import glibc-2.39-36.el10

SOURCES/glibc-RHEL-71530-1.patch

+commit 1b0a2062c8938c7333cd118d85d9976c4e7c92af
+Author: Andreas Schwab <schwab@suse.de>
+Date:   Mon Jun 10 12:19:17 2024 +0200
+
+    iconv: Fix matching of multi-character transliterations (bug 31859)
+    
+    Only return __GCONV_INCOMPLETE_INPUT for a partial match when the end of
+    the input buffer is reached.  Otherwise it is a non-match, and other
+    patterns should be tried.
+
+diff --git a/iconv/Makefile b/iconv/Makefile
+index 63afc853ff65967a..65b4a44ab86cf0dc 100644
+--- a/iconv/Makefile
++++ b/iconv/Makefile
+@@ -57,6 +57,10 @@ tests = \
+ 	tst-iconv-opt \
+ 	# tests
+ 
++test-srcs := \
++	tst-translit-mchar \
++	# test-srcs
++
+ others		= iconv_prog iconvconfig
+ install-others-programs	= $(inst_bindir)/iconv
+ install-sbin	= iconvconfig
+@@ -73,6 +77,7 @@ include $(patsubst %,$(..)libof-iterator.mk,$(cpp-srcs-left))
+ ifeq ($(run-built-tests),yes)
+ xtests-special += $(objpfx)test-iconvconfig.out
+ tests-special += $(objpfx)tst-iconv_prog.out
++tests-special += $(objpfx)tst-translit-mchar.out
+ endif
+ 
+ # Make a copy of the file because gconv module names are constructed
+@@ -92,6 +97,8 @@ $(objpfx)tst-gconv-init-failure.out: \
+  $(objpfx)gconv-modules $(objpfx)tst-gconv-init-failure-mod.so
+ endif
+ 
++generated-dirs += tst-translit
++
+ include ../Rules
+ 
+ ifeq ($(run-built-tests),yes)
+@@ -126,3 +133,11 @@ $(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog
+ 	$(BASH) $< $(common-objdir) '$(test-wrapper-env)' \
+ 		 '$(run-program-env)' > $@; \
+ 	$(evaluate-test)
++
++$(objpfx)tst-translit-mchar.out: tst-translit-mchar.sh \
++			$(objpfx)tst-translit-mchar \
++			tst-translit-locale
++	$(SHELL) $< $(common-objpfx) '$(run-program-prefix-before-env)' \
++		 '$(run-program-env)' '$(run-program-prefix-after-env)' \
++		 $< > $@; \
++	$(evaluate-test)
+diff --git a/iconv/gconv_trans.c b/iconv/gconv_trans.c
+index 08b7a3f71dad5f1e..44f0fd849a3f82a3 100644
+--- a/iconv/gconv_trans.c
++++ b/iconv/gconv_trans.c
+@@ -150,7 +150,7 @@ __gconv_transliterate (struct __gconv_step *step,
+ 
+ 	  /* Nothing found, continue searching.  */
+ 	}
+-      else if (cnt > 0)
++      else if (cnt > 0 && winbuf + cnt == winbufend)
+ 	/* This means that the input buffer contents matches a prefix of
+ 	   an entry.  Since we cannot match it unless we get more input,
+ 	   we will tell the caller about it.  */
+diff --git a/iconv/tst-translit-locale b/iconv/tst-translit-locale
+new file mode 100644
+index 0000000000000000..712b08628a64dc11
+--- /dev/null
++++ b/iconv/tst-translit-locale
+@@ -0,0 +1,10 @@
++# Test multi-character transliteration rule
++
++LC_CTYPE
++copy "POSIX"
++
++translit_start
++"ÄÄ" "AA"
++translit_end
++
++END LC_CTYPE
+diff --git a/iconv/tst-translit-mchar.c b/iconv/tst-translit-mchar.c
+new file mode 100644
+index 0000000000000000..7d432ea6679b60fa
+--- /dev/null
++++ b/iconv/tst-translit-mchar.c
+@@ -0,0 +1,48 @@
++/* Test multi-character transliterations.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <locale.h>
++#include <iconv.h>
++#include <support/support.h>
++#include <support/check.h>
++
++static int
++do_test (void)
++{
++  iconv_t cd;
++  /* An input sequence that shares a common prefix with a transliteration
++     rule.  */
++  char input[] = "ÄÅ";
++  char *inptr = input;
++  char outbuf[10];
++  char *outptr = outbuf;
++  size_t inlen = sizeof (input), outlen = sizeof (outbuf);
++  size_t n;
++
++  xsetlocale (LC_CTYPE, "tst-translit");
++
++  cd = iconv_open ("ASCII//TRANSLIT", "UTF-8");
++  TEST_VERIFY (cd != (iconv_t) -1);
++
++  /* This call used to loop infinitely.  */
++  n = iconv (cd, &inptr, &inlen, &outptr, &outlen);
++  TEST_VERIFY (iconv_close (cd) == 0);
++  return n == 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/iconv/tst-translit-mchar.sh b/iconv/tst-translit-mchar.sh
+new file mode 100644
+index 0000000000000000..ab7a7f872911cf21
+--- /dev/null
++++ b/iconv/tst-translit-mchar.sh
+@@ -0,0 +1,51 @@
++#!/bin/sh
++# Testing of multi-character transliterations
++# Copyright (C) 2024 Free Software Foundation, Inc.
++# This file is part of the GNU C Library.
++
++# The GNU C Library is free software; you can redistribute it and/or
++# modify it under the terms of the GNU Lesser General Public
++# License as published by the Free Software Foundation; either
++# version 2.1 of the License, or (at your option) any later version.
++
++# The GNU C Library is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++# Lesser General Public License for more details.
++
++# You should have received a copy of the GNU Lesser General Public
++# License along with the GNU C Library; if not, see
++# <https://www.gnu.org/licenses/>.
++
++set -e
++
++common_objpfx=$1
++run_program_prefix_before_env=$2
++run_program_env=$3
++run_program_prefix_after_env=$4
++
++# Generate data files.
++# The locale only defines the LC_CTYPE category, so we expect a failure
++# due to warnings.
++ret=0
++${run_program_prefix_before_env} \
++${run_program_env} \
++I18NPATH=../localedata \
++${run_program_prefix_after_env} ${common_objpfx}locale/localedef \
++--quiet -i tst-translit-locale -f UTF-8 ${common_objpfx}iconv/tst-translit || ret=$?
++if [ $ret -gt 1 ]; then
++  echo "FAIL: Locale compilation for tst-translit-locale failed (error $ret)."
++  exit 1
++fi
++
++set -x
++
++# Run the test.
++${run_program_prefix_before_env} \
++${run_program_env} \
++LOCPATH=${common_objpfx}iconv \
++${run_program_prefix_after_env} ${common_objpfx}iconv/tst-translit-mchar
++
++# Local Variables:
++#  mode:shell-script
++# End:

