- devel - example.com

(fwd) Possible memory leak in libdl.c [kaischoening@gmail.com]
by Waldemar Brodkorb 19 May '23

19 May '23

any ideas? best regards Waldemar

1 0

Implement 'futimesat' function for architectures where Linux does not provide a futimesat syscall.
by Elliot Thomas 13 Mar '23

13 Mar '23

Recently I tried compiling QEMU user emulation with uClibc on Aarch64, and found the 'futimesat' symbol was missing (but still defined in headers). This emulation is similar to the 'lutimesat' emulation. Regards, Elliot.

2 1

riscv64 problem with binutils 2.40
by Waldemar Brodkorb 31 Jan '23

31 Jan '23

Hi, I have a problem linking uClibc-ng for riscv64 with binutils 2.40. I get following error: /home/wbx/openadk/toolchain_qemu-riscv64_uclibc-ng/usr/bin/riscv64-openadk-linux-uclibc-gcc -Wl,-EL -shared -Wl,--warn-common -Wl,--warn-once -Wl,-z,combreloc -Wl,-z,relro -Wl,-O2 -Wl,-z,defs -L/home/wbx/openadk/target_qemu-riscv64_uclibc-ng/lib -L/home/wbx/openadk/target_qemu-riscv64_uclibc-ng/usr/lib -Wl,-O1 -Wl,-rpath -Wl,/usr/lib -Wl,-rpath-link -Wl,/home/wbx/openadk/target_qemu-riscv64_uclibc-ng/usr/lib -Wl,-init,__uClibc_init -Wl,-soname=libc.so.1 -nostdlib -nostartfiles -o lib/libuClibc-1.0.42.so -Wl,--whole-archive libc/libc_so.a -Wl,--no-whole-archive ./lib/interp.os ./lib/ld-uClibc.so.1 ./lib/uclibc_nonshared.a ./lib/libpthread_nonshared.a /home/wbx/openadk/toolchain_qemu-riscv64_uclibc-ng/usr/lib/gcc/riscv64-openadk-linux-uclibc/11.3.0/libgcc.a /home/wbx/openadk/toolchain_qemu-riscv64_uclibc-ng/usr/lib/gcc/riscv64-openadk-linux-uclibc/11.3.0/../../../../riscv64-openadk-linux-uclibc/bin/ld: relocation R_RISCV_RVC_JUMP against `__sigsetjmp' which may bind externally can not be used when making a shared object; recompile with -fPIC collect2: error: ld returned 1 exit status gmake[6]: *** [libc/Makefile.in:77: lib/libc.so] Error 1 I found this commit in glibc: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=68389203832ab39dd0db… But it does not work here. Anyone an idea how to fix it? best regards Waldemar

