitly assuming the use of the GCC runtime. This prevents building glibc with alternative toolchains, specifically clang configured with `--rtlib=compiler-rt`, where these libraries are replaced by `libclang_rt.builtins`. This patch introduces a mechanism to dynamically detect the compiler's underlying runtime library. The logic works as follows: 1. It queries the compiler using `-print-libgcc-file-name`. 2. It parses the output path to determine if `libgcc` or `compiler-rt` is in use. 3. Based on this detection, it parametrizes the build variables for the static runtime and exception handling libraries (replacing hardcoded `-lgcc` and `-lgcc_eh`). This ensures that the build system correctly links against the active compiler runtime—whether it is the traditional libgcc or LLVM's compiler-rt—without requiring manual overrides. Reviewed-by: Sam James commit 3daf1a33792508b593d8f118f81b8f0c34c9e10c Author: Adhemerval Zanella Date: Thu Mar 12 13:49:50 2026 -0300 malloc: Remove lingering DIAG_POP_NEEDS_COMMENT From 0ea9ebe48ad624919d579dbe651293975fb6a699. commit 1bce191b6733fabc87c5b295b5322a29801becec Author: Collin Funk Date: Wed Feb 25 20:00:27 2026 -0800 conform: Add initial support for XOPEN2K24 Make XOPEN2K24 checks the same as XOPEN2K8 using the following command: $ find conform -name '*.h-data' | xargs sed -i \ -e 's| !defined XOPEN2K8| !defined XOPEN2K8 \&\& !defined XOPEN2K24|g' \ -e 's| defined XOPEN2K8| defined XOPEN2K8 \|\| defined XOPEN2K24|g' \ -e 's|ifdef XOPEN2K8|if defined XOPEN2K8 \|\| defined XOPEN2K24|g' \ -e 's|ifndef XOPEN2K8|if !defined XOPEN2K8 \&\& !defined XOPEN2K24|g' Reviewed-by: Yury Khrustalev commit f7c3acb4dfa9c901cf6d290ee1d42582dc7bc468 Author: Collin Funk Date: Wed Feb 25 20:00:26 2026 -0800 conform: Add initial support for POSIX.1-2024 Make POSIX.1-2024 checks the same as POSIX.1-2008 using the following command: $ find conform -name '*.h-data' | xargs sed -i \ -e 's| !defined POSIX2008| !defined POSIX2008 \&\& !defined POSIX2024|g' \ -e 's| defined POSIX2008| defined POSIX2008 \|\| defined POSIX2024|g' \ -e 's|ifdef POSIX2008|if defined POSIX2008 \|\| defined POSIX2024|g' \ -e 's|ifndef POSIX2008|if !defined POSIX2008 \&\& !defined POSIX2024|g' Reviewed-by: Yury Khrustalev commit 0ea9ebe48ad624919d579dbe651293975fb6a699 Author: Wilco Dijkstra Date: Wed Mar 11 17:17:18 2026 +0000 malloc: Cleanup warnings Cleanup warnings - malloc builds with -Os and -Og without needing any complex warning avoidance defines. Reviewed-by: Adhemerval Zanella  commit 656d923a47210d0ec56cdbccefa1b0858ea1572e Author: Siddhesh Poyarekar Date: Wed Mar 11 09:11:44 2026 -0400 Document CVE-2026-3904 All branches already have a fix, so this is mainly for distributions that may have cherry-picked the SSE2 memcmp implementation. Signed-off-by: Siddhesh Poyarekar commit 41e2067a8f238310e72e70b21f7d67fe7d8a9189 Author: Deng Jianbo Date: Mon Mar 9 15:37:49 2026 +0800 LoongArch: Optimize float environment functions In LoongArch, fcsr1 is the alias of enables field in fcsr0, fscr3 is the alias of RM field in fscr0. This patch use fcsr1 and fcsr3 register to optimize fedisableexcept, feenableexcept, fegetexcept, fegetround, fesetround, get_rounding_mode functions, which could reduce the additional andi instruction. commit dafe64e2eeeb24f96bd3165a3890898fac75ad2b Author: Adhemerval Zanella Date: Wed Feb 25 15:31:15 2026 -0300 nptl: Only issues __libc_unwind_link_get for SHARED The compiler already optimizes it away for static builds. Reviewed-by: Collin Funk commit 0f5e379798783b19f892329482806a9e3f4c1daf Author: Adhemerval Zanella Date: Wed Feb 25 15:31:12 2026 -0300 x86_64: Conditionally define __sfp_handle_exceptions for compiler-rt The LLVM compiler-rt builtins library does not currently provide an implementation for __sfp_handle_exceptions. On x86_64, this causes unresolved symbol errors when building glibc in environments that exclude libgcc. This patch implements __sfp_handle_exceptions specifically for x86_64, bridging the gap for non-GNU compiler runtimes. The implementation is used conditionally, only if the compiler does not already provide the symbol. NB: the implementation is based on libgcc and raises bosh SSE and i387 exceptions (different that the one from 460ee50de054396cc9791ff4) Reviewed-by: H.J. Lu commit 660c52dc219a6e77f35b5b5d7d0b80e91cc6beb9 Author: Tomasz Kamiński Date: Tue Mar 10 09:11:23 2026 +0100 test-assert-c++-variadic.cc: Disable assert_works for GCC 14.2 and 14.1 PR118629 [1] resolved issue with usage of __PRETTY_FUNCTION__ (to which assert expands) inside unevaluated context for GCC 14.3. This affects only versions 14.1 and 14.2, as -std=c++26 option is supported since 14.1. clang supports above snippet for all version that supports --std=c++26 flag (since 17.0.1). [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118629 Reviewed-by: Adhemerval Zanella commit 7a5d6adc8e896da4b8d2b0cff8c0f321901ea5aa Author: Yunze Zhu Date: Tue Mar 10 11:29:18 2026 +0800 libio: Properly link in function _IO_wfile_doallocate in static binaries This patch addresses Bug 33935 - _IO_wfile_doallocate not linked correctly when linking glibc statically. https://sourceware.org/bugzilla/show_bug.cgi?id=33935 The function _IO_wfile_doallocate has been added with pragma weak in vtable.c, while it is the only one symbol contained in wfiledoalloc.c, and has not been directly called in libio. In static binaries the true function symbol _IO_wfile_doallocate may not be correctly linked when linking glibc with cases contains wchar functions, but the weak symbol in vtable is linked instead, and cause segmentation fault when running. This patch fixes this with similar way to symbol _IO_file_doallocate, that add libio_static_fn_required(_IO_wfile_doallocate) in wgenops.c to make _IO_wfile_doallocate always link in static binaries. Reviewed-by: Adhemerval Zanella commit 28882c408c7177ff82277bd69f0d7d4078f72561 Author: Wilco Dijkstra Date: Tue Jan 27 19:27:31 2026 +0000 malloc: Improve memalign alignment Use generic stdc_bit_width to safely adapt to input types. Move rounding up of alignments that are not powers of 2 to __libc_memalign. Simplify alignment handling of aligned_alloc and __posix_memalign. Add a testcase for non-power of 2 memalign and fix malloc-debug. Reviewed-by: DJ Delorie commit 9181dc6eb6084da95d8c14d9defe96189fd0360d Author: Frédéric Bérat Date: Tue Jan 27 23:07:17 2026 +0100 feat(rtld): Allow LD_DEBUG category exclusion Adds support for excluding specific categories from `LD_DEBUG` output. The `LD_DEBUG` environment variable now accepts category names prefixed with a dash (`-`) to disable their debugging output. This allows users to enable broad categories (e.g., `all`) while suppressing verbose or irrelevant information from specific sub-categories (e.g., `-tls`). The `process_dl_debug` function in `rtld.c` has been updated to parse these exclusion options and unset the corresponding bits in `GLRO(dl_debug_mask)`. The `LD_DEBUG=help` output has also been updated to document this new functionality. A new test `tst-dl-debug-exclude.sh` is added to verify the correct behavior of category exclusion. Reviewed-by: Adhemerval Zanella commit 1e47dbcce4d5cf2ce71377e729014e454a3e15ae Author: Frédéric Bérat Date: Fri Dec 12 16:19:43 2025 +0100 elf(tls): Add debug logging for TLS operations This commit introduces extensive debug logging for thread-local storage (TLS) operations within the dynamic linker. When `LD_DEBUG=tls` is enabled, messages are printed for: - TLS module assignment and release. - DTV (Dynamic Thread Vector) resizing events. - TLS block allocations and deallocations. - `__tls_get_addr` slow path events (DTV updates, lazy allocations, and static TLS usage). The log format is standardized to use a "tls: " prefix and identifies modules using the "modid %lu" convention. To aid in debugging multithreaded applications, thread-specific logs include the Thread Control Block (TCB) address to identify the context of the operation. A new test module `tst-tls-debug-mod.c` and a corresponding shell script `tst-tls-debug-recursive.sh` have been added. Additionally, the existing `tst-dl-debug-tid` NPTL test has been updated to verify these TLS debug messages in a multithreaded context. Reviewed-by: Adhemerval Zanella commit eb6364974e16bb5bfa5c8131a9dfa2b8afde096b Author: Weixie Cui Date: Fri Feb 27 19:40:58 2026 +0800 elf: should check result of openat with -1 not 1 Signed-off-by: Weixie Cui Reviewed-by: Yury Khrustalev commit 4972c2e1d2791eb125da152817fed4871d905fb7 Author: Samuel Thibault Date: Sun Mar 8 19:01:53 2026 +0100 htl: Fix pthread_once memory ordering We need to tie the fast-path read with the store, to make sure that when fast-reading 1, we see all the effects performed by the init routine. (and we don't need a full barrier, only an acquire/release pair is needed) Reported-by: Brent Baccala 's Claude assistant commit b8742217669fe4809b2d179e12f72bbf3280a7cf Author: Samuel Thibault Date: Sun Mar 8 18:19:17 2026 +0100 htl: Make sure the exit path of last thread sees all thread cleanups In case e.g. some atexit() handlers expect all threads to have finished their side effects. Reported-by: Brent Baccala 's Claude assistant commit 9ec6f2d466b440d4d9cbb132f0484dc64002e9e1 Author: Samuel Thibault Date: Sun Mar 8 02:10:00 2026 +0000 hurd: Check for _hurdsig_preempted_set with _hurd_siglock held Without taking _hurd_siglock, we could be missing the addition of a global preemptor. Reported-by: Brent Baccala 's