SOURCES/glibc-RHEL-71530-10.patch

+commit 9a4b0eaf726f5404c6683d5c7c5e86f61c3f3fbc
+Author: Aurelien Jarno <aurelien@aurel32.net>
+Date:   Sat Dec 14 11:44:11 2024 +0100
+
+    iconv: do not report error exit with transliteration [BZ #32448]
+    
+    Commit 6cbf845fcdc7 ("iconv: Preserve iconv -c error exit on invalid
+    inputs (bug 32046)") changed the error exit code to report an error when
+    an input character has been transliterated. This looks like a bug as the
+    moto in the iconv program is to report an error code in the same
+    condition as the iconv() function.
+    
+    This happens because the STANDARD_TO_LOOP_ERR_HANDLER macro sets a
+    default value for result and later updates it if the transliteration
+    succeed. With the changes, setting the default value also marks the
+    input as illegal.
+    
+    Fix that by setting up the default value of result only when the
+    transliteration is not used. This works because __gconv_transliterate()
+    calls __gconv_mark_illegal_input() to return an error. At the same time
+    also fix the typo outself -> ourselves.
+    
+    Fixes: 6cbf845fcdc7
+    Resolves: BZ #32448
+    Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+
+diff --git a/iconv/loop.c b/iconv/loop.c
+index 199fb283266fb9ca..7149cec9b215a918 100644
+--- a/iconv/loop.c
++++ b/iconv/loop.c
+@@ -141,12 +141,13 @@
+    points.  */
+ #define STANDARD_TO_LOOP_ERR_HANDLER(Incr) \
+   {									      \
+-    result = __gconv_mark_illegal_input (step_data);			      \
+-									      \
+     if (irreversible == NULL)						      \
+-      /* This means we are in call from __gconv_transliterate.  In this	      \
+-	 case we are not doing any error recovery outself.  */		      \
+-      break;								      \
++      {									      \
++	/* This means we are in call from __gconv_transliterate.  In this     \
++	   case we are not doing any error recovery ourselves.  */	      \
++	result = __gconv_mark_illegal_input (step_data);		      \
++	break;								      \
++      }									      \
+ 									      \
+     /* If needed, flush any conversion state, so that __gconv_transliterate   \
+        starts with current shift state.  */				      \
+@@ -157,6 +158,8 @@
+       result = __gconv_transliterate					      \
+ 	(step, step_data, *inptrp,					      \
+ 	 &inptr, inend, &outptr, irreversible);			      \
++    else								      \
++      result = __gconv_mark_illegal_input (step_data);			      \
+ 									      \
+     REINIT_PARAMS;							      \
+ 									      \
+diff --git a/iconv/tst-iconv_prog.sh b/iconv/tst-iconv_prog.sh
+index ca4dbd4a3a3318fe..f3a03ac062a70b05 100644
+--- a/iconv/tst-iconv_prog.sh
++++ b/iconv/tst-iconv_prog.sh
+@@ -211,12 +211,13 @@ hangarray=(
+ "\x00\x81;-c;WIN-SAMI-2;UTF-8//TRANSLIT//IGNORE"
+ )
+ 
+-# List of option combinations that *should* lead to an error
+-errorarray=(
++# List of option combinations with their expected return code
++testarray=(
+ # Converting from/to invalid character sets should cause error
+-"\x00\x00;;INVALID;INVALID"
+-"\x00\x00;;INVALID;UTF-8"
+-"\x00\x00;;UTF-8;INVALID"
++"\x00\x00;;INVALID;INVALID;1"
++"\x00\x00;;INVALID;UTF-8;1"
++"\x00\x00;;UTF-8;INVALID;1"
++"\xc3\xa9;;UTF-8;ASCII//TRANSLIT;0"
+ )
+ 
+ # Requires $twobyte input, $c flag, $from, and $to to be set; sets $ret
+@@ -264,7 +265,7 @@ done
+ 
+ check_errtest_result ()
+ {
+-  if [ "$ret" -eq "1" ]; then # we errored out as expected
++  if [ "$ret" -eq "$eret" ]; then # we got the expected return code
+     result="PASS"
+   else
+     result="FAIL"
+@@ -277,11 +278,12 @@ check_errtest_result ()
+   fi
+ }
+ 
+-for errorcommand in "${errorarray[@]}"; do
+-  twobyte="$(echo "$errorcommand" | cut -d";" -f 1)"
+-  c="$(echo "$errorcommand" | cut -d";" -f 2)"
+-  from="$(echo "$errorcommand" | cut -d";" -f 3)"
+-  to="$(echo "$errorcommand" | cut -d";" -f 4)"
++for testcommand in "${testarray[@]}"; do
++  twobyte="$(echo "$testcommand" | cut -d";" -f 1)"
++  c="$(echo "$testcommand" | cut -d";" -f 2)"
++  from="$(echo "$testcommand" | cut -d";" -f 3)"
++  to="$(echo "$testcommand" | cut -d";" -f 4)"
++  eret="$(echo "$testcommand" | cut -d";" -f 5)"
+   execute_test
+   check_errtest_result
+ done

