commit 8cce7727ac3250f1d83454f74cdd983de9bdc1ce (HEAD -> gentoo/2.33, gentoo/gentoo/2.33)
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Jan 24 18:14:24 2022 +0100

    Linux: Detect user namespace support in io/tst-getcwd-smallbuff
    
    Otherwise the test fails with certain container runtimes.
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 5b8e7980c5dabd9aaefeba4f0208baa8cf7653ee)
    (cherry picked from commit 48d9161e026604bfb1b186627d5b87c6e829a888)

 sysdeps/unix/sysv/linux/tst-getcwd-smallbuff.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

commit b5598c7e31a398ba2ccc1b9b63308b98a862eef8
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Mon Jan 24 21:36:41 2022 +0530

    realpath: Avoid overwriting preexisting error (CVE-2021-3998)
    
    Set errno and failure for paths that are too long only if no other error
    occurred earlier.
    
    Related: BZ #28770
    
    Reviewed-by: Andreas Schwab <schwab@linux-m68k.org>
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 84d2d0fe20bdf94feed82b21b4d7d136db471f03)
    (cherry picked from commit 41980af2d77ecaef34ef5470dc76f6137279e47f)

 stdlib/canonicalize.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 867220ea5ec64d1c482e486c99a1c06d5b03e08b
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Fri Jan 21 23:32:56 2022 +0530

    getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999)
    
    No valid path returned by getcwd would fit into 1 byte, so reject the
    size early and return NULL with errno set to ERANGE.  This change is
    prompted by CVE-2021-3999, which describes a single byte buffer
    underflow and overflow when all of the following conditions are met:
    
    - The buffer size (i.e. the second argument of getcwd) is 1 byte
    - The current working directory is too long
    - '/' is also mounted on the current working directory
    
    Sequence of events:
    
    - In sysdeps/unix/sysv/linux/getcwd.c, the syscall returns ENAMETOOLONG
      because the linux kernel checks for name length before it checks
      buffer size
    
    - The code falls back to the generic getcwd in sysdeps/posix
    
    - In the generic func, the buf[0] is set to '\0' on line 250
    
    - this while loop on line 262 is bypassed:
    
        while (!(thisdev == rootdev && thisino == rootino))
    
      since the rootfs (/) is bind mounted onto the directory and the flow
      goes on to line 449, where it puts a '/' in the byte before the
      buffer.
    
    - Finally on line 458, it moves 2 bytes (the underflowed byte and the
      '\0') to the buf[0] and buf[1], resulting in a 1 byte buffer overflow.
    
    - buf is returned on line 469 and errno is not set.
    
    This resolves BZ #28769.
    
    Reviewed-by: Andreas Schwab <schwab@linux-m68k.org>
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    Signed-off-by: Qualys Security Advisory <qsa@qualys.com>
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e)
    (cherry picked from commit bcdde07537d733eafe1f28cea3084003e140f5ff)

 NEWS                                           |   7 +
 sysdeps/posix/getcwd.c                         |   7 +
 sysdeps/unix/sysv/linux/Makefile               |   7 +-
 sysdeps/unix/sysv/linux/tst-getcwd-smallbuff.c | 241 +++++++++++++++++++++++++
 4 files changed, 261 insertions(+), 1 deletion(-)

commit 8db1bafea735b3df05b6a5af2562a853e3ab7772
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Wed Mar 10 12:26:30 2021 -0300

    support: Add xclone
    
    It is a wrapper for Linux clone syscall, to simplify the call to the
    use only the most common arguments and remove architecture specific
    handling (such as ia64 different name and signature).
    
    (cherry picked from commit de8995a2a04163617c1a233b4b81356ef9f9741f)
    (cherry picked from commit 46a70c49ba5a40059c76d5df387ff6e3b045de21)

 support/Makefile |  1 +
 support/xclone.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 support/xsched.h | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 85 insertions(+)

commit 0ab79a0495a71b5998c8745578a0439a13959808
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Mon Jan 24 10:57:09 2022 +0530

    tst-realpath-toolong: Fix hurd build
    
    Define PATH_MAX to a constant if it isn't already defined, like in hurd.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 976db046bc3a3738f69255ae00b0a09b8e77fd9c)
    (cherry picked from commit f63cb3cf721d7ef4b98178e1be2164b5e9280579)

 stdlib/tst-realpath-toolong.c | 4 ++++
 1 file changed, 4 insertions(+)

commit 1a45595eb5910b85aa164729ebd41b78db6621fb
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Thu Jan 13 11:28:36 2022 +0530

    realpath: Set errno to ENAMETOOLONG for result larger than PATH_MAX [BZ #28770]
    
    realpath returns an allocated string when the result exceeds PATH_MAX,
    which is unexpected when its second argument is not NULL.  This results
    in the second argument (resolved) being uninitialized and also results
    in a memory leak since the caller expects resolved to be the same as the
    returned value.
    
    Return NULL and set errno to ENAMETOOLONG if the result exceeds
    PATH_MAX.  This fixes [BZ #28770], which is CVE-2021-3998.
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit ee8d5e33adb284601c00c94687bc907e10aec9bb)
    (cherry picked from commit e41e5b97e340e1bb6c23c0af3a36a8e12a9f25ff)

 NEWS                          |  5 +++++
 stdlib/Makefile               |  3 ++-
 stdlib/canonicalize.c         | 12 +++++++++--
 stdlib/tst-realpath-toolong.c | 49 +++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 66 insertions(+), 3 deletions(-)

commit 728f00893cd879f3a99ec82fa0a105d8991ca3bf
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Jan 18 13:29:36 2022 +0530

    support: Add helpers to create paths longer than PATH_MAX
    
    Add new helpers support_create_and_chdir_toolong_temp_directory and
    support_chdir_toolong_temp_directory to create and descend into
    directory trees longer than PATH_MAX.
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit fb7bff12e81c677a6622f724edd4d4987dd9d971)
    (cherry picked from commit e081bafcb132ad48911f85d4410cbafb277f8b03)

 support/temp_file.c | 161 ++++++++++++++++++++++++++++++++++++++++++++++++----
 support/temp_file.h |   9 +++
 2 files changed, 160 insertions(+), 10 deletions(-)

commit 90a44fd889f3d07615cf5267d343835ec033c2e1
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Jun 25 08:02:30 2021 +0200

    elf: Fix glibc-hwcaps priorities with cache flags mismatches [BZ #27046]
    
    If lib->flags (in the cache) did not match GLRO (dl_correct_cache_id),
    searching for further glibc-hwcaps entries did not happen, and it
    was possible that the best glibc-hwcaps was not found.  By accident,
    this causes a test failure for elf/tst-glibc-hwcaps-prepend-cache
    on armv7l.
    
    This commit changes the cache lookup logic to continue searching
    if (a) no match has been found, (b) a named glibc-hwcaps match
    has been found(), or (c) non-glibc-hwcaps match has been found
    and the entry flags and cache default flags do not match.
    
    _DL_CACHE_DEFAULT_ID is used instead of GLRO (dl_correct_cache_id)
    because the latter is only written once on i386 if loading
    of libc.so.5 libraries is selected, so GLRO (dl_correct_cache_id)
    should probably removed in a future change.
    
    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
    (cherry picked from commit 66db95b6e8264c5a6307f6a9e5285fec76907254)
    (cherry picked from commit ac148bdd88403b66faf71466dc999c4f4b6dea0a)

 elf/dl-cache.c | 124 ++++++++++++++++++++++++++++-----------------------------
 1 file changed, 60 insertions(+), 64 deletions(-)

commit d44c9baa829b5c498efa554680333ecd520fd19d
Author: Paul A. Clarke <pc@us.ibm.com>
Date:   Sat Sep 25 09:57:15 2021 -0500

    powerpc: Fix unrecognized instruction errors with recent binutils
    
    Recent versions of binutils (with commit
    b25f942e18d6ecd7ec3e2d2e9930eb4f996c258a) stopped preserving "sticky"
    options across a base `.machine` directive, nullifying the use of
    passing "-many" through GCC to the assembler.  As a result, some
    instructions which were recognized even under older, more stringent
    `.machine` directives become unrecognized instructions in that
    context.
    
    In `sysdeps/powerpc/tst-set_ppr.c`, the use of the `mfppr32` extended
    mnemonic became unrecognized, as the default compilation with GCC for
    32bit powerpc adds a `.machine ppc` in the resulting assembly, so the
    command line option `-Wa,-many` is essentially ignored, and the ISA 2.06
    instructions and mnemonics, like `mfppr32`, are unrecognized.
    
    The compilation of `sysdeps/powerpc/tst-set_ppr.c` fails with:
    Error: unrecognized opcode: `mfppr32'
    
    Add appropriate `.machine` directives in the assembly to bracket the
    `mfppr32` instruction.
    
    Part of a 2019 fix (commit 9250e6610fdb0f3a6f238d2813e319a41fb7a810) to
    the above test's Makefile to add `-many` to the compilation when GCC
    itself stopped passing `-many` to the assember no longer has any effect,
    so remove that.
    
    Reported-by: Joseph Myers <joseph@codesourcery.com>
    (cherry picked from commit ee874f44fd55988808a4a162ef21bfa2cc8dc6f7)
    (cherry picked from commit 5cab4e3f3a623d2c9ad7cd64e4dde48095aa2383)

 sysdeps/powerpc/Makefile      | 5 -----
 sysdeps/powerpc/tst-set_ppr.c | 3 ++-
 2 files changed, 2 insertions(+), 6 deletions(-)

commit 0602db3e7dfa73b7f820206cec11b5e8aeea8d0a
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Jan 17 11:49:25 2022 +0100

    CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768)
    
    The sunrpc function svcunix_create suffers from a stack-based buffer
    overflow with overlong pathname arguments.
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit f545ad4928fa1f27a3075265182b38a4f939a5f7)
    (cherry picked from commit 0f70b829f8ede011c0851a7ce33f6e2d07632842)

 NEWS                  |  4 ++++
 sunrpc/Makefile       |  2 +-
 sunrpc/svc_unix.c     | 11 ++++-------
 sunrpc/tst-bug28768.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 51 insertions(+), 8 deletions(-)

commit ef608878558de53636271f57d1beac2c1b16ed3c
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Mar 9 21:07:24 2021 +0100

    <shlib-compat.h>: Support compat_symbol_reference for _ISOMAC
    
    This is helpful for testing compat symbols in cases where _ISOMAC
    is activated implicitly due to -DMODULE_NAME=testsuite and cannot
    be disabled easily.
    