Claude assistant commit 15134aabfb67b4971cc178b87d5685908d1ae834 Author: Samuel Thibault Date: Sun Mar 8 01:09:18 2026 +0100 htl: Call thread-specific destructors for last thread too As required by posix. Reported-by: Brent Baccala 's Claude assistant commit 0f2a0a45d2f0b2267e57af42793b206d526e8ec9 Author: Samuel Thibault Date: Sun Mar 8 01:03:42 2026 +0100 htl: Fix checking for mutex not being recoverable pthread_mutex_unlock sets __owner_id to NOTRECOVERABLE_ID Reported-by: Brent Baccala 's Claude assistant commit 05d00ade8e8ae53d5087e986c9bbda449ff6be28 Author: Adhemerval Zanella Date: Wed Jan 28 13:29:21 2026 -0300 benchtests: Adapt tanh Random values in the range of [-4,4]. commit 5ff573204ba7fa696190c0d433c52924ae5e0461 Author: Adhemerval Zanella Date: Wed Jan 28 13:29:20 2026 -0300 benchtests: Adapt sinh Random values in the range of [-10,10]. commit 740d29d59b75aa5db6c9f1364e7aa0d75ba0b435 Author: Adhemerval Zanella Date: Wed Jan 28 13:29:19 2026 -0300 benchtests: Adapt cosh Random values in the range of [-10,10]. commit 66f930ebe0f80f920aae20293c0d53dbe4cf68ca Author: Samuel Thibault Date: Thu Mar 5 14:28:26 2026 +0100 Fix Makefile alphabetical ordering commit 4fd4c273ed5d70928e391ac52ff744bad83c70f4 Author: Samuel Thibault Date: Thu Mar 5 01:29:37 2026 +0100 hurd; Fix return value for sigwait It is supposed to return an error code, not just -1. Reported-by: Brent Baccala 's Claude assistant commit 8a616a787228bf23d9607b6e0965c8138f83ec54 Author: Samuel Thibault Date: Thu Mar 5 00:12:14 2026 +0000 hurd: Fix cleaning on sigtimedwait timing out sigtimedwait also needs to clean up preemptors and the blocked mask before returning EAGAIN. Also add some sigtimedwait testing. commit d12b017cddfeb9fe9920ba054ae3dfcb8e9238b8 Author: Florian Weimer Date: Wed Mar 4 18:32:36 2026 +0100 Linux: Only define OPEN_TREE_* macros in if undefined (bug 33921) There is a conditional inclusion of earlier in the file. If that defines the macros, do not redefine them. This addresses build problems as the token sequence used by the UAPI macro definitions changes between Linux versions. Reviewed-by: Adhemerval Zanella commit 2e8a940df14e9e03fd5bd01015ebbd00c1a5e9b4 Author: Wilco Dijkstra Date: Fri Feb 27 20:20:45 2026 +0000 malloc: Avoid accessing /sys/kernel/mm files On AArch64 malloc always checks /sys/kernel/mm/transparent_hugepage/enabled to set the THP mode. However this check is quite expensive and the file may not be accessible in containers. If DEFAULT_THP_PAGESIZE is non-zero, use malloc_thp_mode_madvise so that we take advantage of THP in all cases. Since madvise is a fast systemcall, it adds only a small overhead compared to the cost of mmap and populating the pages. Reviewed-by: Aurelien Jarno commit 41918174fc7b839cd14717fcee36833eb3acc73c Author: Yury Khrustalev Date: Wed Mar 4 09:04:14 2026 +0000 misc: Fix a few typos in comments commit 7053778703f8de2488789a002d093247d2626921 Author: Samuel Thibault Date: Wed Mar 4 01:21:43 2026 +0000 htl: Fix race between timedrd/wrlock and unlock In case the rwlock is unlocked right before we time out, we will have been given ownership, so we shouldn't time out. Reported-by: Brent Baccala 's Claude assistant commit 7fdb0ab26444d0c5ad25b4e84cbd11cbaf3bb78c Author: Samuel Thibault Date: Wed Mar 4 02:12:48 2026 +0100 hurd: Take cancel_lock in critical section read/write etc. shall be signal-safe, and take cancel_lock, so we have to defer signal delivery while holding cancel_lock. Reported-by: Brent Baccala 's Claude assistant commit dc9ca785a5fe2059a9b04ab336520d463d9a715b Author: Carlos Peón Costa Date: Tue Mar 3 18:48:47 2026 +0100 resolv: Avoid duplicate query if search list contains '.' (bug 33804) Co-authored-by: Florian Weimer Signed-off-by: Florian Weimer Reviewed-by: Carlos O'Donell commit c995686e2cbe2a3ab2a11877a61c14a2e1fc35cb Author: Florian Weimer Date: Tue Mar 3 18:48:47 2026 +0100 support: no_override_resolv_conf_search flag for resolver test framework It is required to test "search ." in /etc/resolv.conf files. The default is to override the search path isolate from unexpected settings in the test execution environment. Reviewed-by: Carlos O'Donell commit d2bbf8aedaec9684724e39a96cc131f2eab224f5 Author: Wilco Dijkstra Date: Mon Mar 2 17:17:04 2026 +0000 AArch64: Improve memset when len is 64 Change the mask to 48 to support len==64. The second memory store now accesses offset 32, whereas the third one accesses offset 16. As a result performance for len==64 almost doubles. commit c37b8d9f34872f81844fb30552af08b5cdaf9b2d Author: Wilco Dijkstra Date: Mon Mar 2 13:09:24 2026 +0000 malloc: Add asserts for malloc assumptions Currently malloc has various assumptions, some documented, some implicit. Add a few asserts to check the most fundamental assumptions using verify(). Remove some odd #define void. Reviewed-by: Paul Eggert commit 0d28f1f1a07e3a4473fb87cfade9528e54fbffe0 Author: Yury Khrustalev Date: Mon Feb 2 14:06:38 2026 +0000 tests: posix: use cpu clock for sleep On some emulated targets sleep may result in inconsistent wait times which will lead to the failure of the tst-chmod test. To account for this we use the CLOCK_PROCESS_CPUTIME_ID clock ID while also consuming CPU time by repeatedly calling clock_gettime. Reviewed-by: DJ Delorie commit ea37298b65bd67f94c3c2640e91ec5865a5019ad Author: Jonathan Wakely Date: Wed Feb 25 15:01:23 2026 +0100 assert: Support assert as variadic macro for C++26 [PR27276] C++26 changes assert into a variadic macro to support using assignment-expressions that would be interpreted as multiple macro arguments, in particular one containing: * template parameter lists: func() * calls to overloaded operator[] that accepts multiple arguments: arr[1, 2] this is C++23 feature, see libstdc++ PR/119855 [1] * lambdas with explicit captures: [x, y] { ... } The new expansion in form: (__VA_ARGS__) ? void (1 ? 1 : bool (__VA_ARGS__)) : __assert_fail (...) Has the following properties: * Use of (__VA_ARGS__) ? ... : ..., requires that __VA_ARGS__ is contextually convertible to bool. This means that enumerators of scoped enumeration are no longer accepted (they are only explicitly convertible). Thus this patch address the glibc PR/27276 [2]. * Nested ternary 1 ? 1 : bool (__VA_ARGS__) guarantees that expression expanded from __VA_ARGS__ is not evaluated twice. This is used instead of unevaluated context (like sizeof...) to support C++ expressions that are not allowed in unevaluated context (lambdas until C++20, co_await, co_yield). * bool (__VA_ARGS__) is ill-formed if __VA_ARGS__ expands to multiple arguments: assert(1, 2) * bool (__VA_ARGS__) also triggers warnings when __VA_ARGS__ expands to x = 1: assert(x = 1) To guarantee that the code snippets from assert/test-assert-c++-variadic.cc, are actually checked for validity, we need to compile this test in C++26 (-std=c++26) mode. To achieve that, this patch compiles the file with test-config-cxxflags-stdcxx26 variable as additional flag, that is set to -std=c++26 if $(TEST_CXX) executable supports that flag, and empty otherwise. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119855 [2] https://sourceware.org/bugzilla/show_bug.cgi?id=27276 Co-authored-by: Tomasz Kamiński Signed-off-by: Tomasz Kamiński Reviewed-by: Adhemerval Zanella commit 44ce02b6a8b0061edf0a312368f2f3fa719c1df8 Author: Adhemerval Zanella Date: Tue Jan 27 19:56:45 2026 +0000 math: Sync atanh with CORE-MATH It speeds the fast-path for |x|<0.25. The CORE-MATH muldd is the same as muldd2 from glibc ddcoremath.h. Checked on aarch64-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, i686-linux-gnu, and x86_64-linux-gnu. Reviewed-by: Paul Zimmermann commit 85e47a333b0f117ef70d3c43a106e747707b3985 Author: Adhemerval Zanella Date: Tue Jan 27 19:56:44 2026 +0000 math: Sync log10p1f with CORE-MATH The new code shows a small performance increase in x86_64: latency patched sync improvement x86_64 41.8873 40.2864 3.82% x86_64v2 40.5859 39.2079 3.40% x86_64v3 34.6393 33.5018 3.28% aarch64 15.2731 14.5953 4.44% armhf-vpfv4 17.0373 17.0186 0.11% powerpc64le 8.3341 8.3298 0.05% reciprocal-throughput patched sync improvement x86_64 15.6516 13.6373 12.87% x86_64v2 15.0551 13.2769 11.81% x86_64v3 12.8994 11.0628 14.24% aarch64 8.8306 9.1898 -4.07% armhf-vpfv4 9.5855 10.0199 -4.53% powerpc64le 4.0074 4.4466 -10.96% x86_64 / i686 gcc version 15.2.1 20260112. Ryzen 5900X aarch64: gcc version 15.2.1 20251105, Neoverse-N1 armv7a-vpfv4: gcc version 15.2.1 20251105, Neoverse-N1 powerpc64le: gcc version 14.2.1 20241230, POWER10 The code size also show slight improvement, the s_log10pf.os 'size' output shows: size patched sync improvement x86_64 2345 2243 4.35% x86_64v2 2345 2243 4.35% x86_64v3 2226 2162 2.88% aarch64 2104 2112 -0.38% armhf-vpfv4 2016 2012 0.20% powerpc64le 2324 2340 -0.69% Checked on aarch64-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, i686-linux-gnu, and x86_64-linux-gnu. Reviewed-by: Paul Zimmermann commit 0b949d5d575f5d024e04c38a6b054e62abd8a5ac Author: Adhemerval Zanella Date: Tue Jan 27 19:56:43 2026 +0000 math: Sync log10f with CORE-MATH The performance is similar: latency master sync improvement x86_64 34.6851 32.7977 5.44% x86_64v2 34.0921 32.4295 4.88% x86_64v3 27.8292 27.6070 0.80% aarch64 11.7246 11.1351 5.03% armhf-vpfv4 13.3748 12.9055 3.51% powerpc64le 6.4036 6.5825 -2.79% reciprocal-throughput master sync improvement x86_64 10.2653 10.0437 2.16% x86_64v2 10.8432 10.7040 1.28% x86_64v3 10.9006 11.0765 -1.61% aarch64 6.6447 