SOURCES/glibc-RHEL-71530-2.patch

+commit 422ed8ede312f786369e4850e47b8d32beaae4e4
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Sep 20 13:10:54 2024 +0200
+
+    iconv: Base tests for buffer management
+    
+    Reviewed-by: DJ Delorie <dj@redhat.com>
+
+diff --git a/iconv/Makefile b/iconv/Makefile
+index 65b4a44ab86cf0dc..b0fa550141db5a06 100644
+--- a/iconv/Makefile
++++ b/iconv/Makefile
+@@ -76,8 +76,11 @@ include $(patsubst %,$(..)libof-iterator.mk,$(cpp-srcs-left))
+ 
+ ifeq ($(run-built-tests),yes)
+ xtests-special += $(objpfx)test-iconvconfig.out
+-tests-special += $(objpfx)tst-iconv_prog.out
+-tests-special += $(objpfx)tst-translit-mchar.out
++tests-special += \
++	$(objpfx)tst-iconv_prog-buffer.out \
++	$(objpfx)tst-iconv_prog.out \
++	$(objpfx)tst-translit-mchar.out \
++	# tests-special
+ endif
+ 
+ # Make a copy of the file because gconv module names are constructed
+@@ -141,3 +144,8 @@ $(objpfx)tst-translit-mchar.out: tst-translit-mchar.sh \
+ 		 '$(run-program-env)' '$(run-program-prefix-after-env)' \
+ 		 $< > $@; \
+ 	$(evaluate-test)
++
++$(objpfx)tst-iconv_prog-buffer.out: \
++  tst-iconv_prog-buffer.sh $(objpfx)iconv_prog
++	$(BASH) $< $(common-objdir) '$(test-program-prefix)' > $@; \
++	$(evaluate-test)
+diff --git a/iconv/tst-iconv_prog-buffer.sh b/iconv/tst-iconv_prog-buffer.sh
+new file mode 100644
+index 0000000000000000..a27107f02b95cdc7
+--- /dev/null
++++ b/iconv/tst-iconv_prog-buffer.sh
+@@ -0,0 +1,177 @@
++#!/bin/bash
++# Test for iconv (the program) buffer management.
++# Copyright (C) 2024 Free Software Foundation, Inc.
++# This file is part of the GNU C Library.
++
++# The GNU C Library is free software; you can redistribute it and/or
++# modify it under the terms of the GNU Lesser General Public
++# License as published by the Free Software Foundation; either
++# version 2.1 of the License, or (at your option) any later version.
++
++# The GNU C Library is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++# Lesser General Public License for more details.
++
++# You should have received a copy of the GNU Lesser General Public
++# License along with the GNU C Library; if not, see
++# <https://www.gnu.org/licenses/>.
++
++exec 2>&1
++set -e
++
++exec {logfd}>&1
++
++codir=$1
++test_program_prefix="$2"
++
++# Use internal converters to avoid issues with module loading.
++iconv_args="-f ASCII -t UTF-8"
++
++failure=false
++
++tmp=`mktemp -d`
++trap 'rm -rf "$tmp"' 0
++echo ABC > "$tmp/abc"
++echo DEF > "$tmp/def"
++echo GGG > "$tmp/ggg"
++echo HH > "$tmp/hh"
++echo XY > "$tmp/xy"
++echo ZT > "$tmp/zt"
++echo OUT > "$tmp/out-template"
++printf '\xff' > "$tmp/0xff"
++cat "$tmp/xy" "$tmp/0xff" "$tmp/zt" > "$tmp/0xff-wrapped"
++
++run_iconv () {
++    local c=0
++    if test "${FUNCNAME[2]}" = main; then
++       c=1
++    fi
++    echo "${BASH_SOURCE[$c]}:${BASH_LINENO[$c]}: iconv $iconv_args $@" >&$logfd
++    $test_program_prefix $codir/iconv/iconv_prog $iconv_args "$@"
++}
++
++check_out_expected () {
++    if ! cmp -s "$tmp/out" "$tmp/expected" ; then
++        echo "error: iconv output difference" >&$logfd
++        echo "*** expected ***" >&$logfd
++        cat "$tmp/expected" >&$logfd
++        echo "*** actual ***" >&$logfd
++        cat "$tmp/out" >&$logfd
++        failure=true
++    fi
++}
++
++expect_files () {
++    local f
++    ! test -z "$1"
++    cp "$tmp/$1" "$tmp/expected"
++    shift
++    for f in "$@" ; do
++        cat "$tmp/$f" >> "$tmp/expected"
++    done
++    check_out_expected
++}
++
++check_out () {
++    cat > "$tmp/expected"
++    check_out_expected
++}
++
++expect_exit () {
++    local expected=$1
++    shift
++    # Prevent failure for stopping the script.
++    if "$@" ; then
++        actual=$?
++    else
++        actual=$?
++    fi
++    if test "$actual" -ne "$expected"; then
++        echo "error: expected exit status $expected, not $actual" >&$logfd
++        exit 1
++    fi
++}
++
++ignore_failure () {
++    set +e
++    "$@"
++    status=$?
++    set -e
++}
++
++# Concatentation test.
++run_iconv -o "$tmp/out" "$tmp/abc" "$tmp/def"
++expect_files abc def
++
++# Single-file in-place conversion.
++run_iconv -o "$tmp/out" "$tmp/out"
++expect_files abc def
++
++# Multiple input files with in-place conversion.
++
++run_iconv -o "$tmp/out" "$tmp/out" "$tmp/abc"
++expect_files abc def abc
++
++# But not if we are writing to standard output.
++
++cp "$tmp/out-template" "$tmp/out"
++run_iconv </dev/null >>"$tmp/out"
++expect_files out-template
++
++cp "$tmp/out-template" "$tmp/out"
++run_iconv - </dev/null >>"$tmp/out"
++expect_files out-template
++
++cp "$tmp/out-template" "$tmp/out"
++run_iconv /dev/null >>"$tmp/out"
++expect_files out-template
++
++# Conversion errors should avoid clobbering an existing file if
++# it is also an input file.
++
++cp "$tmp/0xff" "$tmp/out"
++expect_exit 1 run_iconv -o "$tmp/out" "$tmp/out"
++expect_files 0xff
++
++cp "$tmp/0xff" "$tmp/out"
++expect_exit 1 run_iconv -o "$tmp/out" < "$tmp/out"
++expect_files 0xff
++
++cp "$tmp/0xff" "$tmp/out"
++expect_exit 1 run_iconv -o "$tmp/out" - < "$tmp/out"
++expect_files 0xff
++
++# If errors are ignored, the file should be overwritten.
++
++cp "$tmp/out-template" "$tmp/out"
++expect_exit 1 \
++    run_iconv -c -o "$tmp/out" "$tmp/abc" "$tmp/0xff" "$tmp/def" 2>"$tmp/err"
++! test -s "$tmp/err"
++expect_files abc def
++
++# FIXME: This is not correct, -c should not change the exit status.
++cp "$tmp/out-template" "$tmp/out"
++run_iconv -c -o "$tmp/out" \
++    "$tmp/abc" "$tmp/0xff-wrapped" "$tmp/def" 2>"$tmp/err"
++! test -s "$tmp/err"
++expect_files abc xy zt def
++
++# If the file does not exist yet, it should not be created on error.
++
++rm "$tmp/out"
++expect_exit 1 run_iconv -o "$tmp/out" "$tmp/0xff"
++! test -e "$tmp/out"
++
++expect_exit 1 run_iconv -o "$tmp/out" < "$tmp/0xff"
++! test -e "$tmp/out"
++
++expect_exit 1 run_iconv -o "$tmp/out" "$tmp/abc" "$tmp/0xff" "$tmp/def"
++! test -e "$tmp/out"
++
++expect_exit 1 run_iconv -o "$tmp/out" "$tmp/abc" - < "$tmp/0xff" "$tmp/def"
++! test -e "$tmp/out"
++
++if $failure ; then
++    exit 1
++fi