    (cherry picked from commit 36f6e408845c8c539128f3fb9cb132bf1845a2c8)
    (cherry picked from commit 4f4452721d84fcdcc66ba427524bd646610281d9)

 include/libc-symbols.h | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

commit f9749d474dba3471125b8bbac9140dc8abca5a13
Author: Martin Sebor <msebor@redhat.com>
Date:   Mon Jan 17 10:21:34 2022 +0100

    sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542)
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit ef972a4c50014a16132b5c75571cfb6b30bef136)
    (cherry picked from commit dae9a8e7f6b7c8e35e63b43c0c046f885a6ede4b)

 sunrpc/Makefile       |  5 ++++-
 sunrpc/tst-bug22542.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 1 deletion(-)

commit cd1e69ed103640e4294f9c23c677a586278619bd
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Jan 17 10:21:34 2022 +0100

    CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix" (bug 22542)
    
    Processing an overlong pathname in the sunrpc clnt_create function
    results in a stack-based buffer overflow.
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 226b46770c82899b555986583294b049c6ec9b40)
    (cherry picked from commit 4653cd9e3669ff0a49908397e6f2a2eb8e572fdf)

 NEWS              |  5 +++++
 sunrpc/clnt_gen.c | 10 +++++++---
 2 files changed, 12 insertions(+), 3 deletions(-)

commit 32902b05b873ca6e00431f864e54a42cda2d8ef4
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Jan 17 10:21:34 2022 +0100

    socket: Add the __sockaddr_un_set function
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit e368b12f6c16b6888dda99ba641e999b9c9643c8)
    (cherry picked from commit f10e992e8d6c61f915c711f7bcc491ad2f10b06c)

 include/sys/un.h             | 12 +++++++++
 socket/Makefile              |  6 ++++-
 socket/sockaddr_un_set.c     | 41 +++++++++++++++++++++++++++++
 socket/tst-sockaddr_un_set.c | 62 ++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 120 insertions(+), 1 deletion(-)

commit f87f5ad5ceae933baafd8768e5dcbc94f2dfe51d
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Mon Jan 17 19:41:40 2022 +0100

    x86: use default cache size if it cannot be determined [BZ #28784]
    
    In some cases (e.g QEMU, non-Intel/AMD CPU) the cache information can
    not be retrieved and the corresponding values are set to 0.
    
    Commit 2d651eb9265d ("x86: Move x86 processor cache info to
    cpu_features") changed the behaviour in such case by defining the
    __x86_shared_cache_size and __x86_data_cache_size variables to 0 instead
    of using the default values. This cause an issue with the i686 SSE2
    optimized bzero/routine which assumes that the cache size is at least
    128 bytes, and otherwise tries to zero/set the whole address space minus
    128 bytes.
    
    Fix that by restoring the original code to only update
    __x86_shared_cache_size and __x86_data_cache_size variables if the
    corresponding cache sizes are not zero.
    
    Fixes bug 28784
    Fixes commit 2d651eb9265d
    
    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
    (cherry picked from commit c242fcce06e3102ca663b2f992611d0bda4f2668)
    (cherry picked from commit a51b76b71e8190a50b0e0c0b32f313888b930108)

 NEWS                    |  1 +
 sysdeps/x86/cacheinfo.h | 14 ++++++++++----
 2 files changed, 11 insertions(+), 4 deletions(-)

commit 9dc10fa72250680d5a29a98d542c10a9b03a875c
Author: Paul A. Clarke <pc@us.ibm.com>
Date:   Tue Sep 14 13:13:33 2021 -0500

    powerpc: Fix unrecognized instruction errors with recent GCC
    
    Recent binutils commit b25f942e18d6ecd7ec3e2d2e9930eb4f996c258a
    changes the behavior of `.machine` directives to override, rather
    than augment, the base CPU. This can result in _reduced_ functionality
    when, for example, compiling for default machine "power8", but explicitly
    asking for ".machine power5", which loses Altivec instructions.
    
    In tst-ucontext-ppc64-vscr.c, while the instructions provoking the new
    error messages are bracketed by ".machine power5", which is ostensibly
    Power ISA 2.03 (POWER5), the POWER5 processor did not support the
    VSX subset, so these instructions are not recognized as "power5".
    
    Error: unrecognized opcode: `vspltisb'
    Error: unrecognized opcode: `vpkuwus'
    Error: unrecognized opcode: `mfvscr'
    Error: unrecognized opcode: `stvx'
    
    Manually adding the VSX subset via ".machine altivec" is sufficient.
    
    Reviewed-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com>
    (cherry picked from commit 064b475a2e5662b6b3973fabf505eade86e61510)
    (cherry picked from commit 55b99e9ed07688019609bd4dcd17d3ebf4572948)

 sysdeps/powerpc/powerpc64/tst-ucontext-ppc64-vscr.c | 1 +
 1 file changed, 1 insertion(+)

commit 775f81c974bf7ca7a7379749a91e52be756aad25
Author: Matheus Castanho <msc@linux.ibm.com>
Date:   Wed Dec 1 11:14:40 2021 -0300

    powerpc64[le]: Allocate extra stack frame on syscall.S
    
    The syscall function does not allocate the extra stack frame for scv like other
    assembly syscalls using DO_CALL_SCV. So after commit d120fb9941 changed the
    offset that is used to save LR, syscall ended up using an invalid offset,
    causing regressions on powerpc64. So make sure the extra stack frame is
    allocated in syscall.S as well to make it consistent with other uses of
    DO_CALL_SCV and avoid similar issues in the future.
    
    Tested on powerpc, powerpc64, and powerpc64le (with and without scv)
    
    Reviewed-by: Raphael M Zinsly <rzinsly@linux.ibm.com>
    
    (cherry picked from commit ae91d3df24a4a1b1f264d101a71a298bff310d14)
    (cherry picked from commit c493f6a0e4dcd6fff22da0df9fb2e52ecf4ffff1)

 sysdeps/unix/sysv/linux/powerpc/syscall.S | 4 ++++
 1 file changed, 4 insertions(+)

commit bb0746096f99931c1c62afb8c75233ddbad1007e
Author: Nikita Popov <npv1310@gmail.com>
Date:   Tue Nov 2 13:21:42 2021 +0500

    gconv: Do not emit spurious NUL character in ISO-2022-JP-3 (bug 28524)
    
    Bugfix 27256 has introduced another issue:
    In conversion from ISO-2022-JP-3 encoding, it is possible
    to force iconv to emit extra NUL character on internal state reset.
    To do this, it is sufficient to feed iconv with escape sequence
    which switches active character set.
    The simplified check 'data->__statep->__count != ASCII_set'
    introduced by the aforementioned bugfix picks that case and
    behaves as if '\0' character has been queued thus emitting it.
    
    To eliminate this issue, these steps are taken:
    * Restore original condition
    '(data->__statep->__count & ~7) != ASCII_set'.
    It is necessary since bits 0-2 may contain
    number of buffered input characters.
    * Check that queued character is not NUL.
    Similar step is taken for main conversion loop.
    
    Bundled test case follows following logic:
    * Try to convert ISO-2022-JP-3 escape sequence
    switching active character set
    * Reset internal state by providing NULL as input buffer
    * Ensure that nothing has been converted.
    
    Signed-off-by: Nikita Popov <npv1310@gmail.com>
    (cherry picked from commit ff012870b2c02a62598c04daa1e54632e020fd7d)
    (cherry picked from commit c76a0ba878cac9e3e8ec54abbad9db28a50a369a)

 NEWS                      |  1 +
 iconvdata/Makefile        |  5 +++-
 iconvdata/bug-iconv15.c   | 60 +++++++++++++++++++++++++++++++++++++++++++++++
 iconvdata/iso-2022-jp-3.c | 28 +++++++++++++++-------
 4 files changed, 85 insertions(+), 9 deletions(-)

commit 0efaed28245ad21c55d9bbf89c7513cba648272a
Author: Matheus Castanho <msc@linux.ibm.com>
Date:   Tue Oct 26 10:44:59 2021 -0300

    powerpc64[le]: Fix CFI and LR save address for asm syscalls [BZ #28532]
    
    Syscalls based on the assembly templates are missing CFI for r31, which gets
    clobbered when scv is used, and info for LR is inaccurate, placed in the wrong
    LOC and not using the proper offset. LR was also being saved to the callee's
    frame, while the ABI mandates it to be saved to the caller's frame. These are
    fixed by this commit.
    
    After this change:
    
    $ readelf -wF libc.so.6 | grep 0004b9d4.. -A 7 && objdump --disassemble=kill libc.so.6
    00004a48 0000000000000020 00004a4c FDE cie=00000000 pc=000000000004b9d4..000000000004ba3c
       LOC           CFA      r31   ra
    000000000004b9d4 r1+0     u     u
    000000000004b9e4 r1+48    u     u
    000000000004b9e8 r1+48    c-16  u
    000000000004b9fc r1+48    c-16  c+16
    000000000004ba08 r1+48    c-16
    000000000004ba18 r1+48    u
    000000000004ba1c r1+0     u
    
    libc.so.6:     file format elf64-powerpcle
    
    Disassembly of section .text:
    
    000000000004b9d4 <kill>:
       4b9d4:       1f 00 4c 3c     addis   r2,r12,31
       4b9d8:       2c c3 42 38     addi    r2,r2,-15572
       4b9dc:       25 00 00 38     li      r0,37
       4b9e0:       d1 ff 21 f8     stdu    r1,-48(r1)
       4b9e4:       20 00 e1 fb     std     r31,32(r1)
       4b9e8:       98 8f ed eb     ld      r31,-28776(r13)
       4b9ec:       10 00 ff 77     andis.  r31,r31,16
       4b9f0:       1c 00 82 41     beq     4ba0c <kill+0x38>
       4b9f4:       a6 02 28 7d     mflr    r9
       4b9f8:       40 00 21 f9     std     r9,64(r1)
       4b9fc:       01 00 00 44     scv     0
       4ba00:       40 00 21 e9     ld      r9,64(r1)
       4ba04:       a6 03 28 7d     mtlr    r9
       4ba08:       08 00 00 48     b       4ba10 <kill+0x3c>
       4ba0c:       02 00 00 44     sc
       4ba10:       00 00 bf 2e     cmpdi   cr5,r31,0
       4ba14:       20 00 e1 eb     ld      r31,32(r1)
       4ba18:       30 00 21 38     addi    r1,r1,48
       4ba1c:       18 00 96 41     beq     cr5,4ba34 <kill+0x60>
       4ba20:       01 f0 20 39     li      r9,-4095
       4ba24:       40 48 23 7c     cmpld   r3,r9
       4ba28:       20 00 e0 4d     bltlr+
       4ba2c:       d0 00 63 7c     neg     r3,r3
       4ba30:       08 00 00 48     b       4ba38 <kill+0x64>
       4ba34:       20 00 e3 4c     bnslr+
       4ba38:       c8 32 fe 4b     b       2ed00 <__syscall_error>
            ...
       4ba44:       40 20 0c 00     .long 0xc2040
       4ba48:       68 00 00 00     .long 0x68
       4ba4c:       06 00 5f 5f     rlwnm   r31,r26,r0,0,3
       4ba50:       6b 69 6c 6c     xoris   r12,r3,26987
    
    (cherry picked from commit d120fb9941be1fb1934f0b50c6ad64e4c5e404fb)
    (cherry picked from commit 1cc490adca533549adffc68b938f5d0cbb9a0138)

 NEWS                               |  1 +
 sysdeps/powerpc/powerpc64/sysdep.h | 10 ++++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

commit f997040a0f70a9e1ff89211cfd8d22d67c7ce140
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Nov 24 08:59:54 2021 +0100

    nptl: Do not set signal mask on second setjmp return [BZ #28607]
    
    __libc_signal_restore_set was in the wrong place: It also ran
    when setjmp returned the second time (after pthread_exit or
    pthread_cancel).  This is observable with blocked pending
    signals during thread exit.
    