6.2743 5.57% armhf-vpfv4 6.8916 6.7538 2.00% powerpc64le 2.9494 2.7661 6.21% x86_64 / i686 gcc version 15.2.1 20260112. Ryzen 5900X aarch64: gcc version 15.2.1 20251105, Neoverse-N1 armv7a-vpfv4: gcc version 15.2.1 20251105, Neoverse-N1 powerpc64le: gcc version 14.2.1 20241230, POWER10 The code size is also similar. Checked on aarch64-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, i686-linux-gnu, and x86_64-linux-gnu. Reviewed-by: Paul Zimmermann commit 236171bb8727e7d0acdf7dbfa51cf524e8955744 Author: Adhemerval Zanella Date: Tue Jan 27 19:56:42 2026 +0000 math: Sync log2p1f with CORE-MATH The new code shows better performance overall: latency patched sync improvement x86_64 48.5909 33.3368 31.39% x86_64v2 49.1357 33.9981 30.81% x86_64v3 39.2397 28.0957 28.40% aarch64 16.5372 12.8133 22.52% armhf-vpfv4 18.1434 14.5273 19.93% powerpc64le 9.0999 7.49235 17.67% reciprocal-throughput patched sync improvement x86_64 14.5197 10.9726 24.43% x86_64v2 14.7640 11.1358 24.57% x86_64v3 11.5523 9.83253 14.89% aarch64 8.2854 7.8479 5.28% armhf-vpfv4 8.8586 8.5245 3.77% powerpc64le 3.8995 4.0069 -2.75% x86_64 / i686 gcc version 15.2.1 20260112. Ryzen 5900X aarch64: gcc version 15.2.1 20251105, Neoverse-N1 armv7a-vpfv4: gcc version 15.2.1 20251105, Neoverse-N1 powerpc64le: gcc version 14.2.1 20241230, POWER10 The sync also improves the internal table size, the s_log1pf.os 'size' output shows: size master sync improvement x86_64 3417 2089 38.86% x86_64v2 3417 2089 38.86% x86_64v3 3228 2001 38.01% i686 3490 2151 38.37% aarch64 3200 1888 41.00% armhf-vpfv4 3080 1804 41.43% powerpc64le 3408 2148 36.97% Checked on aarch64-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, i686-linux-gnu, and x86_64-linux-gnu. Reviewed-by: Paul Zimmermann commit 3069c7951d83a3d5d4ef87ebcd54adb64257f4e5 Author: Adhemerval Zanella Date: Tue Jan 27 19:56:41 2026 +0000 math: Sync log1pf with CORE-MATH The performance is similar, with some minor regression: latency master sync improvement x86_64 38.2841 38.1375 0.38% x86_64v2 37.7338 37.4292 0.81% x86_64v3 31.3500 32.3576 -3.21% aarch64 13.7384 13.9030 -1.20% armhf-vpfv4 15.5730 16.5105 -6.02% powerpc64le 7.6038 7.5757 0.37% reciprocal-throughput master sync improvement x86_64 12.4910 11.9683 4.18% x86_64v2 12.2935 11.7614 4.33% x86_64v3 11.5444 10.6369 7.86% aarch64 7.7262 7.8954 -2.19% armhf-vpfv4 8.3502 8.8741 -6.27% powerpc64le 3.5883 3.5259 1.74% x86_64 / i686 gcc version 15.2.1 20260112. Ryzen 5900X aarch64: gcc version 15.2.1 20251105, Neoverse-N1 armv7a-vpfv4: gcc version 15.2.1 20251105, Neoverse-N1 powerpc64le: gcc version 14.2.1 20241230, POWER10 The sync also improves the internal table size, the s_log1pf.os 'size' output shows: size master sync improvement x86_64 2078 1641 21.03% x86_64v2 2078 1641 21.03% x86_64v3 1975 1514 23.34% aarch64 1808 1336 26.11% armhf-vpfv4 1716 1284 25.17% powerpc64le 2132 1616 24.20% Checked on aarch64-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, i686-linux-gnu, and x86_64-linux-gnu. Reviewed-by: Paul Zimmermann commit 4b5a74412ee6ebb69a289acd8a94ef8ddcc6baa8 Author: Samuel Thibault Date: Sun Mar 1 17:57:54 2026 +0100 htl: Fix mt-safeness of libio Since d2e04918833 ("Single threaded stdio optimization") we are supposed to call _IO_enable_locks when creating the first thread, but that commit missed doing it for htl. commit 1d19ddf714f5e7afeaf2ef538417bbf681c5d4e8 Author: Samuel Thibault Date: Sun Mar 1 17:01:25 2026 +0100 hurd: Sign-extend the sigcode passed to msg_sig_post The negative sigcodes are reserved for SI_* values, we need to keep them negative when extending to exc_subcode's long type. This fixes the comparison in HURD_PREEMPT_SIGNAL_P for the signal preemptor for setitimer, thus fixing considering it.it_interval. Reported-by: David Yang commit dedebed24f77762eea7d3c5ed2739a90a4d60461 Author: Cosmina.Dunca@arm.com Date: Thu Feb 26 14:23:45 2026 +0000 Vectorise inverse hyperbolic special cases Vectorise SVE and AdvSIMD special-case handling for inverse hyperbolic functions (acosh, asinh, atanh). General-case improvements yield an average 11% speedup, with peak gains of up to 80%. For benchmarking I used Neoverse V2 with GCC@15. commit 5179ae2756a18fe8b034df12e7400c76ea3c9df0 Author: Richard.Wild@arm.com Date: Thu Feb 26 15:25:59 2026 +0000 AArch64: Single and Double precision entire exp family, SVE and AdvSIMD optimisations This patch vectorises remaining special cases and optimises some fast path performance for single and double precision exp, SVE and AdvSIMD. Moves most special case functions to header files to minimise code size. Uses NOINLINE in main case where half width alias is used to minimise codegen. Special case vectorisation performance increase of average 8x to greatest 9.5x. Special case improvements performance increase average 15% speed improvement to greatest 40%. Some fast path gains during rework of files. Fastest notable increase in exp2m1 AdvSIMD double precision of 26% improvement. Most fast paths improved by 5-10%. 8 unchanged. No regressions. Benchmarked on Neoverse V2 with GCC@15 commit da5fc86c578353d91eed06ad4755eb7a822d554b Author: Nicolas Boulenguez Date: Thu Feb 26 03:20:11 2026 +0100 manual: Document that EOPNOTSUPP and ENOTSUP are equal, not distinct (BZ 2363) The section 2.1 of the glibc manual says that EWOULDBLOCK == EAGAIN, but forgets to mention that ENOTSUP == EOPNOTSUPP. https://sourceware.org/legacy-ml/libc-alpha/2019-08/msg00629.html https://sourceware.org/bugzilla/show_bug.cgi?id=2363 https://bugs.debian.org/337013 Signed-off-by: Nicolas Boulenguez Reviewed-by: Adhemerval Zanella commit 447a8a74dcf0bbebbd3bf1702b6c7a4f149097e8 Author: Richard.Wild@arm.com Date: Thu Feb 26 11:04:46 2026 +0000 AArch64: Vectorise SVE log/log2/log10 single and double precision special cases. This patch vectorises scalar fallbacks for SVE logB(f) functions. Special case performance increase of around 3x speedup for double and 5x speedup for single precision. Some fast path gains during rework of files. Most fast paths improved by 2-3%. 2 unchanged. No regressions. Benchmarked on Neoverse V2 with GCC@15. commit f562fec7df97df43a642b089a58400d6af97d1f6 Author: Richard.Wild@arm.com Date: Thu Feb 26 10:22:35 2026 +0000 AArch64: Single and Double precision hyperbolics, SVE and AdvSIMD optimisations This patch vectorises special cases and optimises some fast path performance for single and double precision hyperbolics, sve and advsimd. Special case performance increase of average 4x to greatest 10x. Some fast path gains during rework of files. Fastest notable increase in sinh advsimd double precision of 2x. Most fast paths improved by 5-10%. Benchmarked on Neoverse V2 with GCC@15. commit 64d851cef39a9cb743ca79ca4f00208b2a340f84 Author: Paul Eggert Date: Thu Feb 26 08:14:20 2026 -0800 malloc: alignment might change in future versions This follows up on a comment by Wilco Dijkstra; see: https://sourceware.org/pipermail/libc-alpha/2026-February/174934.html * NEWS: Mention this. * manual/memory.texi (Malloc Examples): Say that alignment guarantee might change for small allocations. Reviewed-by: Wilco Dijkstra Reviewed-by: Florian Weimer commit feda85454de3da5c353265adc6e31e1d8b8c9904 Author: Paul Eggert Date: Thu Feb 26 08:14:20 2026 -0800 Say malloc (0) != NULL is now common; resection * manual/memory.texi (Portable Allocation): New section, split off from Malloc Examples. Say that almost every system follows glibc's example in having successful malloc (0) return non-null; AIX is the only exception nowadays. Document fundamental alignment portability. Have examples match the new text, and use NULL rather than 0. Reviewed-by: Florian Weimer commit b4b5c64c03abdb7498e4ab3a8fc4bafdc8d09eda Author: Paul Eggert Date: Thu Feb 26 08:14:20 2026 -0800 Document malloc alignment * manual/memory.texi (Malloc Examples, Changing Block Size) (Allocating Cleared Space): Document the alignment of the returned value. Reviewed-by: Florian Weimer commit d0348243f9317ed3647b6b14c4093065f67022d9 Author: Paul Eggert Date: Thu Feb 26 08:14:20 2026 -0800 Document max_align_t * manual/lang.texi (Important Data Types): Mention max_align_t. Reviewed-by: Florian Weimer commit e1a036b1a2d315c8189295cc5500b6136c54885a Author: Florian Weimer Date: Thu Feb 26 16:44:14 2026 +0100 manual: Fix typo in documentation of iconv character set options Reported-by: Andreas Schwab commit f96e9bd2fecce3f0284479a5c0dac6989736c8c8 Author: Adhemerval Zanella Date: Thu Feb 26 09:49:19 2026 -0300 debug: Fix build with --enable-fortify-source=1 (BZ 33904) The libio/bits/stdio2-decl.h only defined the prototypes for __vasprintf_chk and __vfprintf_chk for __USE_FORTIFY_LEVEL > 1. Also defined them for the internal header regardless. Checked with a build with --enable-fortify-source=1 and --enable-fortify-source=2 for all afftected ABIs. commit c19cdbf66ff62a4578ac2117d43ebb306ae36aeb Author: Xi Ruoyao Date: Thu Feb 26 11:50:53 2026 +0100 linux/mips: handle wait status 0x7f specially for WIFSIGNALED and WIFSTOPPED MIPS Linux has SIGRTMAX=127, thus the wait status 0x7f means the program is terminated by SIGRTMAX, not stopped. This cannot happen on other ports so make a special version of waitstatus.h for MIPS to avoid adding redundant calculation to others. I cannot find a way to use status only once in the expression, so use inline functions instead of macros to avoid double-evaluating status. Signed-off-by: Xi Ruoyao Reviewed-by: Florian Weimer commit 493fac9ac87531cd77df6fd6ba039ed434fb3ff4 