SOURCES/glibc-RHEL-71530-3.patch

+commit 0cb64617a6f691b611406427c8e24b7f04c4983f
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Sep 20 13:10:54 2024 +0200
+
+    iconv: Do not use mmap in iconv (the program) (bug 17703)
+    
+    On current systems, very large files are needed before
+    mmap becomes beneficial.  Simplify the implementation.
+    
+    This exposed that inptr was not initialized correctly in
+    process_fd.  Handling multiple input files resulted in
+    EFAULT in read because a null pointer was passed.  This
+    could be observed previously if an input file was not
+    mappable and was reported as bug 17703.
+    
+    Reviewed-by: DJ Delorie <dj@redhat.com>
+
+diff --git a/iconv/iconv_prog.c b/iconv/iconv_prog.c
+index a765b1af21d2bde0..88a928557e7afb0a 100644
+--- a/iconv/iconv_prog.c
++++ b/iconv/iconv_prog.c
+@@ -31,9 +31,6 @@
+ #include <string.h>
+ #include <unistd.h>
+ #include <libintl.h>
+-#ifdef _POSIX_MAPPED_FILES
+-# include <sys/mman.h>
+-#endif
+ #include <charmap.h>
+ #include <gconv_int.h>
+ #include "iconv_prog.h"
+@@ -253,10 +250,6 @@ conversions from `%s' and to `%s' are not supported"),
+       else
+ 	do
+ 	  {
+-#ifdef _POSIX_MAPPED_FILES
+-	    struct stat64 st;
+-	    char *addr;
+-#endif
+ 	    int fd, ret;
+ 
+ 	    if (verbose)
+@@ -276,39 +269,6 @@ conversions from `%s' and to `%s' are not supported"),
+ 		  }
+ 	      }
+ 
+-#ifdef _POSIX_MAPPED_FILES
+-	    /* We have possibilities for reading the input file.  First try
+-	       to mmap() it since this will provide the fastest solution.  */
+-	    if (fstat64 (fd, &st) == 0
+-		&& ((addr = mmap (NULL, st.st_size, PROT_READ, MAP_PRIVATE,
+-				  fd, 0)) != MAP_FAILED))
+-	      {
+-		/* Yes, we can use mmap().  The descriptor is not needed
+-		   anymore.  */
+-		if (close (fd) != 0)
+-		  error (EXIT_FAILURE, errno,
+-			 _("error while closing input `%s'"),
+-			 argv[remaining]);
+-
+-		ret = process_block (cd, addr, st.st_size, &output,
+-				     output_file);
+-
+-		/* We don't need the input data anymore.  */
+-		munmap ((void *) addr, st.st_size);
+-
+-		if (ret != 0)
+-		  {
+-		    status = EXIT_FAILURE;
+-
+-		    if (ret < 0)
+-		      /* We cannot go on with producing output since it might
+-			 lead to problem because the last output might leave
+-			 the output stream in an undefined state.  */
+-		      break;
+-		  }
+-	      }
+-	    else
+-#endif	/* _POSIX_MAPPED_FILES */
+ 	      {
+ 		/* Read the file in pieces.  */
+ 		ret = process_fd (cd, fd, &output, output_file);
+@@ -544,7 +504,7 @@ process_fd (iconv_t cd, int fd, FILE **output, const char *output_file)
+      process it in one step.  */
+   static char *inbuf = NULL;
+   static size_t maxlen = 0;
+-  char *inptr = NULL;
++  char *inptr = inbuf;
+   size_t actlen = 0;
+ 
+   while (actlen < maxlen)