    Fixes commit b3cae39dcbfa2432b3f3aa28854d8ac57f0de1b8
    ("nptl: Start new threads with all signals blocked [BZ #25098]").
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    (cherry picked from commit e186fc5a31e46f2cbf5ea1a75223b4412907f3d8)
    (cherry picked from commit f9592d65f2eb7381ff0ff8b9b92ffc41e562fb0a)

 NEWS                                      |  1 +
 nptl/pthread_create.c                     |  4 +--
 sysdeps/pthread/Makefile                  |  1 +
 sysdeps/pthread/tst-pthread-exit-signal.c | 45 +++++++++++++++++++++++++++++++
 4 files changed, 49 insertions(+), 2 deletions(-)

commit 5f5ba762a83a2136ccf89dd6ddc0ce0b2dad766c
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Wed Jan 20 14:32:23 2021 -0300

    support: Add xpthread_kill
    
    Checked on x86_64-linux-gnu.
    
    (cherry picked from commit 0280b390fbd4c55a708985829d58a639475bbffb)
    (cherry picked from commit 94c91ce23106ec21905e1c01afbec0323aacc4e6)

 support/Makefile        |  1 +
 support/xpthread_kill.c | 26 ++++++++++++++++++++++++++
 support/xthread.h       |  2 ++
 3 files changed, 29 insertions(+)

commit c457df56b3059727d637c00f171d350ce6982566
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Nov 10 15:21:37 2021 +0100

    s390: Use long branches across object boundaries (jgh instead of jh)
    
    Depending on the layout chosen by the linker, the 16-bit displacement
    of the jh instruction is insufficient to reach the target label.
    
    Analysis of the linker failure was carried out by Nick Clifton.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Reviewed-by: Stefan Liebler <stli@linux.ibm.com>
    (cherry picked from commit 98966749f2b418825ff2ea496a0ee89fe63d2cc8)
    (cherry picked from commit 9edf29fd72ad12b2b74c8d838222616de5be6dc8)

 sysdeps/s390/memmem-arch13.S | 2 +-
 sysdeps/s390/strstr-arch13.S | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

commit ad2c5e7ee5bae92eae8e95f2c82add657f6226db
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Thu Sep 30 10:29:17 2021 -0700

    elf: Replace nsid with args.nsid [BZ #27609]
    
    commit ec935dea6332cb22f9881cd1162bad156173f4b0
    Author: Florian Weimer <fweimer@redhat.com>
    Date:   Fri Apr 24 22:31:15 2020 +0200
    
        elf: Implement __libc_early_init
    
    has
    
    @@ -856,6 +876,11 @@ no more namespaces available for dlmopen()"));
       /* See if an error occurred during loading.  */
       if (__glibc_unlikely (exception.errstring != NULL))
         {
    +      /* Avoid keeping around a dangling reference to the libc.so link
    +   map in case it has been cached in libc_map.  */
    +      if (!args.libc_already_loaded)
    +  GL(dl_ns)[nsid].libc_map = NULL;
    +
    
    do_dlopen calls _dl_open with nsid == __LM_ID_CALLER (-2), which calls
    dl_open_worker with args.nsid = nsid.  dl_open_worker updates args.nsid
    if it is __LM_ID_CALLER.  After dl_open_worker returns, it is wrong to
    use nsid.
    
    Replace nsid with args.nsid after dl_open_worker returns.  This fixes
    BZ #27609.
    
    (cherry picked from commit 1e1ecea62e899acb58c3fdf3b320a0833ddd0dff)
    (cherry picked from commit 6090cf1330faf2deb17285758f327cb23b89ebf1)

 elf/dl-open.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 1d4481f1df1f96a0bf24886ad262c0a8c394b98b
Author: Stefan Liebler <stli@linux.ibm.com>
Date:   Tue Oct 5 16:14:10 2021 +0200

    S390: Add PCI_MIO and SIE HWCAPs
    
    Both new HWCAPs were introduced in these kernel commits:
    - 7e8403ecaf884f307b627f3c371475913dd29292
      "s390: add HWCAP_S390_PCI_MIO to ELF hwcaps"
    - 7e82523f2583e9813e4109df3656707162541297
      "s390/hwcaps: make sie capability regular hwcap"
    
    Also note that the kernel commit 511ad531afd4090625def4d9aba1f5227bd44b8e
    "s390/hwcaps: shorten HWCAP defines" has shortened the prefix of the macros
    from "HWCAP_S390_" to "HWCAP_".  For compatibility reasons, we do not
    change the prefix in public glibc header file.
    
    (cherry picked from commit f2e06656d04a9fcb0603802a4f8ce7aa3a1f055e)
    (cherry picked from commit 4b95183785666d3c3f26a811d3dae859b67d7aec)

 sysdeps/s390/dl-procinfo.c                | 4 ++--
 sysdeps/s390/dl-procinfo.h                | 4 +++-
 sysdeps/unix/sysv/linux/s390/bits/hwcap.h | 7 +++++++
 3 files changed, 12 insertions(+), 3 deletions(-)

commit b21a9196a954c9d6a0c83067e4cc2da28bf35822
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Fri Sep 10 19:39:35 2021 +0200

    posix: Fix attribute access mode on getcwd [BZ #27476]
    
    There is a GNU extension that allows to call getcwd(NULL, >0). It is
    described in the documentation, but also directly in the unistd.h
    header, just above the declaration.
    
    Therefore the attribute access mode added in commit 06febd8c6705
    is not correct. Drop it.
    
    (cherry picked from commit 63a788f48a713f2081f200dd054df3e728b0e7c2)
    (cherry picked from commit d27d1e4d13ba494b3a1c9dc14072d20c77533d73)

 posix/bits/unistd.h | 5 ++---
 posix/unistd.h      | 3 +--
 2 files changed, 3 insertions(+), 5 deletions(-)

commit c4e5c07ad40c79a645c93aeb7f031d43f71bc952
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Fri Sep 3 00:28:14 2021 +0200

    Fix failing nss/tst-nss-files-hosts-long with local resolver
    
    When a local resolver like unbound is listening on the IPv4 loopback
    address 127.0.0.1, the nss/tst-nss-files-hosts-long test fails. This is
    due to:
    - the default resolver in the absence of resolv.conf being 127.0.0.1
    - the default DNS NSS database configuration in the absence of
      nsswitch.conf being 'hosts: dns [!UNAVAIL=return] file'
    
    This causes the requests for 'test4' and 'test6' to first be sent to the
    local resolver, which responds with NXDOMAIN in the likely case those
    records do no exist. In turn that causes the access to /etc/hosts to be
    skipped, which is the purpose of that test.
    
    Fix that by providing a simple nsswitch.conf file forcing access to
    /etc/hosts for that test. I have tested that the only changed result in
    the testsuite is that test.
    
    (cherry picked from commit 2738480a4b0866723fb8c633f36bdd34a8767581)
    (cherry picked from commit 14f2867b575ff84ddf226258d0746ae1f80edefd)

 nss/tst-nss-files-hosts-long.root/etc/nsswitch.conf | 1 +
 1 file changed, 1 insertion(+)

commit ba62b492aedf15e4fd9d9511e3e63f8452f97fea
Author: Jiaxun Yang <jiaxun.yang@flygoat.com>
Date:   Tue Sep 7 13:31:42 2021 +0800

    MIPS: Setup errno for {f,l,}xstat
    
    {f,l,}xstat stub for MIPS is using INTERNAL_SYSCALL
    to do xstat syscall for glibc ver, However it leaves
    errno untouched and thus giving bad errno output.
    
    Setup errno properly when syscall returns non-zero.
    
    Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
    
    (cherry picked from commit 66016ec8aeefd40e016d7040d966484c764b0e9c)
    (cherry picked from commit 9b01145592fdbffbcbb949d680c152ed2bf2375d)

 sysdeps/unix/sysv/linux/mips/fxstat.c | 4 +++-
 sysdeps/unix/sysv/linux/mips/lxstat.c | 4 +++-
 sysdeps/unix/sysv/linux/mips/xstat.c  | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

commit 6b50df063fa26a6ce93eb8c241d9426de99aea2c
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Wed Sep 1 23:49:27 2021 +0200

    RISC-V: Update rv64 ULPs
    
    Generated on both a Microsemi Polarfire Icicle Kit and a BeagleV
    Starlight, resulting in identical ULPs.
    
    (cherry picked from commit 9c676ef514c5e52bf7e6caabc3bfc9f918ef72ba)

 sysdeps/riscv/rv64/rvd/libm-test-ulps | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

commit 45e333ecab1d2ef49edbf236b89e3bcbc28bfa30
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Tue Feb 2 09:55:50 2021 -0300

    linux: Remove shmmax check from tst-sysvshm-linux
    
    The shmmax expected value is tricky to check because kernel clamps it
    to INT_MAX in two cases:
    
      1. Compat symbols with IPC_64, i.e, 32-bit binaries running on 64-bit
         kernels.
    
      2. Default symbol without IPC_64 (defined as IPC_OLD within Linux) and
         glibc always use IPC_64 for 32-bit ABIs (to support 64-bit time_t).
         It means that 32-bit binaries running on 32-bit kernels will not see
         shmmax being clamped.
    
    And finding out whether the compat symbol is used would require checking
    the underlying kernel against the current ABI.  The shmall and shmmni
    already provided enough coverage.
    
    Checked on x86_64-linux-gnu and i686-linux-gnu.  It should fix the
    tst-sysvshm-linux failures on 32-bit kernels.
    
    (cherry picked from commit 913201078502ad3f10043db02a8efce5d75387c2)
    (cherry picked from commit c6cadbf83a64600d44faf8f27f6db41094e9682a)

 sysdeps/unix/sysv/linux/tst-sysvshm-linux.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

commit 22292cbe2def3b68b220141e05dc1035b1f648b4 (tag: gentoo/glibc-2.33-6)
Author: Nikita Popov <npv1310@gmail.com>
Date:   Thu Aug 12 16:09:50 2021 +0530

    librt: add test (bug 28213)
    
    This test implements following logic:
    1) Create POSIX message queue.
       Register a notification with mq_notify (using NULL attributes).
       Then immediately unregister the notification with mq_notify.
       Helper thread in a vulnerable version of glibc
       should cause NULL pointer dereference after these steps.
    2) Once again, register the same notification.
       Try to send a dummy message.
       Test is considered successfulif the dummy message
       is successfully received by the callback function.
    