Author: Adhemerval Zanella Date: Wed Feb 25 15:35:41 2026 -0300 elf: Fix tst-link-map-contiguous-ldso build for Hurd Checked with a make check for i686-gnu. commit aed8390a6a22e5751fc12704c0c5f2a8271fc286 Author: Xi Ruoyao Date: Tue Feb 3 16:20:12 2026 +0800 elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso The initialization process of libc.so calls mmap() several times and the kernel may lay the maps into the gap. If all pages in the gap are occupied, the test would not be able to find the gap with mmap() and the test would fail. The failure reproduces most frequently on LoongArch because with the commonly used page size (16 KiB) the gap only contains 4 pages and the probability they are all occupied is not near to zero. With the changes in the patch, a test run may output: info: ld.so link map is not contiguous info: object "/dev/zero" found at 0x7ffff1fe0000 - 0x7ffff1fe4000 info: anonymous mapping found at 0x7ffff1fe4000 - 0x7ffff1fec000 Also take the chance to fix a mistake in the "object found at" message which has puzzled me during the initial debug session. Signed-off-by: Xi Ruoyao Reviewed-by: Adhemerval Zanella commit 67f303b47dc584f204e3f2441b9832082415eebc Author: Michael Jeanson Date: Fri Feb 20 11:01:00 2026 -0500 tests: fix tst-rseq with Linux 7.0 A sub-test of tst-rseq is to validate the return code and errno of the rseq syscall when attempting to register the exact same rseq area as was done in the dynamic loader. This involves finding the rseq area address by adding the '__rseq_offset' to the thread pointer and calculating the area size from the AT_RSEQ_FEATURE_SIZE auxiliary vector. However the test currently calculates the size of the rseq area allocation in the TLS block which must be a multiple of AT_RSEQ_ALIGN. Up until now that happened to be the same value since the feature size and alignment exposed by the kernel were below the minimum ABI size of 32. Starting with Linux 7.0 the feature size has reached 33 while the alignment is now 64. This results in the test trying to re-register the rseq area with a different size and thus not getting the expected errno value. Signed-off-by: Michael Jeanson Reviewed-by: Mathieu Desnoyers commit b657f72fa34192b9afdd4cfab7fcf8e039d8888c Author: Florian Weimer Date: Mon Feb 23 14:19:38 2026 +0100 libio: Fix deadlock between freopen, fflush (NULL) and fclose (bug 24963) The canonical lock ordering for stream list processing is locking list_all_lock first, then individual streams as needed. The fclose implementation reversed that, and the freopen implementation performed list operations under the reverse order, too. Unlinking in fclose was already unconditional, and the early unlinking looks unnecessary: _IO_file_close_it would call it even for !_IO_IS_FILEBUF streams. There is still a remaining concurrency defect because _IO_new_file_init_internal links in the stream before it is fully initialized, and it is not locked at this point. Reviewed-by: Arjun Shankar commit 9af18a94e051fce513972254bf97c12ae563841e Author: Samuel Thibault Date: Sun Feb 22 23:34:25 2026 +0100 hurd: Define _POSIX_TIMERS to 200809L We now have monotonic vs realtime clocks, and high-precision. commit 0a380fe9a31bc2d5793c7c5d22d36c45dfe6e2ed Author: Adhemerval Zanella Date: Thu Feb 12 09:48:53 2026 -0300 elf: Use dl-symbol-redir-ifunc.h instead _dl_strlen Also replace the loop with strlen And remove -fno-tree-loop-distribute-patterns usage. It requires redirect the strlen to the baseline implementation for x86_64, aarch64, and loongarch64. Checked on x86_64-linux-gnu{-v2,v3} and aarch64-linux-gnu with both gcc-15 and clang-21. Reviewed-by: DJ Delorie commit ecb60726d0c242b9e92683f23259337b3b915fe4 Author: Pádraig Brady Date: Fri Feb 13 19:41:13 2026 +0000 posix: execvpe: skip $PATH components that are too long [BZ #33626] * posix/execvpe.c (__execvpe_common): Rather than error out with ENAMETOOLONG, just ignore and try the next path. Note we know the FILE length is <= NAME_MAX, so the ENAMETOOLONG almost certainly pertains to the current $PATH entry. * posix/tst-execvpe7.c: A new test based on tst-execvp3.c. * posix/Makefile: Reference the new test. Reviewed-by: Collin Funk Reviewed-by: Adhemerval Zanella commit 243bdfec8f7cd4a85a8ce6e4e9a5a5accd3ce1aa Author: Jakub Jelinek Date: Tue Feb 17 17:06:48 2026 +0100 Rename __unused fields to __glibc_reserved. __unused is often defined to __attribute__((unused)) in BSD sources and furthermore libstdc++ testsuite uses it as a macro to verify libstdc++ headers don't use __unused identifiers. In ~2012 glibc headers have been cleaned up, but some new uses of __unused have reappeared (s390 fenv.h already many years ago, the rest last November). Reviewed-by: Florian Weimer commit ad9784419e274cef9ba7152d7cd2490d291f837b Author: Yury Khrustalev Date: Tue Feb 3 15:51:11 2026 +0000 aarch64: Tests for locking GCS Check that GCS is locked properly based on the value of the glibc.cpu.aarch64_gcs tunable. Test tst-gcs-execv checks that a child process can be spawned correctly when GCS is locked for the parent process. Test tst-gcs-fork checks that if GCS is not locked for the parent process, the forked child can disable GCS. Tests tst-gcs-lock and tst-gcs-lock-static check that GCS is locked for dynamic and static executables when run with aarch64_gcs=1. Tests tst-gcs-unlock and tst-gcs-unlock-static check that GCS is not locked for dynamic and static executables when run with aarch64_gcs=0. Test tst-gcs-lock-ptrace checks via ptrace that when GCS is locked, all GCS features are locked. Reviewed-by: Adhemerval Zanella commit 5061f524a2976daf3062dd34beae1d7d15502770 Author: Yury Khrustalev Date: Mon Feb 2 18:27:53 2026 +0000 aarch64: Lock GCS status at startup If GCS is enabled (see tunable glibc.cpu.aarch64_gcs), we lock all GCS operations (including status, write on shadow stack, and push to shadow stack) unless OPTIONAL policy is used. Reviewed-by: Adhemerval Zanella commit 4db97f4d04cd2ad87f75b7219de2cb851fc62ebd Author: Yury Khrustalev Date: Mon Feb 16 12:46:39 2026 +0000 tests: aarch64: fix makefile dependencies for dlopen tests for BTI Some BTI tests in the sysdeps/unix/sysv/linux/aarch64 directory use test shared objects via dlopen. Due to lack of direct makefile level dependencies on these modules these tests could be run before the required .so files would be created. This could lead to flaky test results when running make check with -j flag. This commit fixes it. Reviewed-by: Wilco Dijkstra commit 288b55f4636f336cc336344e4215ead9c4d592fc Author: Mike Kelly Date: Sat Feb 14 09:17:11 2026 +0000 hurd: calling alarm() whilst handling SIGALRM can deadlock. alarm() and restart_itimer() can attempt to acquire _hurd_siglock and _hurd_itimer_lock in opposite sequence resulting in occasional deadlock. Rearranged to always acquire the locks in the same sequence with a new pre-condition that setitimer_locked() must be called with both locks already acquired. Message-ID: <20260214091715.157471-2-mike@weatherwax.co.uk> Reviewed-by: Samuel Thibault commit 5b713b49443eb6a4e54e50e2f0147105f86dab02 Author: Florian Weimer Date: Fri Feb 13 09:02:07 2026 +0100 nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940) This avoids a null pointer dereference in the nss_database_check_reload_and_get function, and assertion failures. Reviewed-by: Sam James commit 28660f4b45afa8921c2faebaec2846f95f670ba0 Author: Florian Weimer Date: Fri Feb 13 09:02:07 2026 +0100 Linux: In getlogin_r, use utmp fallback only for specific errors Most importantly, if getwpuid_r fails, it does not make sense to retry via utmp because the user ID obtained from there is less reliable than the one from /proc/self/loginuid. Reviewed-by: Sam James commit 7bb859f4198d0be19c31a9937eae4f6c2c9a079e Author: Florian Weimer Date: Fri Feb 13 09:02:07 2026 +0100 nss: Introduce dedicated struct nss_database_for_fork type The initialized field in struct nss_database_data is rather confusing because it is not used by the regular NSS code, only by the fork state synchronization code. Introduce a separate type and place the initialized field there. Reviewed-by: Sam James commit f5bab97a99be02a7e782e2a4fdbf6bcd762e9c3d Author: Florian Weimer Date: Thu Feb 12 12:18:54 2026 +0100 nscd: Add basic test The innetgr tests are similar to a downstream test for rhbz#1054846. This seems to be the first tests of this function. The getnetgrent tests are new, too. Reviewed-by: DJ Delorie commit bba1920c8b20176986ee294d74cef404027d99e8 Author: Florian Weimer Date: Thu Feb 12 12:18:54 2026 +0100 support: Add support for starting and stopping nscd Reviewed-by: DJ Delorie commit 68fe46a2ca55938a6c8fb3be54ef8982c11a2e00 Author: Florian Weimer Date: Thu Feb 12 12:18:54 2026 +0100 nscd: Pass TRY_AGAIN errors in the hosts cache to clients This is the minimal set of changes to get the upcoming test to pass. The TTL extension logic is somewhat iffy. There is a trade-off here: correct operation under the DNS specification (no TTL extensions), or reducing loading the infrastructure if TRY_AGAIN is the result of overload from this client. Reviewed-by: DJ Delorie commit c9c4ff0b77d72fa0c1229ac9c52ef42379b1f5a5 Author: Florian Weimer Date: Thu Feb 12 12:18:54 2026 +0100 support: Add missing NSS formatting and checking functions This change is largely auto-generated. The function implementations are mechanical and use the glibc-specific support framework, so this should be low-risk and therefore acceptable. The struct etherent type