SOURCES/glibc-RHEL-71530-4.patch

+commit 00ba299787c2ea9e5c4986301e2f4965dffbfded
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Sep 20 13:10:54 2024 +0200
+
+    manual: __is_last is no longer part of iconv internals
+    
+    The __is_last field was replaced with a bitmask in
+    commit 85830c4c4688b30d3d76111aa9a26745c7b141d6 in 2000,
+    and multiple bits are in use today.
+    
+    Reviewed-by: DJ Delorie <dj@redhat.com>
+
+diff --git a/manual/charset.texi b/manual/charset.texi
+index 427db3bc804f6244..3aaa62d088570f76 100644
+--- a/manual/charset.texi
++++ b/manual/charset.texi
+@@ -2422,11 +2422,11 @@ written into the buffer to signal how much output is available.  If this
+ conversion step is not the last one, the element must not be modified.
+ The @code{__outbufend} element must not be modified.
+ 
+-@item int __is_last
+-This element is nonzero if this conversion step is the last one.  This
+-information is necessary for the recursion.  See the description of the
+-conversion function internals below.  This element must never be
+-modified.
++@item int __flags
++This field is a set of flags.  The @code{__GCONV_IS_LAST} bit is set if
++this conversion step is the last one.  This information is necessary for
++the recursion.  See the description of the conversion function internals
++below.  This element must never be modified.
+ 
+ @item int __invocation_counter
+ The conversion function can use this element to see how many calls of
+@@ -2731,8 +2731,8 @@ Otherwise the function has to emit a byte sequence to bring the state
+ object into the initial state.  Once this all happened the other
+ conversion modules in the chain of conversions have to get the same
+ chance.  Whether another step follows can be determined from the
+-@code{__is_last} element of the step data structure to which the first
+-parameter points.
++@code{__GCONV_IS_LAST} flag in the @code{__flags} field of the step
++data structure to which the first parameter points.
+ 
+ The more interesting mode is when actual text has to be converted.  The
+ first step in this case is to convert as much text as possible from the
+@@ -2866,7 +2866,7 @@ gconv (struct __gconv_step *step, struct __gconv_step_data *data,
+ 
+       /* @r{Call the steps down the chain if there are any but only}
+          @r{if we successfully emitted the escape sequence.}  */
+-      if (status == __GCONV_OK && ! data->__is_last)
++      if (status == __GCONV_OK && ! (data->__flags & __GCONV_IS_LAST))
+         status = fct (next_step, next_data, NULL, NULL,
+                       written, 1);
+     @}
+@@ -2892,7 +2892,7 @@ gconv (struct __gconv_step *step, struct __gconv_step_data *data,
+ 
+           /* @r{If this is the last step, leave the loop.  There is}
+              @r{nothing we can do.}  */
+-          if (data->__is_last)
++          if (data->__flags & __GCONV_IS_LAST)
+             @{
+               /* @r{Store information about how many bytes are}
+                  @r{available.}  */

SOURCES/glibc-RHEL-71530-7.patch

+commit 75819cdd29a193cc2db980878bec305905b22bbc
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Sep 20 13:10:54 2024 +0200
+
+    iconv: Multiple - on command line should not fail (bug 32050)
+    
+    Usually, the second and subsequent - return EOF immediately
+    and do not contribute to the output, but this is not an error.
+    
+    Reviewed-by: DJ Delorie <dj@redhat.com>
+
+diff --git a/iconv/iconv_prog.c b/iconv/iconv_prog.c
+index 3e02db7319185d45..dd4bc3a59a20799a 100644
+--- a/iconv/iconv_prog.c
++++ b/iconv/iconv_prog.c
+@@ -287,7 +287,8 @@ conversions from `%s' and to `%s' are not supported"),
+ 		ret = process_fd (cd, fd);
+ 
+ 		/* Now close the file.  */
+-		close (fd);
++		if (fd != STDIN_FILENO)
++		  close (fd);
+ 
+ 		if (ret != 0)
+ 		  {
+diff --git a/iconv/tst-iconv_prog-buffer.sh b/iconv/tst-iconv_prog-buffer.sh
+index 54ff871d32929997..a9c3729d948b4679 100644
+--- a/iconv/tst-iconv_prog-buffer.sh
++++ b/iconv/tst-iconv_prog-buffer.sh
+@@ -265,6 +265,11 @@ expect_exit 1 run_iconv -o "$tmp/out" "$tmp/abc" "$tmp/0xff" "$tmp/def"
+ expect_exit 1 run_iconv -o "$tmp/out" "$tmp/abc" - < "$tmp/0xff" "$tmp/def"
+ ! test -e "$tmp/out"
+ 
++# Listing standard input multiple times should not fail (bug 32050).
++
++run_iconv -o "$tmp/out" "$tmp/xy" - - "$tmp/zt" < "$tmp/abc"
++expect_files xy abc zt
++
+ if $failure ; then
+     exit 1
+ fi