1 0

[PATCH 1/2] fix for CVE-2022-29503
by linted 29 Jan '23

29 Jan '23

Hello, Attached is a patch addressing CVE-2022-29503. After extensive testing, I wasn't able to trigger the bug as described in the reference articles. In my testing, the only way to trigger this bug is to modify PTHREAD_THREADS_MAX to allow enough threads to exhaust the address space. It is however possible that some custom configurations have small enough memory spaces which allow this to become an issue. Since this is a problem of mmap'ing overtop of existing mapped pages, I have elected to take advantage of the new MAP_FIXED_NOREPLACE flag and its associated guidance for backporting. I define it to 0 at the top of manager.c if it isn't defined to support older kernels. From 2b11aa00bd3b637c5c96db39538952dd12514085 Mon Sep 17 00:00:00 2001 From: linted <linted(a)users.noreply.github.com> Date: Sat, 21 Jan 2023 15:22:48 -0500 Subject: [PATCH 1/2] Fix for CVE-2022-29503. Changed linux thread's stack allocation mmap to use new MAP_FIXED_NOREPLACE flag on kernels >4.17. For older kernels, a check is added to see if requested address matches the address received. If the addresses don't match, an error is returned and thread creation is aborted. Signed-off-by: linted <linted(a)users.noreply.github.com> --- libpthread/linuxthreads/manager.c | 35 ++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/libpthread/linuxthreads/manager.c b/libpthread/linuxthreads/manager.c index 2a1ee62af..122997b10 100644 --- a/libpthread/linuxthreads/manager.c +++ b/libpthread/linuxthreads/manager.c @@ -47,6 +47,15 @@ # define USE_SELECT #endif +/* MAP_FIXED_NOREPLACE is not supported in kernel <= 4.17 + * If it's not already defined, define it to 0. + * We check the results of mmap to ensure the correct + * results, and error out otherwise. + */ +#ifndef MAP_FIXED_NOREPLACE +#define MAP_FIXED_NOREPLACE 0 +#endif + /* Array of active threads. Entry 0 is reserved for the initial thread. */ struct pthread_handle_struct __pthread_handles[PTHREAD_THREADS_MAX] = { { __LOCK_INITIALIZER, &__pthread_initial_thread, 0}, @@ -371,12 +380,19 @@ static int pthread_allocate_stack(const pthread_attr_t *attr, /* Allocate space for stack and thread descriptor at default address */ new_thread = default_new_thread; new_thread_bottom = (char *) (new_thread + 1) - stacksize; - if (mmap((caddr_t)((char *)(new_thread + 1) - INITIAL_STACK_SIZE), + void * new_stack_addr = NULL; + new_stack_addr = mmap((caddr_t)((char *)(new_thread + 1) - INITIAL_STACK_SIZE), INITIAL_STACK_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, - MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED | MAP_GROWSDOWN, - -1, 0) == MAP_FAILED) + MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE | MAP_GROWSDOWN, + -1, 0); + if (new_stack_addr == MAP_FAILED){ /* Bad luck, this segment is already mapped. */ return -1; + } else if ( new_stack_addr != (caddr_t)((char *)(new_thread + 1) - INITIAL_STACK_SIZE)) { + /* Worse luck, we almost overwrote an existing page */ + munmap(new_stack_addr, INITIAL_STACK_SIZE); + return -2; + } /* We manage to get a stack. Now see whether we need a guard and allocate it if necessary. Notice that the default attributes (stack_size = STACK_SIZE - pagesize) do not need @@ -496,9 +512,10 @@ static int pthread_handle_create(pthread_t *thread, const pthread_attr_t *attr, return EAGAIN; if (__pthread_handles[sseg].h_descr != NULL) continue; - if (pthread_allocate_stack(attr, thread_segment(sseg), pagesize, + int res = pthread_allocate_stack(attr, thread_segment(sseg), pagesize, &new_thread, &new_thread_bottom, - &guardaddr, &guardsize) == 0) + &guardaddr, &guardsize); + if ( res == 0) break; #ifndef __ARCH_USE_MMU__ else @@ -507,6 +524,14 @@ static int pthread_handle_create(pthread_t *thread, const pthread_attr_t *attr, * use the next one. However, when there is no MMU, malloc () is used. * It's waste of CPU cycles to continue to try if it fails. */ return EAGAIN; +#else + else if (res == -2) + /* When there is an MMU, if pthread_allocate_stack failed with -2, + * it indicates that we are attempting to mmap in address space which + * is already allocated. Any additional attempts will result in failure + * since we have exhausted our stack area. + */ + return EAGAIN; #endif } __pthread_handles_num++; -- 2.34.1

2 1

[PATCH 2/2] fix for CVE-2022-29503
by linted 21 Jan '23

21 Jan '23

Hello, This patch adds the MAP_FIXED_NOREPLACE flag which hasn't made its way into uclibc-ng yet. From c72a664b4bf44bc0d069068b5eed2b62ead35b19 Mon Sep 17 00:00:00 2001 From: linted <linted(a)users.noreply.github.com> Date: Sat, 21 Jan 2023 16:19:23 -0500 Subject: [PATCH 2/2] Defined MAP_FIXED_NOREPLACE Added definition for MAP_FIXED_NOREPLACE which was added in kernel 4.17 Signed-off-by: linted <linted(a)users.noreply.github.com> --- libc/sysdeps/linux/common/bits/mman-linux.h | 1 + 1 file changed, 1 insertion(+) diff --git a/libc/sysdeps/linux/common/bits/mman-linux.h b/libc/sysdeps/linux/common/bits/mman-linux.h index 6ca08415a..4947ddd89 100644 --- a/libc/sysdeps/linux/common/bits/mman-linux.h +++ b/libc/sysdeps/linux/common/bits/mman-linux.h @@ -46,6 +46,7 @@ /* Other flags. */ #define MAP_FIXED 0x10 /* Interpret addr exactly. */ +# define MAP_FIXED_NOREPLACE 0x100000 /* Used to solve problem with MAP_FIXED */ #ifdef __USE_MISC # define MAP_FILE 0 # ifdef __MAP_ANONYMOUS -- 2.34.1

1 0

CVE-2022-29503 questions
by linted 08 Jan '23

08 Jan '23

Hey, Has anyone looked into this CVE? I can't find any mention of it being worked on or even discussed. More info: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1517

2 2

getauxval() implementation
by Ramin Moussavi 07 Dec '22

07 Dec '22

fixed version

1 0

getauxval() git patch
by Ramin Moussavi 07 Dec '22

07 Dec '22

1 0

getauxval() implementation
by Ramin Moussavi 02 Dec '22

02 Dec '22

the main reason for this is to implement gettimeofday() call via vdso in uclibc-ng since i need to extend the auxiliary vector values i just implemented getauxval()