    Signed-off-by: Nikita Popov <npv1310@gmail.com>
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 4cc79c217744743077bf7a0ec5e0a4318f1e6641)
    (cherry picked from commit 22d37364aeaf5f8e4c5108677baaf084871c3006)

 rt/Makefile      |   1 +
 rt/tst-bz28213.c | 101 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 102 insertions(+)

commit 4f4b23d3e8654067eb02b226dc1489064c796902
Author: Nikita Popov <npv1310@gmail.com>
Date:   Mon Aug 9 20:17:34 2021 +0530

    librt: fix NULL pointer dereference (bug 28213)
    
    Helper thread frees copied attribute on NOTIFY_REMOVED message
    received from the OS kernel.  Unfortunately, it fails to check whether
    copied attribute actually exists (data.attr != NULL).  This worked
    earlier because free() checks passed pointer before actually
    attempting to release corresponding memory.  But
    __pthread_attr_destroy assumes pointer is not NULL.
    
    So passing NULL pointer to __pthread_attr_destroy will result in
    segmentation fault.  This scenario is possible if
    notification->sigev_notify_attributes == NULL (which means default
    thread attributes should be used).
    
    Signed-off-by: Nikita Popov <npv1310@gmail.com>
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit b805aebd42364fe696e417808a700fdb9800c9e8)
    (cherry picked from commit 27a78fd712c06748737dfa9638fab96ea362fca9)

 sysdeps/unix/sysv/linux/mq_notify.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 6dd98e2a9aba6234d19710c41c471c5cbb701aaa (tag: gentoo/glibc-2.33-5)
Author: Fangrui Song <maskray@google.com>
Date:   Thu Jul 8 14:26:22 2021 -0700

    x86_64: Remove unneeded static PIE check for undefined weak diagnostic
    
    https://sourceware.org/bugzilla/show_bug.cgi?id=21782 dropped an ld
    diagnostic for R_X86_64_PC32 referencing an undefined weak symbol in
    -pie links.  Arguably keeping the diagnostic like other ports is more
    correct, since statically resolving movl foo(%rip), %eax to the
    link-time zero address produces a corrupted output.
    
    It turns out that --enable-static-pie builds do not depend on the ld
    behavior. GCC generates GOT indirection for weak declarations for
    -fPIE/-fPIC, so what ld does with the PC-relative relocation doesn't
    really matter.
    
    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
    (cherry picked from commit 115d242456de158e698ffb0f9a5fee3118e9e825)
    (cherry picked from commit b5711025bc138c0c94d90b2015d57eda404decbe)

 sysdeps/x86_64/configure    | 33 ---------------------------------
 sysdeps/x86_64/configure.ac | 25 -------------------------
 2 files changed, 58 deletions(-)

commit 0e7dc06365a14f61c0ddc833eab230c0d417d426
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Fri Jun 25 15:02:47 2021 +0200

    wordexp: handle overflow in positional parameter number (bug 28011)
    
    Use strtoul instead of atoi so that overflow can be detected.
    
    (cherry picked from commit 5adda61f62b77384718b4c0d8336ade8f2b4b35c)
    (cherry picked from commit edfd11197ecf3629bbb4b66c5814da09a61a7f9f)

 posix/wordexp-test.c | 1 +
 posix/wordexp.c      | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

commit adad3b89d09a918226c448f8dcea2cfe6fe68589
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Jun 17 15:06:43 2021 +0200

    elf: Use _dl_catch_error from base namespace in dl-libc.c [BZ #27646]
    
    dlerrror_run in elf/dl-libc.c needs to call GLRO (dl_catch_error)
    from the base namespace, just like the exported dlerror
    implementation.
    
    Fixes commit b2964eb1d9a6b8ab1250e8a881cf406182da5875 ("dlfcn:
    Failures after dlmopen should not terminate process [BZ #24772]").
    
    Backport notes: GLRO (dl_catch_error) is replaced with
    _dl_catch_error_ptr to preserve _rtld_global_ro layout.
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit c2059edce20c124d1a99f1a94cc52e83b77a917a)
    (cherry picked from commit 58b90461ae100c95e0bc53d29d2187bad290ecaf)

 NEWS                                |  1 +
 elf/Makefile                        |  7 +++++--
 elf/dl-libc.c                       |  8 +++++++-
 elf/tst-dlmopen-gethostbyname-mod.c | 29 +++++++++++++++++++++++++++++
 elf/tst-dlmopen-gethostbyname.c     | 31 +++++++++++++++++++++++++++++++
 5 files changed, 73 insertions(+), 3 deletions(-)

commit 29d2e95d6cfd3a2f3bc1461790c52fb885a757b6
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Fri Jul 23 01:13:38 2021 +0200

    Revert "Enable nss-systemd in nsswitch.conf"
    
    This reverts commit 5510d44bea20bbf9941c4a56a6e67a22b237ebcd.

 nss/nsswitch.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

commit 82b18f4fe68c2ec1c878eb2447333be1841c14fd
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Fri Jul 23 01:12:35 2021 +0200

    Revert "Add comment about slowdowns via systemd nsswitch lookups"
    
    This reverts commit 35dd849d0983345a8153388db7fdcb72a8e52ce8.

 nss/nsswitch.conf | 7 -------
 1 file changed, 7 deletions(-)

commit 0d5c3ab6cbdd2570af1592dc9a5f1b2c731a0758
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Fri Jul 23 01:11:39 2021 +0200

    Revert "Gentoo: nsswitch.conf: Add nss-systemd hook also to shadow and gshadow"
    
    This reverts commit c834ea3358e6a3d74ed45b96168338f31dd0f080.

 nss/nsswitch.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

commit 1b7bd5a20f0f8dc13f70cd413e4dcd86ed0d7c5c (tag: gentoo/glibc-2.33-4)
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Jun 1 17:51:41 2021 +0200

    Fix use of __pthread_attr_copy in mq_notify (bug 27896)
    
    __pthread_attr_copy can fail and does not initialize the attribute
    structure in that case.
    
    If __pthread_attr_copy is never called and there is no allocated
    attribute, pthread_attr_destroy should not be called, otherwise
    there is a null pointer dereference in rt/tst-mqueue6.
    
    Fixes commit 42d359350510506b87101cf77202fefcbfc790cb
    ("Use __pthread_attr_copy in mq_notify (bug 27896)").
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 217b6dc298156bdb0d6aea9ea93e7e394a5ff091)
    (cherry picked from commit 8c06748c51750333d1516a2d342ed2361186e908)

 sysdeps/unix/sysv/linux/mq_notify.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

commit 4071af59f9ec77d19cfa89472fd0846ca5e02ff2
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Thu May 27 12:49:47 2021 +0200

    Use __pthread_attr_copy in mq_notify (bug 27896)
    
    Make a deep copy of the pthread attribute object to remove a potential
    use-after-free issue.
    
    (cherry picked from commit 42d359350510506b87101cf77202fefcbfc790cb)
    (cherry picked from commit 4b6be914bd3920500a67ef6ca1aa7d1c37e5e859)

 NEWS                                |  6 ++++++
 sysdeps/unix/sysv/linux/mq_notify.c | 15 ++++++++++-----
 2 files changed, 16 insertions(+), 5 deletions(-)

commit 8c2837bedd3abb35fdcb38a929e46218df4b63cc
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Apr 21 19:49:51 2021 +0200

    dlfcn: Failures after dlmopen should not terminate process [BZ #15271]
    
    Commit 9e78f6f6e7134a5f299cc8de77370218f8019237 ("Implement
    _dl_catch_error, _dl_signal_error in libc.so [BZ #16628]") has the
    side effect that distinct namespaces, as created by dlmopen, now have
    separate implementations of the rtld exception mechanism.  This means
    that the call to _dl_catch_error from libdl in a secondary namespace
    does not actually install an exception handler because the
    thread-local variable catch_hook in the libc.so copy in the secondary
    namespace is distinct from that of the base namepace.  As a result, a
    dlsym/dlopen/... failure in a secondary namespace terminates the process
    with a dynamic linker error because it looks to the exception handler
    mechanism as if no handler has been installed.
    
    Backport notes: GLRO (dl_catch_error) is replaced with
    _dl_catch_error_ptr to preserve _rtld_global_ro layout.
    
    (cherry picked from commit b2964eb1d9a6b8ab1250e8a881cf406182da5875)
    (cherry picked from commit f4cba6ca1e5ff2c229af6d474c3ef2c0df2fae52)

 NEWS                          |  1 +
 dlfcn/dlerror.c               | 13 +++++++++++--
 elf/Makefile                  |  8 +++++++-
 elf/Versions                  |  2 +-
 elf/dl-error-skeleton.c       | 15 +++++++++++++++
 elf/rtld.c                    |  1 -
 elf/tst-dlmopen-dlerror-mod.c | 41 +++++++++++++++++++++++++++++++++++++++++
 elf/tst-dlmopen-dlerror.c     | 37 +++++++++++++++++++++++++++++++++++++
 sysdeps/generic/ldsodefs.h    | 11 +++++++++++
 9 files changed, 124 insertions(+), 5 deletions(-)

commit c834ea3358e6a3d74ed45b96168338f31dd0f080
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Tue May 25 22:24:20 2021 +0200

    Gentoo: nsswitch.conf: Add nss-systemd hook also to shadow and gshadow
    
    See-also: https://github.com/systemd/systemd/pull/19545
    See-also: https://github.com/systemd/systemd/commit/f43a19ecd6e3415ec223f245204b4eaaff739af4

 nss/nsswitch.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

commit 82b5ffdd990c0f779b463f0ed124675169f817e8
Author: Nicholas Piggin <npiggin@gmail.com>
Date:   Thu May 20 11:00:36 2021 -0300

    powerpc: Fix handling of scv return error codes [BZ #27892]
    
    When using scv for templated ASM syscalls, current code interprets any
    negative return value as error, but the only valid error codes are in
    the range -4095..-1 according to the ABI.
    
    This commit also fixes 'signal.gen.test' strace test, where the issue
    was first identified.
    
    Reviewed-by: Matheus Castanho <msc@linux.ibm.com>
    (cherry picked from commit 7de36744ee1325f35d3fe0ca079dd33c40b12267)
    (cherry picked from commit 0ef0e6de7fdfa18328b09ba2afb4f0112d4bdab4)

 NEWS                               | 1 +
 sysdeps/powerpc/powerpc64/sysdep.h | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

commit 735b0e377eaa9abceb0f5259d3f9b4cf37ad1c3f
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Apr 22 19:53:15 2021 +0200

    nptl: Do not build nptl/tst-pthread-gdb-attach as PIE
    
    (cherry picked from commit 6f3e54d404cfe1ba7d1444e6dfcfd77b102d9287)
    (cherry picked from commit 3f5080aedd164c1f92a53552dd3e0b82ac6d2bd3)

 nptl/Makefile | 3 +++
 1 file changed, 3 insertions(+)

commit b355f7d04552413286c287e4bc41f895d5bb7c50
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Apr 22 11:07:43 2021 +0200

    nptl: Check for compatible GDB in nptl/tst-pthread-gdb-attach
    
    Also do not clear the subprocess environment, in case running
    GDB needs certain environment variables.
    