SOURCES/glibc-RHEL-71530-8.patch

+commit fa1b0d5e9f6e0353e16339430770a7a8824c0468
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Sep 20 13:10:54 2024 +0200
+
+    iconv: Input buffering for the iconv program (bug 6050)
+    
+    Do not read the entire input file into memory.
+    
+    Reviewed-by: DJ Delorie <dj@redhat.com>
+
+diff --git a/iconv/iconv_prog.c b/iconv/iconv_prog.c
+index dd4bc3a59a20799a..a2f1d34e4579f80f 100644
+--- a/iconv/iconv_prog.c
++++ b/iconv/iconv_prog.c
+@@ -118,8 +118,9 @@ static size_t output_buffer_size = 1024 * 1024;
+ 
+ /* Prototypes for the functions doing the actual work.  */
+ static void prepare_output_file (char **argv);
+-static void close_output_file (int status);
+-static int process_block (iconv_t cd, char *addr, size_t len);
++static void close_output_file (__gconv_t cd, int status);
++static int process_block (iconv_t cd, char **addr, size_t *len,
++			  off64_t file_offset, bool *incomplete);
+ static int process_fd (iconv_t cd, int fd);
+ static int process_file (iconv_t cd, FILE *input);
+ static void print_known_names (void);
+@@ -311,7 +312,7 @@ conversions from `%s' and to `%s' are not supported"),
+ 	status = EXIT_FAILURE;
+ 
+       /* Close the output file now.  */
+-      close_output_file (status);
++      close_output_file (cd, status);
+     }
+ 
+   return status;
+@@ -599,7 +600,7 @@ flush_output (void)
+ }
+ 
+ static void
+-close_output_file (int status)
++close_output_file (__gconv_t cd, int status)
+ {
+   /* Do not perform a flush if a temporary file or the in-memory
+      buffer is in use and there was an error.  It would clobber the
+@@ -608,10 +609,28 @@ close_output_file (int status)
+       (output_using_temporary_file || output_fd < 0))
+     return;
+ 
+-  /* The current_input_file_index variable is now larger than
+-     last_overlapping_file_index, so the flush_output call switches
++  /* All the input text is processed.  For state-dependent character
++     sets we have to flush the state now.
++
++     The current_input_file_index variable is now larger than
++     last_overlapping_file_index, so the flush_output calls switch
+      away from the temporary file.  */
++  size_t n = iconv (cd, NULL, NULL,
++		    &output_buffer_current, &output_buffer_remaining);
++  if (n == (size_t) -1 && errno == E2BIG)
++    {
++      /* Try again if the state flush exceeded the buffer space.  */
++      flush_output ();
++      n = iconv (cd, NULL, NULL,
++		 &output_buffer_current, &output_buffer_remaining);
++    }
++  int saved_errno = errno;
+   flush_output ();
++  if (n == (size_t) -1 && !omit_invalid)
++    {
++      errno = saved_errno;
++      output_error ();
++    }
+ 
+   if (output_fd == STDOUT_FILENO)
+     {
+@@ -625,51 +644,35 @@ close_output_file (int status)
+     output_error ();
+ }
+ 
++/* CD is the iconv handle.  Input processing starts at *ADDR, and
++   consumes upto *LEN bytes.  *ADDR and *LEN are updated.  FILE_OFFSET
++   is the file offset of the data initially at ADDR.  *INCOMPLETE is
++   set to true if conversion stops due to an incomplete input
++   sequence.  */
+ static int
+-process_block (iconv_t cd, char *addr, size_t len)
++process_block (iconv_t cd, char **addr, size_t *len, off64_t file_offset,
++	       bool *incomplete)
+ {
+-  const char *start = addr;
++  const char *start = *addr;
+   size_t n;
+   int ret = 0;
+ 
+-  while (len > 0)
++  while (*len > 0)
+     {
+-      n = iconv (cd, &addr, &len,
++      n = iconv (cd, addr, len,
+ 		 &output_buffer_current, &output_buffer_remaining);
+ 
+       if (n == (size_t) -1 && omit_invalid && errno == EILSEQ)
+ 	{
+ 	  ret = 1;
+-	  if (len == 0)
++	  if (*len == 0)
+ 	    n = 0;
+ 	  else
+ 	    errno = E2BIG;
+ 	}
+ 
+       if (n != (size_t) -1)
+-	{
+-	  /* All the input test is processed.  For state-dependent
+-	     character sets we have to flush the state now.  */
+-	  n = iconv (cd, NULL, NULL,
+-		     &output_buffer_current, &output_buffer_remaining);
+-	  if (n == (size_t) -1 && errno == E2BIG)
+-	    {
+-	      /* Try again if the state flush exceeded the buffer space.  */
+-	      flush_output ();
+-	      n = iconv (cd, NULL, NULL,
+-			 &output_buffer_current, &output_buffer_remaining);
+-	    }
+-	  bool errno_is_EILSEQ = errno == EILSEQ;
+-
+-	  if (n != (size_t) -1)
+-	    break;
+-
+-	  if (omit_invalid && errno_is_EILSEQ)
+-	    {
+-	      ret = 1;
+-	      break;
+-	    }
+-	}
++	break;
+ 
+       if (errno == E2BIG)
+ 	flush_output ();
+@@ -680,13 +683,12 @@ process_block (iconv_t cd, char *addr, size_t len)
+ 	    {
+ 	    case EILSEQ:
+ 	      if (! omit_invalid)
+-		error (0, 0, _("illegal input sequence at position %ld"),
+-		       (long int) (addr - start));
++		error (0, 0, _("illegal input sequence at position %lld"),
++		       (long long int) (file_offset + (*addr - start)));
+ 	      break;
+ 	    case EINVAL:
+-	      error (0, 0, _("\
+-incomplete character or shift sequence at end of buffer"));
+-	      break;
++	      *incomplete = true;
++	      return ret;
+ 	    case EBADF:
+ 	      error (0, 0, _("internal error (illegal descriptor)"));
+ 	      break;
+@@ -706,79 +708,49 @@ incomplete character or shift sequence at end of buffer"));
+ static int
+ process_fd (iconv_t cd, int fd)
+ {
+-  /* we have a problem with reading from a descriptor since we must not
+-     provide the iconv() function an incomplete character or shift
+-     sequence at the end of the buffer.  Since we have to deal with
+-     arbitrary encodings we must read the whole text in a buffer and
+-     process it in one step.  */
+-  static char *inbuf = NULL;
+-  static size_t maxlen = 0;
+-  char *inptr = inbuf;
+-  size_t actlen = 0;
+-
+-  while (actlen < maxlen)
++  char inbuf[BUFSIZ];
++  char *inbuf_end = inbuf + sizeof (inbuf);
++  size_t inbuf_used = 0;
++  off64_t file_offset = 0;
++  int status = 0;
++  bool incomplete = false;
++
++  while (true)
+     {
+-      ssize_t n = read (fd, inptr, maxlen - actlen);
+-
+-      if (n == 0)
+-	/* No more text to read.  */
+-	break;
+-
+-      if (n == -1)
++      char *p = inbuf + inbuf_used;
++      ssize_t read_ret = read (fd, p, inbuf_end - p);
++      if (read_ret == 0)
++	{
++	  /* On EOF, check if the previous iconv invocation saw an
++	     incomplete sequence.  */
++	  if (incomplete)
++	    {
++	      error (0, 0, _("\
++incomplete character or shift sequence at end of buffer"));
++	      return 1;
++	    }
++	  return 0;
++	}
++      if (read_ret < 0)
+ 	{
+-	  /* Error while reading.  */
+ 	  error (0, errno, _("error while reading the input"));
+ 	  return -1;
+ 	}
+-
+-      inptr += n;
+-      actlen += n;
++      inbuf_used += read_ret;
++      incomplete = false;
++      p = inbuf;
++      int ret = process_block (cd, &p, &inbuf_used, file_offset, &incomplete);
++      if (ret != 0)
++	{
++	  status = ret;
++	  if (ret < 0)
++	    break;
++	}
++      /* The next loop iteration consumes the leftover bytes.  */
++      memmove (inbuf, p, inbuf_used);
++      file_offset += read_ret - inbuf_used;
+     }
+-
+-  if (actlen == maxlen)
+-    while (1)
+-      {
+-	ssize_t n;
+-	char *new_inbuf;
+-
+-	/* Increase the buffer.  */
+-	new_inbuf = (char *) realloc (inbuf, maxlen + 32768);
+-	if (new_inbuf == NULL)
+-	  {
+-	    error (0, errno, _("unable to allocate buffer for input"));
+-	    return -1;
+-	  }
+-	inbuf = new_inbuf;
+-	maxlen += 32768;
+-	inptr = inbuf + actlen;
+-
+-	do
+-	  {
+-	    n = read (fd, inptr, maxlen - actlen);
+-
+-	    if (n == 0)
+-	      /* No more text to read.  */
+-	      break;
+-
+-	    if (n == -1)
+-	      {
+-		/* Error while reading.  */
+-		error (0, errno, _("error while reading the input"));
+-		return -1;
+-	      }
+-
+-	    inptr += n;
+-	    actlen += n;
+-	  }
+-	while (actlen < maxlen);
+-
+-	if (n == 0)
+-	  /* Break again so we leave both loops.  */
+-	  break;
+-      }
+-
+-  /* Now we have all the input in the buffer.  Process it in one run.  */
+-  return process_block (cd, inbuf, actlen);
++  return status;
+ }
+ 
+ 
+diff --git a/iconv/tst-iconv_prog-buffer.sh b/iconv/tst-iconv_prog-buffer.sh
+index a9c3729d948b4679..23098ac56a344c48 100644
+--- a/iconv/tst-iconv_prog-buffer.sh
++++ b/iconv/tst-iconv_prog-buffer.sh
+@@ -50,6 +50,9 @@ echo OUT > "$tmp/out-template"
+ : > "$tmp/empty"
+ printf '\xff' > "$tmp/0xff"
+ 
++# Length should be a prime number, to help with buffer alignment testing.
++printf '\xc3\xa4\xe2\x80\x94\xe2\x80\x94\xc3\xa4\n' > "$tmp/utf8-sequence"
++
+ # Double all files to produce larger buffers.
+ for p in "$tmp"/* ; do
+     i=0
+@@ -270,6 +273,34 @@ expect_exit 1 run_iconv -o "$tmp/out" "$tmp/abc" - < "$tmp/0xff" "$tmp/def"
+ run_iconv -o "$tmp/out" "$tmp/xy" - - "$tmp/zt" < "$tmp/abc"
+ expect_files xy abc zt
+ 
++# NB: Extra iconv args are ignored after this point.  Actual
++# multi-byte conversion does not work with tiny buffers.
++iconv_args="-f UTF-8 -t ASCII"
++
++printf 'x\n\xc3' > "$tmp/incomplete"
++expect_exit 1 run_iconv -o "$tmp/out" "$tmp/incomplete"
++check_out <<EOF
++x
++EOF
++
++# Test buffering behavior if the buffer ends with an incomplete
++# multi-byte sequence.
++prefix=""
++prefix_length=0
++while test $prefix_length -lt 12; do
++    echo "info: testing prefix length $prefix_length" 2>&$logfd
++    printf "%s" "$prefix" > "$tmp/prefix"
++    cat "$tmp/prefix" "$tmp/utf8-sequence" > "$tmp/tmp"
++    iconv_args="-f UTF-8 -t UCS-4"
++    run_iconv -o "$tmp/out1" "$tmp/tmp"
++    iconv_args="-f UCS-4 -t UTF-8"
++    run_iconv -o "$tmp/out" "$tmp/out1"
++    expect_files prefix utf8-sequence
++
++    prefix="$prefix@"
++    prefix_length=$(($prefix_length + 1))
++done
++
+ if $failure ; then
+     exit 1
+ fi