1 0

[PATCH] RISC-V 32-bit support
by ustcymgu＠gmail.com 20 Nov '22

20 Nov '22

Added 32-bit RISC-V support. I have managed to get 32-bit RISC-V No-MMU Linux running based on mainstream buildroot. It's nice to have uclibc support this 32-bit No-MMU target. There's no substantial code change except definations and config options. Signed-off-by: Yimin Gu <ustcymgu(a)gmail.com> --- Rules.mak | 2 ++ extra/Configs/Config.in | 9 +++++++++ extra/Configs/Config.riscv32 | 14 ++++++++++++++ libc/sysdeps/linux/riscv32 | 1 + libc/sysdeps/linux/riscv64/bits/wordsize.h | 3 ++- libc/sysdeps/linux/riscv64/sys/asm.h | 6 +++++- 6 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 extra/Configs/Config.riscv32 create mode 120000 libc/sysdeps/linux/riscv32 diff --git a/Rules.mak b/Rules.mak index 3fb64c728..71a14fc38 100644 --- a/Rules.mak +++ b/Rules.mak @@ -305,6 +305,7 @@ ifneq ($(TARGET_ARCH),c6x) ifneq ($(TARGET_ARCH),h8300) ifneq ($(TARGET_ARCH),arc) ifneq ($(TARGET_ARCH),aarch64) +ifneq ($(TARGET_ARCH),riscv32) CPU_CFLAGS-y += -msoft-float endif endif @@ -316,6 +317,7 @@ endif endif endif endif +endif ifeq ($(TARGET_ARCH),aarch64) CPU_CFLAGS-y += -ftls-model=initial-exec diff --git a/extra/Configs/Config.in b/extra/Configs/Config.in index a58ceb265..5e6af800d 100644 --- a/extra/Configs/Config.in +++ b/extra/Configs/Config.in @@ -39,6 +39,7 @@ choice default TARGET_or1k if DESIRED_TARGET_ARCH = "or1k" default TARGET_powerpc if DESIRED_TARGET_ARCH = "powerpc" default TARGET_riscv64 if DESIRED_TARGET_ARCH = "riscv64" + default TARGET_riscv32 if DESIRED_TARGET_ARCH = "riscv32" default TARGET_sh if DESIRED_TARGET_ARCH = "sh" default TARGET_sparc if DESIRED_TARGET_ARCH = "sparc" default TARGET_sparc64 if DESIRED_TARGET_ARCH = "sparc64" @@ -125,6 +126,9 @@ config TARGET_powerpc config TARGET_riscv64 bool "riscv64" +config TARGET_riscv32 + bool "riscv32" + config TARGET_sh bool "superh" @@ -240,6 +244,10 @@ if TARGET_riscv64 source "extra/Configs/Config.riscv64" endif +if TARGET_riscv32 +source "extra/Configs/Config.riscv32" +endif + if TARGET_sh source "extra/Configs/Config.sh" endif @@ -538,6 +546,7 @@ config UCLIBC_HAS_LINUXTHREADS select UCLIBC_HAS_REALTIME depends on !TARGET_aarch64 && \ !TARGET_riscv64 && \ + !TARGET_riscv32 && \ !TARGET_metag help If you want to compile uClibc with Linuxthreads support, then answer Y. diff --git a/extra/Configs/Config.riscv32 b/extra/Configs/Config.riscv32 new file mode 100644 index 000000000..304d30f70 --- /dev/null +++ b/extra/Configs/Config.riscv32 @@ -0,0 +1,14 @@ +# +# For a description of the syntax of this configuration file, +# see extra/config/Kconfig-language.txt +# + +config TARGET_ARCH + string + default "riscv32" + +config FORCE_OPTIONS_FOR_ARCH + bool + default y + select ARCH_LITTLE_ENDIAN + select ARCH_HAS_MMU diff --git a/libc/sysdeps/linux/riscv32 b/libc/sysdeps/linux/riscv32 new file mode 120000 index 000000000..11677ef05 --- /dev/null +++ b/libc/sysdeps/linux/riscv32 @@ -0,0 +1 @@ +riscv64 \ No newline at end of file diff --git a/libc/sysdeps/linux/riscv64/bits/wordsize.h b/libc/sysdeps/linux/riscv64/bits/wordsize.h index 67a16ba62..1fc649aad 100644 --- a/libc/sysdeps/linux/riscv64/bits/wordsize.h +++ b/libc/sysdeps/linux/riscv64/bits/wordsize.h @@ -25,5 +25,6 @@ #if __riscv_xlen == 64 # define __WORDSIZE_TIME64_COMPAT32 1 #else -# error "rv32i-based targets are not supported" +# define __WORDSIZE_TIME64_COMPAT32 1 +// # warning "rv32i-based targets are experimental" #endif diff --git a/libc/sysdeps/linux/riscv64/sys/asm.h b/libc/sysdeps/linux/riscv64/sys/asm.h index ddb84b683..3c94c9a70 100644 --- a/libc/sysdeps/linux/riscv64/sys/asm.h +++ b/libc/sysdeps/linux/riscv64/sys/asm.h @@ -26,7 +26,11 @@ # define REG_S sd # define REG_L ld #elif __riscv_xlen == 32 -# error "rv32i-based targets are not supported" +# define PTRLOG 2 +# define SZREG 4 +# define REG_S sw +# define REG_L lw +// # warning "rv32i-based targets are experimental" #else # error __riscv_xlen must equal 32 or 64 #endif -- 2.37.1

2 1