    (cherry picked from commit f553dc066071a4465321fbc122bed8a75afd996b)
    (cherry picked from commit 36783141cf090412e3e6f042f25f7f6c63d6a14a)

 nptl/tst-pthread-gdb-attach.c | 78 +++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 76 insertions(+), 2 deletions(-)

commit 6662c781378adff89bfe5e2116c1c761d0258fed
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Apr 21 11:50:43 2021 +0200

    nptl_db: Support different libpthread/ld.so load orders (bug 27744)
    
    libthread_db is loaded once GDB encounters libpthread, and at this
    point, ld.so may not have been processed by GDB yet. As a result,
    _rtld_global cannot be accessed by regular means from libthread_db.
    To make this work until GDB can be fixed, acess _rtld_global through
    a pointer stored in libpthread.
    
    The new test does not reproduce bug 27744 with
    --disable-hardcoded-path-in-tests, but is still a valid smoke test.
    With --enable-hardcoded-path-in-tests, it is necessary to avoid
    add-symbol-file because this can tickle a GDB bug.
    
    Fixes commit 1daccf403b1bd86370eb94edca794dc106d02039 ("nptl: Move
    stack list variables into _rtld_global").
    
    Tested-by: Emil Velikov <emil.velikov@collabora.com>
    (cherry picked from commit a64afc225240b2b27129ccfb0516d7c958b98040)
    (cherry picked from commit ea299b62e83cc38b0d910bbd1a879f7d1f836e96)

 NEWS                                 |   1 +
 nptl/Makefile                        |  19 ++++-
 nptl/pthread_create.c                |   8 ++
 nptl/tst-pthread-gdb-attach-static.c |   1 +
 nptl/tst-pthread-gdb-attach.c        | 143 +++++++++++++++++++++++++++++++++++
 nptl_db/structs.def                  |   3 +-
 nptl_db/td_init.c                    |  15 ++--
 nptl_db/thread_dbP.h                 |   2 +
 8 files changed, 181 insertions(+), 11 deletions(-)

commit bd06b8f84cc705922e5d15ad45a8ab6d8e90b02e
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed Apr 21 18:40:08 2021 -0700

    x86: tst-cpu-features-supports.c: Update AMX check
    
    Pass "amx-bf16", "amx-int8" and "amx-tile", instead of "amx_bf16",
    "amx_int8" and "amx_tile", to __builtin_cpu_supports for GCC 11.
    
    (cherry picked from commit 7fc9152e831fb24091c0ceabdcecb9b07dd29dd6)
    (cherry picked from commit 162df872f0dfc2b124a18e1a8c33be63f70d9a1c)

 sysdeps/x86/tst-cpu-features-supports.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

commit a73a8851ad8acf0582bdaf8645312c8eb99256c0
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Tue Feb 2 15:02:09 2021 +0000

    Remove PR_TAGGED_ADDR_ENABLE from sys/prctl.h
    
    The value of PR_TAGGED_ADDR_ENABLE was incorrect in the installed
    headers and the prctl command macros were missing that are needed
    for it to be useful (PR_SET_TAGGED_ADDR_CTRL).  Linux headers have
    the definitions since 5.4 so it's widely available, we don't need
    to repeat these definitions.  The remaining definitions are from
    Linux 5.10.
    
    To build glibc with --enable-memory-tagging, Linux 5.4 headers and
    binutils 2.33.1 or newer is needed.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit f4596d9540021265a99697fceef8a434c47e8bcf)
    (cherry picked from commit 12ff80b312c11b0284df7a1c5cb9be6418f85228)

 sysdeps/unix/sysv/linux/sys/prctl.h | 4 ----
 1 file changed, 4 deletions(-)

commit f30da6c94135a369472af485e2d672cf45881ec3
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Mar 16 12:37:55 2021 +0530

    Fix SXID_ERASE behavior in setuid programs (BZ #27471)
    
    When parse_tunables tries to erase a tunable marked as SXID_ERASE for
    setuid programs, it ends up setting the envvar string iterator
    incorrectly, because of which it may parse the next tunable
    incorrectly.  Given that currently the implementation allows malformed
    and unrecognized tunables pass through, it may even allow SXID_ERASE
    tunables to go through.
    
    This change revamps the SXID_ERASE implementation so that:
    
    - Only valid tunables are written back to the tunestr string, because
      of which children of SXID programs will only inherit a clean list of
      identified tunables that are not SXID_ERASE.
    
    - Unrecognized tunables get scrubbed off from the environment and
      subsequently from the child environment.
    
    - This has the side-effect that a tunable that is not identified by
      the setxid binary, will not be passed on to a non-setxid child even
      if the child could have identified that tunable.  This may break
      applications that expect this behaviour but expecting such tunables
      to cross the SXID boundary is wrong.
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    
    (cherry picked from commit 2ed18c5b534d9e92fc006202a5af0df6b72e7aca)
    (cherry picked from commit 1bf38e7260c2cd3e40e118c1f1ea28de182dc751)

 elf/dl-tunables.c             | 56 ++++++++++++++++++++-----------------------
 elf/tst-env-setuid-tunables.c | 26 ++++++++++++++++++++
 2 files changed, 52 insertions(+), 30 deletions(-)

commit c17ab64c286a5f343e2a3818a8c257288f97d9a5
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Mar 16 12:37:54 2021 +0530

    Enhance setuid-tunables test
    
    Instead of passing GLIBC_TUNABLES via the environment, pass the
    environment variable from parent to child.  This allows us to test
    multiple variables to ensure better coverage.
    
    The test list currently only includes the case that's already being
    tested.  More tests will be added later.
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    
    (cherry picked from commit 061fe3f8add46a89b7453e87eabb9c4695005ced)
    (cherry picked from commit a7b8e8ec9b21c7c6d4ec0ba2229abd63dc3a00b2)

 elf/Makefile                  |  2 -
 elf/tst-env-setuid-tunables.c | 90 +++++++++++++++++++++++++++++++++----------
 2 files changed, 69 insertions(+), 23 deletions(-)

commit e27053112fbac0007344dea58879e4b1e135e355
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Mar 16 12:37:53 2021 +0530

    tst-env-setuid: Use support_capture_subprogram_self_sgid
    
    Use the support_capture_subprogram_self_sgid to spawn an sgid child.
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    
    (cherry picked from commit ca335281068a1ed549a75ee64f90a8310755956f)
    (cherry picked from commit ee16c81063d85582091702b6a3a736002b76f397)

 elf/tst-env-setuid.c | 197 ++++-----------------------------------------------
 1 file changed, 14 insertions(+), 183 deletions(-)

commit 2ecca6ca3e2e63be9f773fa9e709f4de21f06014
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Fri Apr 9 20:55:45 2021 +0530

    support: Add capability to fork an sgid child
    
    Add a new function support_capture_subprogram_self_sgid that spawns an
    sgid child of the running program with its own image and returns the
    exit code of the child process.  This functionality is used by at
    least three tests in the testsuite at the moment, so it makes sense to
    consolidate.
    
    There is also a new function support_subprogram_wait which should
    provide simple system() like functionality that does not set up file
    actions.  This is useful in cases where only the return code of the
    spawned subprocess is interesting.
    
    This patch also ports tst-secure-getenv to this new function.  A
    subsequent patch will port other tests.  This also brings an important
    change to tst-secure-getenv behaviour.  Now instead of succeeding, the
    test fails as UNSUPPORTED if it is unable to spawn a setgid child,
    which is how it should have been in the first place.
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    
    (cherry picked from commit 716a3bdc41b2b4b864dc64475015ba51e35e1273)
    (cherry picked from commit 267e174f198532d950a6f419681689d73b2c633c)

 stdlib/tst-secure-getenv.c           | 199 ++++-------------------------------
 support/capture_subprocess.h         |   6 ++
 support/subprocess.h                 |   5 +
 support/support_capture_subprocess.c | 126 ++++++++++++++++++++++
 support/support_subprocess.c         |  13 +++
 5 files changed, 168 insertions(+), 181 deletions(-)

commit cb6c79855b10e4335e6b0f596299cc11d259eb39
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Mon Mar 15 17:23:30 2021 +0530

    support: Pass environ to child process
    
    Pass environ to posix_spawn so that the child process can inherit
    environment of the test.
    
    (cherry picked from commit e958490f8c74e660bd93c128b3bea746e268f3f6)
    (cherry picked from commit 249c486ce8e80a9e94d51b4bbf3ccf5d0af57e5e)

 support/support_subprocess.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

commit 3f3fa41378087ae8cbf06992b392ad8f5a08a672
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Mon Mar 15 16:00:06 2021 +0530

    support: Typo and formatting fixes
    
    - Add a newline to the end of error messages in transfer().
    - Fixed the name of support_subprocess_init().
    
    (cherry picked from commit 95c68080a3ded882789b1629f872c3ad531efda0)
    (cherry picked from commit 45b2c57d345092e8a6a9f065a44c9801e09c24c5)

 support/support_capture_subprocess.c | 2 +-
 support/support_subprocess.c         | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

commit 77a0bddb24867bfa0e3b93c8883c1de228194f64
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Mar 16 18:31:02 2021 +0530

    tunables: Fix comparison of tunable values
    
    The simplification of tunable_set interfaces took care of
    signed/unsigned conversions while setting values, but comparison with
    bounds ended up being incorrect; comparing TUNABLE_SIZE_T values for
    example will fail because SIZE_MAX is seen as -1.
    
    Add comparison helpers that take tunable types into account and use
    them to do comparison instead.
    
    (cherry picked from commit d1a3dcabf2f89233a99a4a9be08f9f407da0b6b4)
    (cherry picked from commit e07abf59b28dc4406f8462aef4fb28b38f1cbd3b)

 elf/dl-tunable-types.h | 17 +++++++++++++++++
 elf/dl-tunables.c      | 25 ++++++++++++++-----------
 elf/dl-tunables.h      | 18 ++++++++++++++++++
 3 files changed, 49 insertions(+), 11 deletions(-)

commit 3da6fde67d85bf1d47cf58c4e9c4591a2198d1b2
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Apr 8 07:39:32 2021 -0300

    linux: always update select timeout (BZ #27706)
    
    The timeout should be updated even on failure for time64 support.
    
    Checked on i686-linux-gnu.
    
    (cherry-pick from commit cedbf6d5f3f70ca911176de87d6e453eeab4b7a1)
    
    (cherry picked from commit 3e9ca60a580e2b6854cd5314ebb0866a1f387ca8)

 NEWS                             |  1 +
 misc/tst-select.c                | 30 ++++++++++++++++++++++++++++++
 sysdeps/unix/sysv/linux/select.c |  4 ++--
 3 files changed, 33 insertions(+), 2 deletions(-)

commit 1fafc22294c5b0398c732f8e79a586c020021557
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Wed Mar 31 13:53:34 2021 -0300

    linux: Normalize and return timeout on select (BZ #27651)
    
    The commit 2433d39b697, which added time64 support to select, changed
    the function to use __NR_pselect6 (or __NR_pelect6_time64) on all
    architectures.  However, on architectures where the symbol was
    implemented with __NR_select the kernel normalizes the passed timeout
    instead of return EINVAL.  For instance, the input timeval
    { 0, 5000000 } is interpreted as { 5, 0 }.
    