SOURCES/glibc-RHEL-71530-9.patch

+commit 079ebf7624e7fd0ad7fe94a7176a2e132c996d86
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Tue Sep 24 10:41:35 2024 +0200
+
+    iconv: Use $(run-program-prefix) for running iconv (bug 32197)
+    
+    With --enable-hardcoded-path-in-tests, $(test-program-prefix)
+    does not redirect to the built glibc, but we need to run
+    iconv (the program) against the built glibc even with
+    --enable-hardcoded-path-in-tests, as it is using the ABI
+    path for the dynamic linker (as an installed program).
+    Use $(run-program-prefix) instead.
+    
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+
+diff --git a/iconv/Makefile b/iconv/Makefile
+index c9af0c4d44cae7fb..de9d964ed3c762bf 100644
+--- a/iconv/Makefile
++++ b/iconv/Makefile
+@@ -153,14 +153,14 @@ $(objpfx)tst-translit-mchar.out: tst-translit-mchar.sh \
+ 
+ $(objpfx)tst-iconv_prog-buffer.out: \
+   tst-iconv_prog-buffer.sh $(objpfx)iconv_prog
+-	$(BASH) $< $(common-objdir) '$(test-program-prefix)' > $@; \
++	$(BASH) $< $(common-objdir) '$(run-program-prefix)' > $@; \
+ 	$(evaluate-test)
+ $(objpfx)tst-iconv_prog-buffer-tiny.out: \
+   tst-iconv_prog-buffer.sh $(objpfx)iconv_prog
+-	$(BASH) $< $(common-objdir) '$(test-program-prefix)' \
++	$(BASH) $< $(common-objdir) '$(run-program-prefix)' \
+ 	  '--buffer-size=1' > $@; \
+ 	$(evaluate-test)
+ $(objpfx)tst-iconv_prog-buffer-large.out: \
+   tst-iconv_prog-buffer.sh $(objpfx)iconv_prog
+-	$(BASH) $< $(common-objdir) '$(test-program-prefix)' '' '22' > $@; \
++	$(BASH) $< $(common-objdir) '$(run-program-prefix)' '' '22' > $@; \
+ 	$(evaluate-test)