is currently internal-only (although it can be used by NSS modules), which is why it is not included here. Reviewed-by: DJ Delorie commit a1a730b0119a5b35dfa59c70c6744246ac1ee7fa Author: Florian Weimer Date: Thu Feb 12 12:18:54 2026 +0100 support: Clean up NSS formatting and checking functions Move includes into the implementation files. Use const where appropriate. Introduce support_check_nss and use it to implement the check_* functions. Reviewed-by: DJ Delorie commit 419245719ccbc7dad6a97f24465e7f09c090327a Author: DJ Delorie Date: Mon Jan 26 22:24:42 2026 -0500 include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h Including sys/mount.h should not implicitly include fcntl.h as that causes namespace pollution and conflicts with kernel headers. It only needs O_CLOEXEC for OPEN_TREE_CLOEXEC (although it shouldn't need that, but it's defined that way) so we provide that define (via a private version) separately. Reviewed-by: Adhemerval Zanella Tested-by: Florian Weimer commit 60a3b44f603f1410a6fd2a63f96da65095269bad Author: Adhemerval Zanella Date: Thu Feb 5 14:49:59 2026 -0300 x86: Build tst-gnu2-tls2-x86* iff compiler supports TLS descriptor The test modules are built with -mtls-dialect=$(have-test-mtls-descriptor), similar to tst-gnu2-tls2. Checked on x86_64-linux-gnu. commit 807b3d5e48ffa63561de6cf5b4b8f6b877cd9880 Author: Mike Kelly Date: Mon Feb 9 20:42:00 2026 +0000 hurd: _hurd_intr_rpc_mach_msg() might not preserve the correct reply port Calls to mach_msg_trap() that return MACH_SEND_INTERRUPTED modify the message header. A subsequent attempt at sending the message can return EINTR for handling by the caller. Mig generated code (expecting the message header to be unaltered) now fails assertion in __mig_dealloc_reply_port(). Fixed by restoring the altered message header content before reattempting RPC message delivery. Message-ID: <20260209204213.91782-2-mike@weatherwax.co.uk> commit 98dee6c96f5abc507966e0b8be2a37969b2bccfb Author: John David Anglin Date: Tue Feb 10 09:41:43 2026 -0500 hppa: Fix type punning in sysdeps/hppa/dl-fptr.c [BZ 33888] Compiling gcc with -Werror=strict-aliasing exposed a type punning issue in dl-fptr.c. It does a number of compare and swap operations to atomically exchange function pointers, etc. The PTR argument is dereferenced to determine the type of the objects to exchange. Casting the type of the PTR argument to a different type will result in in an error with -Werror=strict-aliasing. For example, a `(ElfW(Addr) *' pointer is not strictly equivalent to a `struct fdesc *' pointer. Fix this by removing the casts from the COMPARE_AND_SWAP PTR arguments and adjusting the type of the OLD and NEW arguments to match the dereferenced PTR type. Signed-off-by: John David Anglin commit 5f554e478c35801d7ddb32b68931c09e0ea3218b Author: Joseph Myers Date: Tue Feb 10 13:53:46 2026 +0000 Use Linux 6.19 in build-many-glibcs.py Tested with build-many-glibcs.py (host-libraries, compilers and glibcs builds). commit d71a81ab37336fe0b6dd6945ea8c195797bf4800 Author: George Hu Date: Mon Feb 9 20:22:18 2026 +0100 x86-64: Use 32-bit zero idiom for shorter encoding Replace the 64-bit zero idiom with the 32-bit form. In 64-bit mode, zeroing the lower 32 bits of a GPR implicitly clears the entire register. The 32-bit encoding is one byte shorter while preserving identical semantics. Reviewed-by: Samuel Thibault commit af79874ffd4d1f79bd0c040257320d1a6fe6a452 Author: Carlos O'Donell Date: Fri Feb 6 17:05:31 2026 -0500 SHARED-FILES: Update Unicode version to 17.0.0. In commit 88dc93cb400b832d2478c6c70bc4cf8c5b37432d we updated to Unicode 17.0.0. commit ea4c36c36bc1fcdc4683127edd2312cbdf540a45 Author: Wilco Dijkstra Date: Wed Dec 17 16:16:23 2025 +0000 malloc: Remove unused tcache code from unsorted bin scan Now that fastbins have been removed, there is no need to add chunks to tcache during an unsorted scan. Small blocks can only be added to unsorted as a result of a remainder chunk split off a larger block, so there is no point in checking for additional chunks to place in tcache. The last remainder is checked first, and will be used if it is large enough or an exact fit. The unsorted bin scan becomes simpler as a result. Remove the tcache_unsorted_limit tunable and manual entries. Reviewed-by: Adhemerval Zanella  commit 672aec0de053aee13c3d64c75c46c5666da09ff3 Author: Yury Khrustalev Date: Thu Feb 5 15:16:42 2026 +0000 tests: aarch64: clean up BTI and GCS tests No functional change, just cleaning up code, fixing style and correcting typos. Reviewed-by: Adhemerval Zanella commit 280119e974f1f5e5efcc94e065dd86ba4c515286 Author: Yury Khrustalev Date: Thu Feb 5 14:29:13 2026 +0000 tests: aarch64: move BTI tests to linux/aarch64 folder No functional change. BTI tests check Linux-related functionality and belong in the linux/aarch64 directory. Reviewed-by: Adhemerval Zanella commit 0d0e439439bc7137ca7f3b7d0befda84371be649 Author: Stefan Liebler Date: Thu Feb 5 13:03:08 2026 +0100 tst-{pthread|sched}-affinity-inheritance: Only use in-mask CPUs in affinity mask. On s390x, the two tests are failing on a lpar with linux 6.18 booted with nosmt: FAIL: misc/tst-sched-affinity-inheritance FAIL: nptl/tst-pthread-affinity-inheritance Both tests were failing because they are claiming that the CPU affinity mask was not correctly inherited in the forked process/thread. The error already happened before forking, as the mask was set up to use CPUs 0-14 in set_cpu_mask(). But according to e.g. lscpu or the line "Cpus_allowed_list" in /proc/self/status, only the following CPUs were in mask at startup: 0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30 while 1, 3, 5, ... were configured, but not online. Now the test first gets the current CPU mask at startup in do_test() and set_cpu_mask() only selects those available CPUs. The test is now just counting the available CPUs instead of relying on get_nprocs(). This allows to run the test even if it was already limited via taskset. Therefore both concrete tests now have the get_my_affinity() function. This also allows to implement verify_my_affinity() in the common skeleton. In order to ensure that the affinity mask is really set as expected, verify_my_affinity() is now also called before forking a new process or creating a new thread. For also printing the list of mismatched CPU IDs in xor_set in verify_my_affinity(), the argument order of CPU_ISSET_S is now fixed. Furthermore we now keep iterating over all configured CPUs to print the list of cpucount IDs instead of iterating over the first nproc CPUs. Reviewed-by: Florian Weimer commit c4a81e882e607a34d0c26caf279c98398e9c1e4d Author: Samuel Thibault Date: Tue Feb 3 23:04:58 2026 +0000 hurd: Take cancel_lock in critical section read/write etc. shall be signal-safe, and take cancel_lock, so we have to defer signal delivery while holding cancel_lock. Reported-by: Michael Banck commit 9054973ce6e87a1e55556043bd96f36cd2cdb9b7 Author: Adhemerval Zanella Date: Wed Dec 31 12:38:25 2025 -0300 malloc: Extend malloc function hiding to tst-memalign-{2,3} (BZ #32366) clang 21 optimize out memalign. Checked on x86_64-linux-gnu with gcc-15 and clang-21. commit cec336bac7151b0b88e724fee1571bdb1fc5ecc6 Author: Adhemerval Zanella Date: Wed Feb 4 11:03:20 2026 -0300 elf: Build tst-gnu2-tls2 iff compiler supports TLS descriptor The test modules are built with -mtls-dialect=$(have-test-mtls-descriptor), similar to tst-gnu2-tls1. Checked on x86_64-linux-gnu. commit 22f9d87fcf0757bd0050e34c0f3a1441d685228b Author: Jiamei Xie Date: Wed Feb 4 09:46:07 2026 +0100 x86: Fix for cache computation on Hygon under hypervisors On Hygon CPUs, glibc currently relies on CPUID leaf 0x8000001D to compute cache parameters. This works correctly on bare-metal systems. However, under some hypervisors (e.g. QEMU with -cpu qemu64), the maximum supported extended CPUID leaf is only 0x8000000A, and CPUID 0x8000001D is not exposed. In this case, cache information computed via 0x8000001D is zeroed out. This patch introduces legacy fallback of cache computation based on CPUID 0x80000005 and 0x80000006, consistent with the AMD implementation, to restore correct cache information under such environments. Signed-off-by: Jiamei Xie Reviewed-by: H.J. Lu commit fff40098b0716bdd5b1dcd848ff25a2da6c33be2 Author: Florian Weimer Date: Wed Feb 4 09:46:07 2026 +0100 support: Also put libaudit, libcap into the testroot if present Some configurations of nscd are linked against those libraries. commit 4bea40d7c8749a915a6d38f08aa1b44f5628cd8a Author: Florian Weimer Date: Wed Feb 4 09:46:07 2026 +0100 Rules: Set up test infrastructure if tests-container is set Previously, if a subdirectory had only container-based tests (via tests-container), the Makefile rules for the test infrastructure were excluded. commit 8fe63ae3142ee69ad0899ce2d25111bc4f9012d1 Author: Samuel Thibault Date: Tue Feb 3 21:54:35 2026 +0000 hurd: Test FPU preservation on double-signal delivery This test was fixed by 826484111a ("hurd: handling pending signals could result in corruption of FPU state.") commit 826484111a81295056a98507a493876cd31cb21d Author: Mike Kelly Date: Mon Feb 2 07:25:02 2026 +0000 hurd: handling pending signals could result in corruption of FPU state Handling a pending signal calls _hurd_setup_sighandler() once again after the initial signal handling. In this case a pointer to the previous sigcontext is available to supply the interrupted thread's original basic state, fpu state and fpu XSTATE. The