    And as indicated by BZ #27651, this semantic seems to be expected
    and changing it results in some performance issues (most likely
    the program does not check the return code and keeps issuing
    select with unormalized tv_usec argument).
    
    To avoid a different semantic depending whether which syscall the
    architecture used to issue, select now always normalize the timeout
    input.  This is a slight change for some ABIs (for instance aarch64).
    
    Checked on x86_64-linux-gnu and i686-linux-gnu.
    
    (cherry picked from commit 9d7c5cc38e58fb0923e88901f87174a511b61552)
    (cherry picked from commit 8380ca5833ef2a11bf0162f2290f4f8c85ce3b90)

 NEWS                             |  1 +
 include/time.h                   |  5 +++++
 misc/tst-select.c                | 17 +++++++++++++++++
 sunrpc/svcauth_des.c             |  1 -
 sysdeps/unix/sysv/linux/select.c | 41 +++++++++++++++++++++++++++++++---------
 5 files changed, 55 insertions(+), 10 deletions(-)

commit e064d361245afcce68771c5ed7ffb511e2d3858e
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Apr 9 10:05:13 2021 -0300

    libsupport: Add support_select_normalizes_timeout
    
    It will be used on a select() test.
    
    (cherry-pick from commit 49a40ba18e2cb948259771317fe6ff6f5eb68683)
    
    (cherry picked from commit 85e4dc415a9ae70eebb167f04d5fda2cc8cd5461)

 support/Makefile                            |  1 +
 support/support.h                           |  4 ++++
 support/support_select_normalizes_timeout.c | 29 +++++++++++++++++++++++++++++
 3 files changed, 34 insertions(+)

commit 1adef5b6d156d495da24ba4c74db4fdf4d110415
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Fri Apr 9 10:02:30 2021 -0300

    libsupport: Add support_select_modifies_timeout
    
    It will be used on a select() test.
    
    (cherry picked from commit 5628f103f5937611730845390928cb43ef716012)
    (cherry picked from commit b5b4aa62c124cf5c6c8d7a520137acbc0f3dc525)

 support/Makefile                          |  1 +
 support/support.h                         |  5 +++++
 support/support_select_modifies_timeout.c | 29 +++++++++++++++++++++++++++++
 3 files changed, 35 insertions(+)

commit b81e91116b49c5c5398c558158a20712d3af3f90
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Mar 25 16:57:45 2021 -0300

    misc: Fix tst-select timeout handling (BZ#27648)
    
    Instead of polling the stderr, create two pipes and fork to check
    if child timeout as expected similar to tst-pselect.c.  Also lower
    the timeout value.
    
    Checked on x86_64-linux-gnu.
    
    (cherry picked from commit 1b53b5d970c232b48843c778ac4566ff5b566c3b)
    (cherry picked from commit 3d525dd63926bb28517b3bf452da17fb3c4ee24c)

 NEWS              |  1 +
 misc/tst-select.c | 85 +++++++++++++++++++++++++++++++++++--------------------
 2 files changed, 56 insertions(+), 30 deletions(-)

commit 915a1c1a8087dfbd89ac311701bffcb8c5f697a6
Author: Lukasz Majewski <lukma@denx.de>
Date:   Sat Mar 13 23:34:21 2021 +0100

    tst: Provide test for select
    
    This change adds new test to assess select()'s timeout related
    functionality (the rdfs set provides valid fd - stderr - but during
    normal program operation there is no data to be read, so one just
    waits for timeout).
    
    To be more specific - two use cases are checked:
    - if select() times out immediately when passed struct timeval has
      zero values of tv_usec and tv_sec.
    - if select() times out after timeout specified in passed argument
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    
    (cherry picked from commit bff3019afc77eb51634471827daaa1c17a6dc5bd)
    (cherry picked from commit 830674605ffaa6213f951198501d585fff1b15fe)

 misc/Makefile     |  2 +-
 misc/tst-select.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 1 deletion(-)

commit 35dd849d0983345a8153388db7fdcb72a8e52ce8
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Sat Apr 10 17:09:26 2021 +0200

    Add comment about slowdowns via systemd nsswitch lookups
    
    Bug: https://bugs.gentoo.org/773436

 nss/nsswitch.conf | 7 +++++++
 1 file changed, 7 insertions(+)

commit 9d02fa728bc9be7aba3ab2a974141f1a574f73cf (tag: gentoo/glibc-2.33-3)
Author: Joseph Myers <joseph@codesourcery.com>
Date:   Thu Apr 1 20:14:50 2021 +0000

    Update Nios II libm-test-ulps.
    
    This has a subset of the changes in the version applied to master
    (only those that actually appear in a regeneration on 2.33 branch).
    
    (cherry picked from commit e78ea9bd26199497b9f047e421f16284297629cf)

 sysdeps/nios2/libm-test-ulps | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

commit ca20537639f53e27b63254ab16f259fd6592b7e1
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Feb 25 14:49:58 2021 +0000

    malloc: Fix a realloc crash with heap tagging [BZ 27468]
    
    _int_free must be called with a chunk that has its tag reset. This was
    missing in a rare case that could crash when heap tagging is enabled:
    when in a multi-threaded process the current arena runs out of memory
    during realloc, but another arena still has space to finish the realloc
    then _int_free was called without clearing the user allocation tags.
    
    Fixes bug 27468.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 42cc96066b22ba065db11096c78881a55e45def4)
    (cherry picked from commit 98bb18f52a7c576e6068f4b42dea5b24fa6fd81e)

 malloc/malloc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

commit 0311304a691c2deed1b85cc0d25e5e70f78656a4
Author: Stefan Liebler <stli@linux.ibm.com>
Date:   Tue Mar 23 17:29:26 2021 +0100

    S390: Also check vector support in memmove ifunc-selector [BZ #27511]
    
    The arch13 memmove variant is currently selected by the ifunc selector
    if the Miscellaneous-Instruction-Extensions Facility 3 facility bit
    is present, but the function is also using vector instructions.
    If the vector support is not present, one is receiving an operation
    exception.
    
    Therefore this patch also checks for vector support in the ifunc
    selector and in ifunc-impl-list.c.
    
    Just to be sure, the configure check is now also testing an arch13
    vector instruction and an arch13 Miscellaneous-Instruction-Extensions
    Facility 3 instruction.
    
    (cherry picked from commit 7759be2593b689cb1eafc0f52ee7f59c639e5d2f)
    (cherry picked from commit fc4ecce85b5ce10f64ae1328f4105ace8d7b7b67)

 sysdeps/s390/configure                   | 8 ++++++--
 sysdeps/s390/configure.ac                | 8 ++++++--
 sysdeps/s390/memmove.c                   | 2 +-
 sysdeps/s390/multiarch/ifunc-impl-list.c | 3 ++-
 4 files changed, 15 insertions(+), 6 deletions(-)

commit 20baa02f396b82fa772a677d820960679f6fc1de
Author: DJ Delorie <dj@redhat.com>
Date:   Thu Mar 11 12:50:02 2021 -0500

    test-container: Always copy test-specific support files [BZ #27537]
    
    There's a small chance that a fresh checkout will result in some of
    the test-specific container files will have the same timestamp and
    size, which breaks the rsync logic in test-container, resulting in
    tests running with the wrong support files.
    
    This patch changes the rsync logic to always copy the test-specific
    files, which normally would always be copied anyway.  The rsync logic
    for the testroot itself is unchanged.
    
    (cherry picked from commit 20bee7134801cc932ff87fac511289b92fc94944)
    (cherry picked from commit db32fc27e7bdfb5468200a94e9152bcc1c971d25)

 NEWS                     |  1 +
 support/test-container.c | 23 ++++++++++++-----------
 2 files changed, 13 insertions(+), 11 deletions(-)

commit d0ec06d650890f63c6177e482091447d115d234c
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Feb 4 15:00:20 2021 +0100

    nptl: Remove private futex optimization [BZ #27304]
    
    It is effectively used, unexcept for pthread_cond_destroy, where we do
    not want it; see bug 27304.  The internal locks do not support a
    process-shared mode.
    
    This fixes commit dc6cfdc934db9997c33728082d63552b9eee4563 ("nptl:
    Move pthread_cond_destroy implementation into libc").
    
    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
    (cherry picked from commit c4ad832276f4dadfa40904109b26a521468f66bc)
    (cherry picked from commit 79c6be6a0ad59e28cfb73ad6cae6b073e22836e3)

 NEWS                              |  1 +
 sysdeps/nptl/lowlevellock-futex.h | 14 +-------------
 2 files changed, 2 insertions(+), 13 deletions(-)

commit 21940cfd2e8fcd98b6cfb9b5ee914b83a69be524
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu Mar 4 15:15:33 2021 +0100

    pthread_once hangs when init routine throws an exception [BZ #18435]
    
    This is another attempt at making pthread_once handle throwing exceptions
    from the init routine callback.  As the new testcases show, just switching
    to the cleanup attribute based cleanup does fix the tst-once5 test, but
    breaks the new tst-oncey3 test.  That is because when throwing exceptions,
    only the unwind info registered cleanups (i.e. C++ destructors or cleanup
    attribute), when cancelling threads and there has been unwind info from the
    cancellation point up to whatever needs cleanup both unwind info registered
    cleanups and THREAD_SETMEM (self, cleanup, ...) registered cleanups are
    invoked, but once we hit some frame with no unwind info, only the
    THREAD_SETMEM (self, cleanup, ...) registered cleanups are invoked.
    So, to stay fully backwards compatible (allow init routines without
    unwind info which encounter cancellation points) and handle exception throwing
    we actually need to register the pthread_once cleanups in both unwind info
    and in the THREAD_SETMEM (self, cleanup, ...) way.
    If an exception is thrown, only the former will happen and we in that case
    need to also unregister the THREAD_SETMEM (self, cleanup, ...) registered
    handler, because otherwise after catching the exception the user code could
    call deeper into the stack some cancellation point, get cancelled and then
    a stale cleanup handler would clobber stack and probably crash.
    If a thread calling init routine is cancelled and unwind info ends before
    the pthread_once frame, it will be cleaned up through self->cleanup as
    before.  And if unwind info is present, unwind_stop first calls the
    self->cleanup registered handler for the frame, then it will call the
    unwind info registered handler but that will already see __do_it == 0
    and do nothing.
    