original XSTATE was not being preserved by the pending signal but instead overwritten with the active XSTATE. XSTATE register values modified by the signal handling code could therefore be wrongly propogated back to the interrupted user code. commit 67322498c4b2c2fca2be5e8c4561780631b35992 Author: Paul Eggert Date: Tue Feb 3 09:28:23 2026 -0800 gnulib: sync comment from upstream commit 707658b42887e611ea3710644784477a05120014 Author: Wilco Dijkstra Date: Tue Jan 27 14:28:35 2026 +0000 AArch64: Add if('fastmath') to math-vector-fortran.h [BZ #33226] Only enable vector math functions with -ffast-math by adding if('fastmath'). This uses a new annotation supported by GCC 16 (PR 118955). If an older compiler is used, it will disable the math function without an error. This fixes BZ #33226. commit 9399998f72921d58f56023cce0d706358f3449c0 Author: Weihong Ye Date: Tue Feb 3 17:09:03 2026 +0000 AArch64: Optimize memcpy for Kunpeng 950 processor For copies ≤64 bytes, the implementation remains consistent with memcpy_sve. For 65–128 bytes, it removes the 96-byte branch and reorders instructions, improving performance by 18–32%. For >128 bytes, it aligns the destination to a 32-byte boundary and uses Pre-indexed load/store instructions to reduce address-update overhead. All benchmarks report execution time (lower is better). Geomean results (__memcpy_generic → this patch): - bench-memcpy: 16.74 → 12.11 (28% faster) - bench-memcpy-large: 24287 → 23302 (4% faster) - bench-memcpy-random: 107693 → 72153 (33% faster) Reviewed-by: Wilco Dijkstra commit 0e47414ce87f3b088ff454fc6c7d1129ff9617ec Author: Andreas Schwab Date: Tue Feb 3 12:41:23 2026 +0100 Don't include directly (bug 33848) Headers from bits directories should never be included directly, only via the official headers. commit bcbd6736005876dadd3d4751cad509568bc4bf28 Author: Collin Funk Date: Sun Jan 25 18:52:34 2026 -0800 posix: avoid a cast in regex syntax bit definitions The cast doesn't have any benefit over using a UL suffix and prevents the macro from being used in preprocessor directives. Reviewed-by: Arjun Shankar commit 364426a59ee30ee3e528e5b5cae36b5dee045320 Author: Florian Weimer Date: Mon Feb 2 21:15:48 2026 +0100 elf: Add test case for LD_PROFILE/LD_PROFILE_OUTPUT interaction This verifies that LD_PROFILE is correctly ignored if LD_PROFILE_OUTPUT is not set. The test was initially auto-generated, then heavily edited and re-edited for brevity and clarity. The test uses glibc-specific interfaces (including one that did not exist at all a couple of hours ago), so this should be unproblematic. commit 229f65f5f322609283c7104c80c8af6434dff628 Author: Florian Weimer Date: Mon Feb 2 21:15:48 2026 +0100 support: Add support_spawn_wrap and related functionality It allows us to write test cases in C that run tests with dynamic linker wrapping. The iconv test case was auto-generated. The posix_spawn usage is mechanical, and the interface it tests is newly added in this commit, so this should be acceptable. Reviewed-by: Adhemerval Zanella commit ba0fedc2b9412792a410ca580da221f4e5c36599 Author: Adhemerval Zanella Date: Tue Jan 20 10:11:10 2026 -0300 arm: Fix tst-gnu2-tls2 On armv7a vfpv4 tst-gnu2-tls2 fails with: open tst-gnu2-tls2mod0.so open tst-gnu2-tls2mod1.so open tst-gnu2-tls2mod2.so close tst-gnu2-tls2mod0.so close tst-gnu2-tls2mod1.so open tst-gnu2-tls2mod0.so open tst-gnu2-tls2mod1.so Didn't expect signal from child: got `Aborted' Because AFTER_TLSDESC_CALL might clobber caller-saved registers and the zero array might call the memset function resolution, which itself might clobber some vector registers. The AFTER_TLSDESC_CALL calls memset and memcmp, and both the lazy resolution and the routines themselves can clobber the caller-saved registes used in the tests. Checked on arm-linux-gnueabihf (armv7-a vpfv4 / QEMU). Reviewed-by: Florian Weimer commit f8dac91ca3b4123e8c853b1bf6b126ad6829687e Author: Luca Boccassi Date: Wed Jan 28 15:37:56 2026 +0000 linux: use PIDFD_GET_INFO ioctl for pidfd_getpid() if available Linux v6.13 introduced a new ioctl to query info from a pidfd. The advantage of this vs. parsing /proc/ is that it works even when procfs is not mounted. It's also a single syscall, and doesn't need manual string parsing. Use it when available. Signed-off-by: Luca Boccassi Reviewed-by: Adhemerval Zanella commit 19e84d59a40d93720883bc54dae0c09e07760b5a Author: Avinal Kumar Date: Mon Jan 5 18:59:27 2026 +0530 elf: Fix ambiguous error message for --f in sotruss [BZ #25257] The sotruss utility printed an incomplete error message when the ambiguous option --f was used. The message did not list the possible matching options, making it unclear how to resolve the ambiguity. This commit corrects the error message to report all valid alternatives. Example after this change: $ sotruss --f /bin/true sotruss: option '--f' is ambiguous; possibilities: '--from' '--follow' Try `sotruss --help' or `sotruss --usage' for more information. This fixes BZ #25257. Signed-off-by: Avinal Kumar Suggested-by: Carlos Santos Reviewed-by: Adhemerval Zanella commit d8d261566658f59e98d121b1be28a525e3488370 Author: Adhemerval Zanella Date: Fri Jan 23 10:02:26 2026 -0300 powerpc: Add math-use-builtins-f{max,min}.h ISA 2.06 (POWER7) added xsmindp/xsmaxdp, but we can only use the builtin for GCC 14+ [1] Checked on powerpc64le-linux-gnu. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103605 Reviewed-by: Wilco Dijkstra commit 1405c0fe2dace23a895cf7c0cc3586b03a95f8e0 Author: Adhemerval Zanella Date: Fri Jan 23 10:02:25 2026 -0300 math: Optimize f{max,min}imum_mag_num{f,l,f128} Simplify order signal comparison and reorganize check to reduce branches and allow targets to use conditional select/move. With gcc-15 on aarch64 for fmaximum_mag_num: * master: 0000000000000000 <__fmaximum_mag_num>: 0: d503245f bti c 4: 1e60c004 fabs d4, d0 8: 1e60c023 fabs d3, d1 c: 1e632080 fcmp d4, d3 10: 5400008d b.le 20 <__fmaximum_mag_num+0x20> 14: 1e60401f fmov d31, d0 18: 1e6043e0 fmov d0, d31 1c: d65f03c0 ret 20: 54000085 b.pl 30 <__fmaximum_mag_num+0x30> // b.nfrst 24: 1e60403f fmov d31, d1 28: 1e6043e0 fmov d0, d31 2c: d65f03c0 ret 30: 54000161 b.ne 5c <__fmaximum_mag_num+0x5c> // b.any 34: 4f000402 movi v2.4s, #0x0 38: 1e6e101d fmov d29, #1.000000000000000000e+00 3c: 6ee0f842 fneg v2.2d, v2.2d 40: 4ea21c5e mov v30.16b, v2.16b 44: 2e7d1c22 bsl v2.8b, v1.8b, v29.8b 48: 2e7d1c1e bsl v30.8b, v0.8b, v29.8b 4c: 1e6223d0 fcmpe d30, d2 50: 1e61ac1f fcsel d31, d0, d1, ge // ge = tcont 54: 1e6043e0 fmov d0, d31 58: d65f03c0 ret 5c: 1e612020 fcmp d1, d1 60: 1e60403f fmov d31, d1 64: 54ffff87 b.vc 54 <__fmaximum_mag_num+0x54> 68: 1e602000 fcmp d0, d0 6c: 1e60401f fmov d31, d0 70: 54ffff27 b.vc 54 <__fmaximum_mag_num+0x54> 74: 1e61281f fadd d31, d0, d1 78: 17fffff7 b 54 <__fmaximum_mag_num+0x54> * patch: 0000000000000000 <__fminimum_mag_num>: 0: d503245f bti c 4: 1e612000 fcmp d0, d1 8: 1e60401f fmov d31, d0 c: 540000e6 b.vs 28 <__fminimum_mag_num+0x28> 10: 1e60c01e fabs d30, d0 14: 1e60c03d fabs d29, d1 18: 1e7d23c0 fcmp d30, d29 1c: 54000160 b.eq 48 <__fminimum_mag_num+0x48> // b.none 20: 1e605c20 fcsel d0, d1, d0, pl // pl = nfrst 24: d65f03c0 ret 28: 1e612020 fcmp d1, d1 2c: 1e604020 fmov d0, d1 30: 54ffffa7 b.vc 24 <__fminimum_mag_num+0x24> 34: 1e7f23e0 fcmp d31, d31 38: 1e6043e0 fmov d0, d31 3c: 54ffff47 b.vc 24 <__fminimum_mag_num+0x24> 40: 1e612be0 fadd d0, d31, d1 44: d65f03c0 ret 48: 9e660000 fmov x0, d0 4c: f100001f cmp x0, #0x0 50: 1e61bc00 fcsel d0, d0, d1, lt // lt = tstop 54: d65f03c0 ret Checked on x86_64-linux-gnu, aarch64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, riscv64-linux-gnu-rv64imafdc-lp64d, and loongarch64-linux-gnuf64. Reviewed-by: Wilco Dijkstra commit 8a7675663e03b73d6331f17f931762f8e2a33d2f Author: Adhemerval Zanella Date: Fri Jan 23 10:02:24 2026 -0300 math: Optimize f{max,min}imum_mag{f,l,f128} Simplify order signal comparison and reorganize check to reduce branches and allow targets to use conditional select/move. With gcc-15 on aarch64 for fmaximum_mag: * master: 0000000000000000 <__fmaximum_mag>: 0: d503245f bti c 4: 1e60c004 fabs d4, d0 8: 1e60c023 fabs d3, d1 c: 1e632080 fcmp d4, d3 10: 5400008d b.le 20 <__fmaximum_mag+0x20> 14: 1e60401f fmov d31, d0 18: 1e6043e0 fmov d0, d31 1c: d65f03c0 ret 20: 54000085 b.pl 30 <__fmaximum_mag+0x30> // b.nfrst 24: 1e60403f fmov d31, d1 28: 1e6043e0 fmov d0, d31 2c: d65f03c0 ret 30: 54000161 b.ne 5c <__fmaximum_mag+0x5c> // b.any 34: 4f000402 movi v2.4s, #0x0 38: 1e6e101d fmov d29, #1.000000000000000000e+00 3c: 6ee0f842 fneg v2.2d, v2.2d 40: 4ea21c5e mov v30.16b, v2.16b 44: 2e7d1c22 bsl v2.8b, v1.8b, v29.8b 48: 2e7d1c1e bsl v30.8b, v0.8b, v29.8b 4c: 1e6223d0 fcmpe d30, d2 50: 1e61ac1f fcsel d31, d0, d1, ge // ge = tcont 54: 1e6043e0 fmov d0, d31 58: d65f03c0 ret 5c: 1e61281f fadd d31, d0, d1 60: 1e6043e0 fmov d0, d31 64: d65f03c0 ret * patch: 0000000000000000 <__fmaximum_mag>: 0: d503245f bti c 4: 1e612000 fcmp d0, d1 8: 540000e6 b.vs 24 <__fmaximum_mag+0x24> c: 1e60c01f fabs d31, d0 10: 1e60c03e fabs d30, d1 14: 1e7e23e0 fcmp d31, d30 18: 540000a0 b.eq 2c <__fmaximum_mag+0x2c> // b.none 1c: 1e60dc20 fcsel d0, d1, d0, le 20: d65f03c0 ret 24: 1e612800 fadd d0, d0, d1 28: d65f03c0 ret 2c: 9e660000 fmov x0, d0 30: f100001f cmp x0, #0x0 34: 1e60bc20 fcsel d0, d1, d0, lt // lt = tstop 38: d65f03c0 ret Checked on x86_64-linux-gnu, aarch64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, riscv64-linux-gnu-rv64imafdc-lp64d, and loongarch64-linux-gnuf64. Reviewed-by: Wilco Dijkstra commit c3ced14f88924873762a9d0cb4561050b9839ce4 Author: Adhemerval Zanella Date: Fri Jan 23 10:02:23 2026 -0300 math: Optimize f{max,min}imum_num{f,l,f,f128} Add an isunordered check for fast-path and simplified sign check and use the fmax/fmin when possible. With gcc-15 on aarch64 for fmaximum_num: * master 0000000000000000 <__fmaximum_num>: 0: d503245f bti c 4: 1e612000 fcmp d0, d1 8: 5400008d b.le 18 <__fmaximum_num+0x18> c: 1e60401f fmov d31, d0 10: 1e6043e0 fmov d0, d31 14: d65f03c0 ret 18: 54000085 b.pl 28 <__fmaximum_num+0x28> // b.nfrst 1c: 1e60403f fmov d31, d1 20: 1e6043e0 fmov d0, d31 24: d65f03c0 ret 28: 54000161 b.ne 54 <__fmaximum_num+0x54> // b.any 2c: 4f000402 movi v2.4s, #0x0 30: 1e6e101e fmov d30, #1.000000000000000000e+00 34: 6ee0f842 fneg v2.2d, v2.2d 38: 4ea21c5d mov v29.16b, v2.16b 3c: 2e7e1c22 bsl v2.8b, v1.8b, v30.8b 40: 2e7e1c1d bsl v29.8b, v0.8b, v30.8b 44: 1e6223b0 fcmpe d29, d2 48: 1e61ac1f fcsel d31, d0, d1, ge // ge = tcont 4c: 1e6043e0 fmov d0, d31 50: d65f03c0 ret 54: 1e612020 fcmp d1, d1 58: 1e60403f fmov d31, d1 5c: 54ffff87 b.vc 4c <__fmaximum_num+0x4c> 60: 1e602000 fcmp d0, d0 64: 1e60401f fmov d31, d0 68: 54ffff27 b.vc 4c <__fmaximum_num+0x4c> 6c: 1e61281f fadd d31, d0, d1 70: 17fffff7 b 4c <__fmaximum_num+0x4c> * patch: 0000000000000000 <__fmaximum_num>: 0: d503245f bti c 4: 1e612000 fcmp d0, d1 8: 54000086 b.vs 18 <__fmaximum_num+0x18> c: 1e61681f fmaxnm d31, d0, d1 10: 1e6043e0 fmov d0, d31 14: d65f03c0 ret 18: 1e612020 fcmp d1, d1 1c: 1e60403f fmov d31, d1 20: 54ffff87 b.vc 10 <__fmaximum_num+0x10> 24: 1e602000 fcmp d0, d0 28: 1e60401f fmov d31, d0 2c: 54ffff27 b.vc 10 <__fmaximum_num+0x10> 30: 1e61281f fadd d31, d0, d1 34: 17fffff7 b 10 <__fmaximum_num+0x10> And with gcc-15 on x86_64: * master: 0000000000000000 <__fmaximum_num>: 0: 66 0f 2e c1 ucomisd %xmm1,%xmm0 4: 66 0f 28 d8 movapd %xmm0,%xmm3 8: 77 5e ja 68 <__fmaximum_num+0x68> a: 66 0f 2e c8 ucomisd %xmm0,%xmm1 e: 77 50 ja 60 <__fmaximum_num+0x60> 10: 66 0f 2e c1 ucomisd %xmm1,%xmm0 14: 7a 5a jp 70 <__fmaximum_num+0x70> 16: 75 58 jne 70 <__fmaximum_num+0x70> 18: f3 0f 7e 05 00 00 00 movq 0x0(%rip),%xmm0 # 20 <__fmaximum_num+0x20> 1f: 00 20: f2 0f 10 15 00 00 00 movsd 0x0(%rip),%xmm2 # 28 <__fmaximum_num+0x28> 27: 00 28: 66 0f 28 e0 movapd %xmm0,%xmm4 2c: 66 0f 54 15 00 00 00 andpd 0x0(%rip),%xmm2 # 34 <__fmaximum_num+0x34> 33: 00 34: 66 0f 54 c1 andpd %xmm1,%xmm0 38: 66 0f 54 e3 andpd %xmm3,%xmm4 3c: 66 0f 56 e2 orpd %xmm2,%xmm4 40: 66 0f 56 d0 orpd %xmm0,%xmm2 44: f2 0f c2 d4 02 cmplesd %xmm4,%xmm2 49: 66 0f 54 da andpd %xmm2,%xmm3 4d: 66 0f 55 d1 andnpd %xmm1,%xmm2 51: 66 0f 56 d3 orpd %xmm3,%xmm2 55: 66 0f 28 c2 movapd %xmm2,%xmm0 59: c3 ret 5a: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 60: 66 0f 28 c1 movapd %xmm1,%xmm0 64: c3 ret 65: 0f 1f 00 nopl (%rax) 68: c3 ret 69: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 70: 66 0f 2e c9 ucomisd %xmm1,%xmm1 74: 66 0f 28 c1 movapd %xmm1,%xmm0 78: 7b ea jnp 64 <__fmaximum_num+0x64> 7a: 66 0f 2e db ucomisd %xmm3,%xmm3 7e: 66 0f 28 c3 movapd %xmm3,%xmm0 82: 7b e0 jnp 64 <__fmaximum_num+0x64> 84: f2 0f 58 c1 addsd %xmm1,%xmm0 88: c3 ret * patch: 0000000000000000 <__fmaximum_num>: 0: 66 0f 2e c1 ucomisd %xmm1,%xmm0 4: 7a 2a jp 30 <__fmaximum_num+0x30> 6: 77 18 ja 20 <__fmaximum_num+0x20> 8: 66 0f 2e c8 ucomisd %xmm0,%xmm1 c: 77 08 ja 16 <__fmaximum_num+0x16> e: 66 0f 50 c0 movmskpd %xmm0,%eax 12: a8 01 test $0x1,%al 14: 74 0a je 20 <__fmaximum_num+0x20> 16: 66 0f 28 c1 movapd %xmm1,%xmm0 1a: c3 ret 1b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 20: 66 0f 28 c8 movapd %xmm0,%xmm1 24: 66 0f 28 c1 movapd %xmm1,%xmm0 28: c3 ret 29: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 30: 66 0f 2e c9 ucomisd %xmm1,%xmm1 34: 7b e0 jnp 16 <__fmaximum_num+0x16> 36: 66 0f 2e c0 ucomisd %xmm0,%xmm0 3a: 7b e4 jnp 20 <__fmaximum_num+0x20> 3c: f2 0f 58 c8 addsd %xmm0,%xmm1 40: eb d4 jmp 16 <__fmaximum_num+0x16> Checked on x86_64-linux-gnu, aarch64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, riscv64-linux-gnu-rv64imafdc-lp64d, and loongarch64-linux-gnuf64. Reviewed-by: Wilco Dijkstra commit a95db490b5acefda5dbb2ffbb1523af6b2d47dfa Author: Adhemerval Zanella Date: Fri Jan 23 10:02:22 2026 -0300 math: Optimize f{max,min}imum{f,l,f128} Add an isunordered check for fast-path and simplified sign check and use the fmax/fmin when possible. With gcc-15 on aarch64: * master: 0000000000000000 <__fmaximum>: 0: d503245f bti c 4: 1e612000 fcmp d0, d1 8: 5400008d b.le 18 <__fmaximum+0x18> c: 1e60401f fmov d31, d0 10: 1e6043e0 fmov d0, d31 14: d65f03c0 ret 18: 54000085 b.pl 28 <__fmaximum+0x28> // b.nfrst 1c: 1e60403f fmov d31, d1 20: 1e6043e0 fmov d0, d31 24: d65f03c0 ret 28: 54000161 b.ne 54 <__fmaximum+0x54> // b.any 2c: 4f000402 movi v2.4s, #0x0 30: 1e6e101e fmov d30, #1.000000000000000000e+00 34: 6ee0f842 fneg v2.2d, v2.2d 38: 4ea21c5d mov v29.16b, v2.16b 3c: 2e7e1c22 bsl v2.8b, v1.8b, v30.8b 40: 2e7e1c1d bsl v29.8b, v0.8b, v30.8b 44: 1e6223b0 fcmpe d29, d2 48: 1e61ac1f fcsel d31, d0, d1, ge // ge = tcont 4c: 1e6043e0 fmov d0, d31 50: d65f03c0 ret 54: 1e61281f fadd d31, d0, d1 58: 1e6043e0 fmov d0, d31 5c: d65f03c0 ret * patch: 0000000000000000 <__fmaximum>: 0: d503245f bti c 4: 1e612000 fcmp d0, d1 8: 54000086 b.vs 18 <__fmaximum+0x18> c: 1e61681f fmaxnm d31, d0, d1 10: 1e6043e0 fmov d0, d31 14: d65f03c0 ret 18: 1e61281f fadd d31, d0, d1 1c: 1e6043e0 fmov d0, d31 20: d65f03c0 ret And with gcc-15 on x86_64: * master: 0000000000000000 <__fmaximum>: 0: 66 0f 2e c1 ucomisd %xmm1,%xmm0 4: 77 56 ja 5c <__fmaximum+0x5c> 6: 66 0f 2e c8 ucomisd %xmm0,%xmm1 a: 77 4c ja 58 <__fmaximum+0x58> c: 66 0f 2e c1 ucomisd %xmm1,%xmm0 10: 7a 4e jp 60 <__fmaximum+0x60> 12: 75 4c jne 60 <__fmaximum+0x60> 14: f3 0f 7e 1d 00 00 00 movq 0x0(%rip),%xmm3 # 1c <__fmaximum+0x1c> 1b: 00 1c: f2 0f 10 15 00 00 00 movsd 0x0(%rip),%xmm2 # 24 <__fmaximum+0x24> 23: 00 24: 66 0f 28 e3 movapd %xmm3,%xmm4 28: 66 0f 54 15 00 00 00 andpd 0x0(%rip),%xmm2 # 30 <__fmaximum+0x30> 2f: 00 30: 66 0f 54 e0 andpd %xmm0,%xmm4 34: 66 0f 54 d9 andpd %xmm1,%xmm3 38: 66 0f 56 e2 orpd %xmm2,%xmm4 3c: 66 0f 56 d3 orpd %xmm3,%xmm2 40: f2 0f c2 d4 02 cmplesd %xmm4,%xmm2 45: 66 0f 54 c2 andpd %xmm2,%xmm0 49: 66 0f 55 d1 andnpd %xmm1,%xmm2 4d: 66 0f 56 c2 orpd %xmm2,%xmm0 51: c3 ret 52: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 58: 66 0f 28 c1 movapd %xmm1,%xmm0 5c: c3 ret 5d: 0f 1f 00 nopl (%rax) 60: f2 0f 58 c1 addsd %xmm1,%xmm0 64: c3 ret * patched: 0000000000000000 <__fmaximum>: 0: 66 0f 2e c1 ucomisd %xmm1,%xmm0 4: 7a 2a jp 30 <__fmaximum+0x30> 6: 77 18 ja 20 <__fmaximum+0x20> 8: 66 0f 2e c8 ucomisd %xmm0,%xmm1 c: 77 08 ja 16 <__fmaximum+0x16> e: 66 0f 50 c0 movmskpd %xmm0,%eax 12: a8 01 test $0x1,%al 14: 74 0a je 20 <__fmaximum+0x20> 16: 66 0f 28 c1 movapd %xmm1,%xmm0 1a: c3 ret 1b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 20: 66 0f 28 c8 movapd %xmm0,%xmm1 24: 66 0f 28 c1 movapd %xmm1,%xmm0 28: c3 ret 29: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 30: f2 0f 58 c8 addsd %xmm0,%xmm1 34: 66 0f 28 c1 movapd %xmm1,%xmm0 38: c3 ret Checked on x86_64-linux-gnu, aarch64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, riscv64-linux-gnu-rv64imafdc-lp64d, and loongarch64-linux-gnuf64. Reviewed-by: Wilco Dijkstra commit 822bb1127851fe2b3817481085220cd73a8998ad Author: Adhemerval Zanella Date: Fri Jan 23 10:02:21 2026 -0300 math: Order signed zeros in f{max,min}mag{f,l,f128} The functions are documented to behave like fmax/fmin when the arguments have the same absolute value. Checked on x86_64-linux-gnu, aarch64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, riscv64-linux-gnu-rv64imafdc-lp64d, and loongarch64-linux-gnuf64. Reviewed-by: Wilco Dijkstra commit bdb07a03fb2f7601ecba7264adb452d9355a93ef Author: Adhemerval Zanella Date: Fri Jan 23 10:02:20 2026 -0300 math: Order signed zeros in f{max,min}{f,l,f128} The C standard (at least from C99 until C23) does not require fmin/fmax to order zeros by their sign, so glibc's previous behavior was entirely standards-conforming. However, the standard does recommend that zeros be ordered in a footnote, saying: "If possible, fmax is sensitive to the sign of zero, for example fmax(−0.0, +0.0) ideally returns +0." As this is indeed possible (and not too complicated), implement it as a quality-of-implementation improvement. It also remove possible deviations between architectures, where for some architectures that has direct mapping instruction (USE_FMA*_BUILTIN) they already do the ordering. Checked on x86_64-linux-gnu, aarch64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, riscv64-linux-gnu-rv64imafdc-lp64d, and loongarch64-linux-gnuf64. Co-authored-by: James Y Knight Reviewed-by: Wilco Dijkstra commit d8658e02d55d563b5a064efce868b1a2cd2b44be Author: Adhemerval Zanella Date: Fri Jan 23 10:02:19 2026 -0300 i386: Remove f{max,min} assembly implementations The sNaN handling on i386 was not properly implemented or tested due to ABI and compiler constraints [1] [2], and although GCC has an open bug to try to fix at least the sNaN in the function call arguments [3], it will most likely never be fixed. To simplify the fix or the order signed zeros and make f{fmin,fmax} behave semantically equal to the rest of the f{min,max}* function, this patch removes all i386 assembly optimizations. The f{min,max} functions should not be hotspots in any meaningful code people are running on i386 nowadays. Checked on i686-linux-gnu. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=57484#c11 [2] https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5aa4a1a1fd742479818a668d42d91ca9ec4a6318 [3] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56831 Reviewed-by: Wilco Dijkstra commit cef254944c5e59f24a53c00dd2cabae59099fa7d Author: Adhemerval Zanella Date: Fri Jan 23 10:02:18 2026 -0300 x86_64: Remove f{max,min} assembly implementations Using recent gcc, the generic implementation generates the same code for normal and subnormal numbers for float/double. For long double, the generic implementations generates slight worse code for the fast-path. With gcc-15: * sysdeps/x86_64/fpu/s_fmaxl.S fldt 8(%rsp) fldt 24(%rsp) fucomi %st(1), %st jp 2f fcmovb %st(1), %st fstp %st(1) ret * generic fldt 0x8(%rsp) fldt 0x18(%rsp) fucomi %st(1),%st jp 18 <__fmaxl+0x18> fxch %st(1) fcomi %st(1),%st fcmovbe %st(1),%st fstp %st(1) ret It could be optimized by using isgreater instead of a direct comparison for the non unordered, but this prevents x86 to issue maxsd. Checked on x86_64-linux-gnu. Reviewed-by: Wilco Dijkstra commit 6bbe7ae5f3a7ebda2c559de1b8d21f738633d3d2 Author: Adhemerval Zanella Date: Fri Jan 23 10:02:17 2026 -0300 math: Simplify f{max,min}mag template On aarch64 with gcc-15 it optimizes the fast-path slightly, for fmaxmag: * master 0000000000000000 <__fmaxmag>: 0: d503245f bti c 4: 1e60c01e fabs d30, d0 8: 1e60c03f fabs d31, d1 c: 1e7f23c0 fcmp d30, d31 10: 5400004d b.le 18 <__fmaxmag+0x18> 14: d65f03c0 ret 18: 54000065 b.pl 24 <__fmaxmag+0x24> // b.nfrst 1c: 1e604020 fmov d0, d1 20: d65f03c0 ret 24: 540001e0 b.eq 60 <__fmaxmag+0x60> // b.none [...] 60: 1e612010 fcmpe d0, d1 64: 1e61cc00 fcsel d0, d0, d1, gt 68: d65f03c0 ret * patch: 0000000000000000 <__fmaxmag>: 0: d503245f bti c 4: 1e612000 fcmp d0, d1 8: 540000e6 b.vs 24 <__fmaxmag+0x24> c: 1e60c01f fabs d31, d0 10: 1e60c03e fabs d30, d1 14: 1e7e23e0 fcmp d31, d30 18: 540001c0 b.eq 50 <__fmaxmag+0x50> // b.none 1c: 1e60dc20 fcsel d0, d1, d0, le 20: d65f03c0 ret [...] 50: 1e612010 fcmpe d0, d1 54: 1e61cc00 fcsel d0, d0, d1, gt 58: d65f03c0 ret [...] Checked on x86_64-linux-gnu, aarch64-linux-gnu, i686-linux-gnu, arm-linux-gnueabihf, powerpc64le-linux-gnu, riscv64-linux-gnu-rv64imafdc-lp64d, and loongarch64-linux-gnuf64. Reviewed-by: Wilco Dijkstra commit 92ff5e9d91ecda28f916447a8c1ffb30bad2779c Author: Adhemerval Zanella Date: Fri Jan 23 10:02:16 2026 -0300 math: Simplify f{max,min} template On x86_64, it allows the fast path (normal/subnormal inputs) to use maxsd. With gcc-15 targetting x86_64 for fmax: * master: ucomisd xmm0, xmm1 jnb .L1 ucomisd xmm1, xmm0 ja .L13 [...] .L13: movapd xmm0, xmm1 .L1: ret * patch; ucomisd xmm0, xmm1 jp .L2 maxsd xmm0, xmm1 ret Reviewed-by: Wilco Dijkstra commit b9fc08c0a9fe447502dd99a8fa9c4cf377c19b63 Author: Adhemerval Zanella Date: Fri Jan 23 10:02:15 2026 -0300 x86: Add __issignalingl inline Checked on x86_64-linux-gnu. Reviewed-by: Wilco Dijkstra commit 570fc094c3d159c31cafaf0f6275a6c1c063ceea Author: Wilco Dijkstra Date: Fri Jan 23 10:02:14 2026 -0300 math: Add __issignaling inline Add __issignaling inline based on the issignaling_inline implementation. Improve the __issignalingf inline. Remove issignaling(f)_inline and its uses. Reviewed-by: Adhemerval Zanella Co-authored-by: Adhemerval Zanella commit 1dd9951d85bc84ec104dda97fd1d3c5e8166f49e Author: Avinal Kumar Date: Mon Feb 2 16:26:13 2026 +0100 manual: Document //TRANSLIT and //IGNORE support in iconv_open [BZ #3794] The //TRANSLIT and //IGNORE suffix supported by iconv_open was not documented in the glibc manual. This commit adds the documentation for the suffixes. This fixes BZ #3794. Signed-off-by: Avinal Kumar Reviewed-by: Florian Weimer commit caab55393aa686ba78bb1cb5803a447bf53b5290 Author: Florian Weimer Date: Mon Feb 2 15:20:57 2026 +0100 manual: Document that iconv buffers may not overlap As discussed here: Re: [bug-gnu-libiconv] iconv and overlapping input/output buffers Reviewed-by: Collin Funk commit 67494ceb5d4b4ea59e9c360bbcd22447bd2329f5 Author: Alejandro Colomar Date: Tue Nov 11 14:29:28 2025 +0100 stdio-common: Assume support for 'long long' GCC supports 'long long' since essentially forever. Signed-off-by: Alejandro Colomar Reviewed-by: Paul Eggert Reviewed-by: Collin Funk commit 9513e9e5a45fd1c6165c115f43f103f93e7a7faa Author: Samuel Thibault Date: Sat Jan 31 17:04:53 2026 +0100 hurd: copy over start/end and entry too on fork gdb needs them to properly find libraries etc. commit ed3d8dd2b3738e67db7628d0d4212db6342fdb36 Author: Collin Funk Date: Tue Jan 27 23:44:51 2026 -0800 manual: Fix some typos in the Threads chapter. commit 2415a06f971ef84c6c0e8dec44d68a509e0ca82b Author: Collin Funk Date: Tue Jan 27 23:40:22 2026 -0800 manual: Fix some typos in the Low-Level Terminal Interface chapter. commit 39d9fa9e313308afa44b2b4843f8442e0ae1c067 Author: Yao Zihong Date: Mon Jan 26 15:28:00 2026 -0600 riscv: Disable multiarch memset variants when !IS_IN(libc) This patch disables multiarch memset variants when !IS_IN(libc), because rtld can only use a single fixed implementation. Signed-off-by: Yao Zihong Reviewed-by: Adhemerval Zanella commit 343b7918da135032a85d677ca3edf8d5a42acbbf Author: Yao Zihong Date: Mon Jan 26 15:24:40 2026 -0600 riscv: Disable multiarch memcpy variants when !IS_IN(libc) This patch disables multiarch memcpy variants when !IS_IN(libc), because rtld can only use a single fixed implementation. Signed-off-by: Yao Zihong Reviewed-by: Adhemerval Zanella commit bed2db02f3183e93f21d506786c5f884a1dec9e7 Author: Florian Weimer Date: Mon Jan 26 17:12:37 2026 +0100 posix: Run tst-wordexp-reuse-mem test The test was not properly scheduled for execution with a Makefile dependency. Fixes commit 80cc58ea2de214f85b0a1d902a3b668ad2ecb302 ("posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281 / BZ 33814"). commit f99481e75e4913357a3d4269c8f365ecdc5cf8ea Author: Florian Weimer Date: Mon Jan 26 16:56:45 2026 +0100 manual: Updates for the dynamic linker hardening recommendations This update addresses text relocations, and clarifies constructor/destructor priorities by mentioning the relevant GCC attributes. commit b52619f2e8bbae57d79c95538346198c4a9f24a6 Author: Arjun Shankar Date: Mon Jan 26 13:49:37 2026 +0100 dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (bug #24298) The existing dlinfo request type RTLD_DI_ORIGIN used for querying the value of the '$ORIGIN' dynamic string token is prone to buffer overflows. This commit adds a new request type named RTLD_DI_ORIGIN_PATH that returns a pointer to the dynamic string token (i.e. the 'l_origin' field in the link map) instead. The dlinfo manual is updated with the new request type, and the description of RTLD_DI_ORIGIN is updated to recommend RTLD_DI_ORIGIN_PATH instead. A test for the new request type is also added to tst-dlinfo. Reviewed-by: Carlos O'Donell commit bad2da7f779dbabb0e2e2c73037489e9f161183e Author: Andreas K. Hüttel Date: Mon Jan 26 01:29:30 2026 +0100 po: Incorporate translatins (nl updated, ar new) Signed-off-by: Andreas K. Hüttel commit 6f4b28b20aa9161aeb42a7f34f4d3b96194e5666 Author: Aurelien Jarno Date: Tue Jan 20 18:25:08 2026 +0100 Fix ldbl-128ibm ceill, floorl, roundl and truncl zero-sign handling When the result of ceill, floorl, roundl and truncl is zero, the sign of the result must match the sign of the input. For the IBM 128-bit long double format, the sign is determined by the high part. Ensure the correct sign when the high part is the result of computations, by copying the sign from the input high part to the output high part. On POWER, this conveniently maps to the fcpsgn instruction. In addition add test for the values provided in BZ #33623, and for the opposite value when the result is 0. Fixes: BZ #33623 Reviewed-by: Adhemerval Zanella commit 8faea5cda6d7bf995402e6aeaa1d7fda3844660a Author: Florian Weimer Date: Sat Jan 24 10:29:39 2026 +0100 malloc: Correct Makefile sorting glitches Reviewed-by: Adhemerval Zanella commit 458a6a2b935f60a25a136846fe8b7a4723296dda Author: Florian Weimer Date: Sat Jan 24 10:29:39 2026 +0100 support: Reinitialize containers if /etc is present This prevents test failures because configuration file leftovers unexpectedly change glibc for future tests. Whether this triggers depends on test execution order. Adding postclean.req files manually (before this change) appears too error-prone. Reviewed-by: DJ Delorie commit e8502182f09211663c1583960442eb6ff502a33e Author: Florian Weimer Date: Sat Jan 24 10:29:22 2026 +0100 support: Add support_hardcoded_paths_in_test It indicates whether glibc was configured with --enable-hardcoded-path-in-tests. Reviewed-by: Adhemerval Zanella commit 34d98aea6c1eaf7750a992bae55b2bca24898eab Author: Florian Weimer Date: Sat Jan 24 10:29:22 2026 +0100 support: Fix memory leaks in support_subprogram, support_subprogram_wait Reviewed-by: Adhemerval Zanella commit 0df04c5b0df45a3acf219c749d34eccd6639693a Author: Florian Weimer Date: Sat Jan 24 10:29:22 2026 +0100 stdlib: Do not run tst-system subtest with RLIMIT_NPROC as root RLIMIT_NPROC is typically ignored by root users with capabilities. Reviewed-by: Collin Funk commit ae2192ee90c8dab57cfd985f24df6b959f02bcc3 Author: Andreas K. Hüttel Date: Fri Jan 23 23:51:31 2026 +0100 version.h: Increase version number Signed-off-by: Andreas K. Hüttel commit 5a836551bc0e23e1f35faa6f5bfd6eeb041d34a8 Author: Andreas K. Hüttel Date: Fri Jan 23 23:50:10 2026 +0100 NEWS: add 2.44 section Signed-off-by: Andreas K. Hüttel