    (cherry picked from commit f0419e6a10740a672b28e112c409ae24f5e890ab)
    (cherry picked from commit f90d6b0484032334a3e2db5891981e123051cf19)

 NEWS                         |  1 +
 nptl/Makefile                |  4 ---
 nptl/pthreadP.h              | 61 ++++++++++++++++++++++++++++++++++++++++++++
 nptl/pthread_once.c          |  4 +--
 nptl/tst-once5.cc            |  4 +--
 sysdeps/pthread/Makefile     |  4 ++-
 sysdeps/pthread/tst-oncey3.c |  1 +
 sysdeps/pthread/tst-oncey4.c |  1 +
 8 files changed, 70 insertions(+), 10 deletions(-)

commit 29814ceca07b6daea079bf00c4a8c91b154e7cc9
Author: Florian Weimer <fweimer@redhat.com>
Date:   Mon Mar 15 10:33:43 2021 +0100

    elf: ld.so --help calls _dl_init_paths without a main map [BZ #27577]
    
    In this case, use the link map of the dynamic loader itself as
    a replacement.  This is more than just a hack: if we ever support
    DT_RUNPATH/DT_RPATH for the dynamic loader, reporting it for
    ld.so --help (without further command line arguments) would be the
    right thing to do.
    
    Fixes commit 332421312576bd7095e70589154af99b124dd2d1 ("elf: Always
    set l in _dl_init_paths (bug 23462)").
    
    (cherry picked from commit 4e6db99c665d3b82a70a3e218860ef087b1555b4)
    (cherry picked from commit dd8023c2ac0af28a6e391a2eb5038bb351694243)

 NEWS          |  1 +
 elf/Makefile  | 18 ++++++++++++++++--
 elf/dl-load.c |  8 +++++++-
 3 files changed, 24 insertions(+), 3 deletions(-)

commit 80bfc4cc279426478af863721986a9ef6726b1c0
Author: Carlos O'Donell <carlos@redhat.com>
Date:   Fri Mar 12 16:44:47 2021 +0100

    elf: Always set l in _dl_init_paths (bug 23462)
    
    After d1d5471579eb0426671bf94f2d71e61dfb204c30 ("Remove dead
    DL_DST_REQ_STATIC code.") we always setup the link map l to make the
    static and shared cases the same.  The bug is that in elf/dl-load.c
    (_dl_init_paths) we conditionally set l only in the #ifdef SHARED
    case, but unconditionally use it later.  The simple solution is to
    remove the #ifdef SHARED conditional, because it's no longer needed,
    and unconditionally setup l for both the static and shared cases. A
    regression test is added to run a static binary with
    LD_LIBRARY_PATH='$ORIGIN' which crashes before the fix and runs after
    the fix.
    
    Co-Authored-By: Florian Weimer <fweimer@redhat.com>
    (cherry picked from commit 332421312576bd7095e70589154af99b124dd2d1)
    (cherry picked from commit ea5a537e879bb667e03435a2308d915dc89448a6)

 NEWS                 |  4 ++++
 elf/Makefile         |  5 ++++-
 elf/dl-load.c        | 63 ++++++++++++++++++++++++----------------------------
 elf/tst-dst-static.c | 32 ++++++++++++++++++++++++++
 4 files changed, 69 insertions(+), 35 deletions(-)

commit 470d458c902b7c7ce70f1cbc0ea6b3e9f1a9bc58
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Sat Mar 6 10:19:32 2021 -0800

    x86: Handle _SC_LEVEL1_ICACHE_LINESIZE [BZ #27444]
    
    commit 2d651eb9265d1366d7b9e881bfddd46db9c1ecc4
    Author: H.J. Lu <hjl.tools@gmail.com>
    Date:   Fri Sep 18 07:55:14 2020 -0700
    
        x86: Move x86 processor cache info to cpu_features
    
    missed _SC_LEVEL1_ICACHE_LINESIZE.
    
    1. Add level1_icache_linesize to struct cpu_features.
    2. Initialize level1_icache_linesize by calling handle_intel,
    handle_zhaoxin and handle_amd with _SC_LEVEL1_ICACHE_LINESIZE.
    3. Return level1_icache_linesize for _SC_LEVEL1_ICACHE_LINESIZE.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit f53ffc9b90cbd92fa5518686daf4091bdd1d4889)
    (cherry picked from commit 64f6c287ad3ccd807b7d4c694f4a91e2a662fed5)

 sysdeps/x86/Makefile                            |  8 ++++
 sysdeps/x86/cacheinfo.c                         |  3 ++
 sysdeps/x86/dl-cacheinfo.h                      |  6 +++
 sysdeps/x86/dl-diagnostics-cpu.c                |  2 +
 sysdeps/x86/include/cpu-features.h              |  2 +
 sysdeps/x86/tst-sysconf-cache-linesize-static.c |  1 +
 sysdeps/x86/tst-sysconf-cache-linesize.c        | 57 +++++++++++++++++++++++++
 7 files changed, 79 insertions(+)

commit dcdf97da50d6ec1f521d8375f4f7b44700fdc1a2
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Thu Mar 11 08:21:06 2021 -0300

    io: Return EBAFD for negative file descriptor on fstat (BZ #27559)
    
    Now that fstat is implemented on top fstatat we need to handle negative
    inputs.  The implementation now rejects AT_FDCWD, which would otherwise
    be accepted by the kernel.
    
    Checked on x86_64-linux-gnu and on i686-linux-gnu.
    
    (cherry picked from commit 94caafa040e4b4289c968cd70d53041b1463ac4d)
    (cherry picked from commit 32b9280f1d9f78e8fa3874e22f4d9a76460ee02a)

 io/Makefile                       |   2 +-
 io/fstat.c                        |   6 +++
 io/fstat64.c                      |   6 +++
 io/tst-stat-lfs.c                 |   2 +
 io/tst-stat.c                     | 102 ++++++++++++++++++++++++++++++++++++++
 sysdeps/unix/sysv/linux/fstat.c   |   6 +++
 sysdeps/unix/sysv/linux/fstat64.c |  12 +++++
 7 files changed, 135 insertions(+), 1 deletion(-)

commit 2fcdcb75ec72ae52f393bcea805258dce5097b83
Author: DJ Delorie <dj@redhat.com>
Date:   Thu Feb 25 16:08:21 2021 -0500

    nscd: Fix double free in netgroupcache [BZ #27462]
    
    In commit 745664bd798ec8fd50438605948eea594179fba1 a use-after-free
    was fixed, but this led to an occasional double-free.  This patch
    tracks the "live" allocation better.
    
    Tested manually by a third party.
    
    Related: RHBZ 1927877
    
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit dca565886b5e8bd7966e15f0ca42ee5cff686673)
    (cherry picked from commit a151f2e05a64727c552a297d129b8ef242ffb3b6)

 nscd/netgroupcache.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

commit 2c759803c994bddb8cacea553d387f83450bfe89
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Tue Feb 2 13:45:58 2021 -0800

    x86: Set minimum x86-64 level marker [BZ #27318]
    
    Since the full ISA set used in an ELF binary is unknown to compiler,
    an x86-64 ISA level marker indicates the minimum, not maximum, ISA set
    required to run such an ELF binary.  We never guarantee a library with
    an x86-64 ISA level v3 marker doesn't contain other ISAs beyond x86-64
    ISA level v3, like AVX VNNI.  We check the x86-64 ISA level marker for
    the minimum ISA set.  Since -march=sandybridge enables only some ISAs
    in x86-64 ISA level v3, we should set the needed ISA marker to v2.
    Otherwise, libc is compiled with -march=sandybridge will fail to run on
    Sandy Bridge:
    
    $ ./elf/ld.so ./libc.so
    ./libc.so: (p) CPU ISA level is lower than required: needed: 7; got: 3
    
    Set the minimum, instead of maximum, x86-64 ISA level marker should have
    no impact on the glibc-hwcaps directory assignment logic in ldconfig nor
    ld.so.
    
    (cherry picked from commit 339bf918ea4830fb35614632e96f3aab3237adce)
    (cherry picked from commit ee9f98d9cac12e843ca59c6e4d4b225f58a66727)

 config.h.in              |  6 ++++++
 sysdeps/x86/configure    | 28 ++++++++++++++++++++++++++++
 sysdeps/x86/configure.ac | 16 ++++++++++++++++
 sysdeps/x86/isa-level.c  | 25 ++++++++++++++-----------
 4 files changed, 64 insertions(+), 11 deletions(-)

commit b0ef21cd8f4573cb39ffc7b97e0b66c5a00df60e
Author: DJ Delorie <dj@redhat.com>
Date:   Thu Feb 18 15:26:30 2021 -0500

    nss: Re-enable NSS module loading after chroot [BZ #27389]
    
    The glibc 2.33 release enabled /etc/nsswitch.conf reloading,
    and to prevent potential security issues like CVE-2019-14271
    the re-loading of nsswitch.conf and all mdoules was disabled
    when the root filesystem changes (see bug 27077).
    
    Unfortunately php-lpfm and openldap both require the ability
    to continue to load NSS modules after chroot. The packages
    do not exec after the chroot, and so do not cause the
    protections to be reset. The only solution is to re-enable
    only NSS module loading (not nsswitch.conf reloading) and so
    get back the previous glibc behaviour.
    
    In the future we may introduce a way to harden applications
    so they do not reload NSS modules once the root filesystem
    changes, or that only files/dns are available pre-loaded
    (or builtin).
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 58673149f37389495c098421085ffdb468b3f7ad)
    (cherry picked from commit 3e880d733753183696d1a81c34caef3a9add2b0c)

 nss/nss_database.c                            |  1 -
 nss/tst-reload2.c                             | 35 +++++++++++++++++++++------
 nss/tst-reload2.root/etc/hosts                |  1 +
 nss/tst-reload2.root/etc/nsswitch.conf        |  1 +
 nss/tst-reload2.root/subdir/etc/hosts         |  1 +
 nss/tst-reload2.root/subdir/etc/nsswitch.conf |  1 +
 6 files changed, 32 insertions(+), 8 deletions(-)

commit 6481df85597de1d3dc87de7ef5b2f61f892422aa
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Feb 24 13:12:04 2021 +0100

    x86: Add CPU-specific diagnostics to ld.so --list-diagnostics
    
    (cherry picked from commit 01a5746b6c8a44dc29d33e056b63485075a6a3cc)
    
    Adjusted to not print the rep_movsb_stop_threshold field, which
    does not exist in glibc 2.33.
    
    (cherry picked from commit 71b2463f6178a6097532dcfe8948bffbe2376dfb)

 sysdeps/x86/dl-diagnostics-cpu.c   | 116 +++++++++++++++++++++++++++++++++++++
 sysdeps/x86/include/cpu-features.h |   2 +
 2 files changed, 118 insertions(+)

commit 240296e629dcdb55927c2872445ba8de22aae607
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Mar 2 14:58:05 2021 +0100

    x86: Automate generation of PREFERRED_FEATURE_INDEX_1 bitfield
    
    Use a .def file to define the bitfield layout, so that it is possible
    to iterate over field members using the preprocessor.
    
    (cherry picked from commit e4933c8a92ea08eecdf3ab45e7f76c95dc3d20ac)
    (cherry picked from commit a1eb3915e781c5b9aed89931cbd536a186c15ed5)

 .../cpu-features-preferred_feature_index_1.def     | 34 +++++++++++++++
 sysdeps/x86/include/cpu-features.h                 | 51 ++++++++--------------
 2 files changed, 51 insertions(+), 34 deletions(-)

commit 64d0cea664435ac5a477d21b78738f2aa464f130
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Mar 2 15:46:42 2021 +0100

    ld.so: Implement the --list-diagnostics option
    
    (cherry picked from commit 851f32cf7bf7067f73b991610778915edd57d7b4)
    (cherry picked from commit 33dc1dd602aecadf2fc5f322715e6f453dda40b5)

 NEWS                                            |   9 +
 elf/Makefile                                    |   5 +-
 elf/dl-diagnostics-cpu.c                        |  24 +++
 elf/dl-diagnostics-kernel.c                     |  24 +++
 elf/dl-diagnostics.c                            | 265 ++++++++++++++++++++++++
 elf/dl-diagnostics.h                            |  46 ++++
 elf/dl-main.h                                   |   5 +-
 elf/dl-usage.c                                  |   1 +
 elf/rtld.c                                      |  18 +-
 sysdeps/unix/sysv/linux/dl-diagnostics-kernel.c |  77 +++++++
 10 files changed, 466 insertions(+), 8 deletions(-)

commit 5510d44bea20bbf9941c4a56a6e67a22b237ebcd (tag: gentoo/glibc-2.33-2)
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Sat Feb 27 18:37:33 2021 +0100

    Enable nss-systemd in nsswitch.conf
    
    See
    https://bugs.gentoo.org/768366
    https://www.freedesktop.org/software/systemd/man/nss-systemd.html
    
    Bug: https://bugs.gentoo.org/768366
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 nss/nsswitch.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

commit b97721d9de6f243a6fe995201fb0ac721585d3d5
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Feb 19 13:29:00 2021 +0100

    string: Work around GCC PR 98512 in rawmemchr
    
    (cherry picked from commit 044e603b698093cf48f6e6229e0b66acf05227e4)
    (cherry picked from commit 8d4241b8976273513e72cc1c5f6b1af3e11f0792)

 string/rawmemchr.c | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

commit 6cf11b09307dc89b99b4e67eaf985564cc196a71
Author: Stefan Liebler <stli@linux.ibm.com>
Date:   Tue Feb 16 16:18:56 2021 +0100

    S390: Add new hwcap values.
    
    The new hwcap values indicate support for arch14 architecture.
    
    (cherry picked from commit 25251c0707fe34f30a27381a5fabc35435a96621)
    (cherry picked from commit 6efa2d44c8a5aeb34bd1f26b707c1713aac5bdd4)

 sysdeps/s390/dl-procinfo.c                | 5 +++--
 sysdeps/s390/dl-procinfo.h                | 4 +++-
 sysdeps/unix/sysv/linux/s390/bits/hwcap.h | 2 ++
 3 files changed, 8 insertions(+), 3 deletions(-)

commit 22d1756397ed6452d2b3ee1f3d84de57bcb15e43
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Fri Feb 5 14:09:24 2021 +0530

    tunables: Disallow negative values for some tunables
    
    The glibc.malloc.mmap_max tunable as well as al of the INT_32 tunables
    don't have use for negative values, so pin the hardcoded limits in the
    non-negative range of INT.  There's no real benefit in any of those
    use cases for the extended range of unsigned, so I have avoided added
    a new type to keep things simple.
    
    (cherry picked from commit 228f30ab4724d4087d5f52018873fde22efea6e2)
    (cherry picked from commit c5e354589729c0ca63899923f18783fa6803462d)

 elf/dl-tunables.list           | 6 ++++++
 elf/tst-rtld-list-tunables.exp | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

commit 8342a6458fd06d8fe19b2d93b7d25690ca112ecb
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Wed Feb 3 20:03:19 2021 +0530

    x86: Use SIZE_MAX instead of (long int)-1 for tunable range value
    
    The tunable types are SIZE_T, so set the ranges to the correct maximum
    value, i.e. SIZE_MAX.
    
    (cherry picked from commit a1b8b06a55c1ee581d5ef860cec214b0c27a66f0)
    (cherry picked from commit 905fdc7071638612027739d74d63fc91debb0325)

 sysdeps/x86/dl-cacheinfo.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

commit 9c3229393d6dfdf4df186a5a28fcceb69751355f
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Fri Feb 5 13:18:58 2021 +0530

    tunables: Simplify TUNABLE_SET interface
    
    The TUNABLE_SET interface took a primitive C type argument, which
    resulted in inconsistent type conversions internally due to incorrect
    dereferencing of types, especialy on 32-bit architectures.  This
    change simplifies the TUNABLE setting logic along with the interfaces.
    
    Now all numeric tunable values are stored as signed numbers in
    tunable_num_t, which is intmax_t.  All calls to set tunables cast the
    input value to its primitive type and then to tunable_num_t for
    storage.  This relies on gcc-specific (although I suspect other
    compilers woul also do the same) unsigned to signed integer conversion
    semantics, i.e. the bit pattern is conserved.  The reverse conversion
    is guaranteed by the standard.
    
    (cherry picked from commit 61117bfa1b08ca048e6512c0652c568300fedf6a)
    (cherry picked from commit 15afd6b8d8263010ed41bca09e62fefec1b7b3f8)

 elf/dl-tunable-types.h                         |   4 +-
 elf/dl-tunables.c                              | 128 ++++++++-----------------
 elf/dl-tunables.h                              |  37 +++----
 manual/README.tunables                         |  16 ++--
 sysdeps/unix/sysv/linux/aarch64/cpu-features.c |   2 +-
 sysdeps/x86/dl-cacheinfo.h                     |  15 ++-
 6 files changed, 75 insertions(+), 127 deletions(-)

commit c47cd4d87549b9bb126fb0ca14bcd49b0d48a9b2
Author: Sergei Trofimovich <slyfox@gentoo.org>
Date:   Fri Feb 5 07:32:18 2021 +0000

    nsswitch: return result when nss database is locked [BZ #27343]
    
    Before the change nss_database_check_reload_and_get() did not populate
    the '*result' value when it returned success in a case of chroot
    detection. This caused initgroups() to use garage pointer in the
    following test (extracted from unbound):
    
    ```
    
    int main() {
        // load some NSS modules
        struct passwd * pw = getpwnam("root");
    
        chdir("/tmp");
        chroot("/tmp");
        chdir("/");
        // access nsswitch.conf in a chroot
        initgroups("root", 0);
    }
    ```
    
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit c3479fb7939898ec22c655c383454d6e8b982a67)

 nss/nss_database.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

commit 015cb1dd0ed6630f1789c34afe69d7b219ebe861 (tag: gentoo/glibc-2.33-1)
Author: Sergei Trofimovich <slyfox@gentoo.org>
Date:   Sat Jul 11 20:06:51 2020 +0300

    Fix miscompilation on ia64's gcc-10
    
    Bug: https://bugs.gentoo.org/723268
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 sysdeps/unix/sysv/linux/ia64/dl-sysdep.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

commit c498b9de0d754c8c2b453963195596d1784ead63
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Fri Dec 14 20:43:04 2018 +0100

    Force -O0 in conform tests to survive $CC changes
    
    In bug #659030 Gentoo started passing user's CFLAGS via $CC variable.
    conform tests should but are not ready to handle -O1/-O2 yet.
    Tests fail to validate headers due to inlining of weak symbol aliases
    and other problems. Let's force it back to -O0 until it's fixed upstream.
    
    Original patch by Sergei, ported to the new python test framework by Andreas
    
    Bug: https://bugs.gentoo.org/659030
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 conform/conformtest.py   | 6 ++++--
 conform/linknamespace.py | 4 +++-
 2 files changed, 7 insertions(+), 3 deletions(-)

commit c50e825805e160dbb244156241c7188e973730c6
Author: Mike FABIAN <mfabian@redhat.com>
Date:   Mon Aug 10 15:58:12 2015 +0200

    Add C.UTF-8 locale
    
    Source:
    https://src.fedoraproject.org/rpms/glibc/raw/master/f/glibc-c-utf8-locale.patch
    
    Notes from there:
    This patch needs to upstream as part of Carlos O'Donell
    <carlos@redhat.com>'s work on enabling upstream C.UTF-8 support. This
    work is currently blocked on cleaning up the test results to prove that
    full code-point sorting is working as intended.
    Note that this patch does not provide full code-point sorting as
    expected.
    This patch needs to upstream as soon as possible since it would be nice
    to have this in F29 and fixed.
    
    Further information:
    https://bugzilla.redhat.com/show_bug.cgi?id=902094
    https://sourceware.org/bugzilla/show_bug.cgi?id=17318
    https://bugs.gentoo.org/671024

 localedata/SUPPORTED |   1 +
 localedata/locales/C | 238 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 239 insertions(+)

commit bae37f242d23ac2135a37d4ac8346cb3230b630a
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Mon Oct 22 22:34:13 2018 +0200

    Adapt to Gentoo-specific /etc/mail/aliases
    
    Patch by pacho2
    
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
    (cherry picked from commit 4e616cda056f471b799beba2b1cedc787ad4ecc0)

 nss/nss_files/files-alias.c    |  2 +-
 nss/tst-nss-files-alias-leak.c | 18 +++++++++---------
 support/support_chroot.c       |  8 +++++++-
 3 files changed, 17 insertions(+), 11 deletions(-)

commit b5c305250e3f6ef97e4847544a5227dc1de2d674
Author: Andreas K. Hüttel <dilfridge@gentoo.org>
Date:   Tue Aug 29 22:58:50 2017 +0200

    Revert " * sysdeps/posix/getaddrinfo.c (gaih_inet): Only use gethostbyname4_r"
    
    This reverts commit 8479f23aa1d5e5477a37f46823856bdafaedfa46.
    
    See for the background
      https://sourceware.org/bugzilla/show_bug.cgi?id=16826
      https://bugs.gentoo.org/show_bug.cgi?id=600632
    
    This makes tst-nss-files-hosts-multi fail. Disable it.

 nss/Makefile                | 1 -
 sysdeps/posix/getaddrinfo.c | 9 ++-------
 2 files changed, 2 insertions(+), 8 deletions(-)

commit e33f15e2a4e1b5ae74b07836102e59c07175b2ae
Author: Mike Frysinger <vapier@gentoo.org>
Date:   Wed Apr 1 02:15:48 2009 -0400

    Disable ldconfig during install
    
    Do not bother running ldconfig on DESTDIR.  It's a waste of time as we
    won't use the result (portage will rebuild the cache after install).
    Also, the Gentoo sandbox does not currently catch chroot() behavior so
    we end up (incorrectly) flagging it as a violation as a write to /etc.
    
    http://sourceware.org/ml/libc-alpha/2012-08/msg00118.html
    https://bugs.gentoo.org/431038

 Makefile | 1 +
 1 file changed, 1 insertion(+)