SOURCES/glibc-RHEL-75555.patch

+commit abeae3c0061c0599ac2f012b270d6b4c8f59c82f
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Thu Jan 16 18:45:25 2025 +0100
+
+    Linux: Fixes for getrandom fork handling
+    
+    Careful updates of grnd_alloc.len are required to ensure that
+    after fork, grnd_alloc.states does not contain entries that
+    are also encountered by __getrandom_reset_state in TCBs.
+    For the same reason, it is necessary to overwrite the TCB state
+    pointer with NULL before updating grnd_alloc.states in
+    __getrandom_vdso_release.
+    
+    Before this change, different TCBs could share the same getrandom
+    state after multi-threaded fork.  This would be a critical security
+    bug (predictable randomness) if not caught during development.
+    
+    The additional check in stdlib/tst-arc4random-thread makes it more
+    likely that the test fails due to the bugs mentioned above.
+    
+    Both __getrandom_reset_state and __getrandom_vdso_release could
+    put reserved NULL pointers into the states array.  This is also
+    fixed with this commit.  After these changes, no null pointers were
+    observed in the states array during testing.
+    
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+
+diff --git a/stdlib/tst-arc4random-thread.c b/stdlib/tst-arc4random-thread.c
+index d1259626c62af5ad..5e8a4761fc39165a 100644
+--- a/stdlib/tst-arc4random-thread.c
++++ b/stdlib/tst-arc4random-thread.c
+@@ -49,7 +49,7 @@ static const int sizes[] = { 12, 15, 16, 17, 24, 31, max_size };
+ struct blob
+ {
+   unsigned int size;
+-  int thread_id;
++  int thread_id;		/* -1 means after fork.  */
+   unsigned int index;
+   unsigned char bytes[max_size];
+ };
+@@ -323,6 +323,20 @@ do_test_func (const char *fname, void (*func)(unsigned char *, size_t))
+         }
+     }
+ 
++  for (struct blob *p = dynarray_blob_begin (&global_result);
++       p < end; ++p)
++    {
++      unsigned int sum = 0;
++      for (unsigned int i = 0; i < p->size; ++i)
++	sum += p->bytes[i];
++      if (sum == 0)
++	{
++          support_record_failure ();
++	  printf ("error: all-zero result of length %u on thread %d\n",
++		  p->size, p->thread_id);
++	}
++    }
++
+   dynarray_blob_free (&global_result);
+ 
+   return 0;
+diff --git a/sysdeps/unix/sysv/linux/getrandom.c b/sysdeps/unix/sysv/linux/getrandom.c
+index d3eab66a1af6229e..d93901f6ea5cbc6b 100644
+--- a/sysdeps/unix/sysv/linux/getrandom.c
++++ b/sysdeps/unix/sysv/linux/getrandom.c
+@@ -168,6 +168,11 @@ vgetrandom_get_state (void)
+   if (grnd_alloc.len > 0 || vgetrandom_get_state_alloc ())
+     state = grnd_alloc.states[--grnd_alloc.len];
+ 
++  /* Barrier needed by fork: The state must be gone from the array
++     through len update before it becomes visible in the TCB.  (There
++     is also a release barrier implied by the unlock, but issue a
++     stronger barrier to help fork.)  */
++  atomic_thread_fence_seq_cst ();
+   __libc_lock_unlock (grnd_alloc.lock);
+   internal_signal_restore_set (&set);
+ 
+@@ -278,7 +283,10 @@ void
+ __getrandom_reset_state (struct pthread *curp)
+ {
+ #ifdef HAVE_GETRANDOM_VSYSCALL
+-  if (grnd_alloc.states == NULL || curp->getrandom_buf == NULL)
++  /* The pointer can be reserved if the fork happened during a
++     getrandom call.  */
++  void *buf = release_ptr (curp->getrandom_buf);
++  if (grnd_alloc.states == NULL || buf == NULL)
+     return;
+   assert (grnd_alloc.len < grnd_alloc.cap);
+   grnd_alloc.states[grnd_alloc.len++] = release_ptr (curp->getrandom_buf);
+@@ -294,11 +302,23 @@ void
+ __getrandom_vdso_release (struct pthread *curp)
+ {
+ #ifdef HAVE_GETRANDOM_VSYSCALL
+-  if (curp->getrandom_buf == NULL)
++  /* The pointer can be reserved if the thread was canceled in a
++     signal handler.  */
++  void *buf = release_ptr (curp->getrandom_buf);
++  if (buf == NULL)
+     return;
+ 
+   __libc_lock_lock (grnd_alloc.lock);
+-  grnd_alloc.states[grnd_alloc.len++] = curp->getrandom_buf;
++
++  size_t len = grnd_alloc.len;
++  grnd_alloc.states[len] = curp->getrandom_buf;
++  curp->getrandom_buf = NULL;
++  /* Barrier needed by fork: The state must vanish from the TCB before
++     it becomes visible in the states array.  Also avoid exposing the
++     previous entry value at the same index in the states array (which
++     may be in use by another thread).  */
++  atomic_thread_fence_seq_cst ();
++  grnd_alloc.len = len + 1;
+   __libc_lock_unlock (grnd_alloc.lock);
+ #endif
+ }

SOURCES/glibc-RHEL-75809.patch

+commit b62759db04b8ed7f829c06f1d7c3b8fb70616493
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Wed Jan 22 13:48:56 2025 +0100
+
+    stdlib: Support malloc-managed environ arrays for compatibility
+    
+    Some applications set environ to a heap-allocated pointer, call
+    setenv (expecting it to call realloc), free environ, and then
+    restore the original environ pointer.  This breaks after
+    commit 7a61e7f557a97ab597d6fca5e2d1f13f65685c61 ("stdlib: Make
+    getenv thread-safe in more cases") because after the setenv call,
+    the environ pointer does not point to the start of a heap allocation.
+    Instead, setenv creates a separate allocation and changes environ
+    to point into that.  This means that the free call in the application
+    results in heap corruption.
+    
+    The interim approach was more compatible with other libcs because
+    it does not assume that the incoming environ pointer is allocated
+    as if by malloc (if it was written by the application).  However,
+    it seems to be more important to stay compatible with previous
+    glibc version: assume the incoming pointer is heap allocated,
+    and preserve this property after setenv calls.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+
+diff --git a/csu/init-first.c b/csu/init-first.c
+index a2cb456ccf9ac5e6..77b5b4941beb3a73 100644
+--- a/csu/init-first.c
++++ b/csu/init-first.c
+@@ -61,6 +61,7 @@ _init_first (int argc, char **argv, char **envp)
+   __libc_argc = argc;
+   __libc_argv = argv;
+   __environ = envp;
++  __environ_startup = envp;
+ 
+ #ifndef SHARED
+   /* First the initialization which normally would be done by the
+diff --git a/csu/libc-start.c b/csu/libc-start.c
+index d784de0f0bdd70c8..260027c2396e1f52 100644
+--- a/csu/libc-start.c
++++ b/csu/libc-start.c
+@@ -244,6 +244,7 @@ LIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL),
+   char **ev = &argv[argc + 1];
+ 
+   __environ = ev;
++  __environ_startup = ev;
+ 
+   /* Store the lowest stack address.  This is done in ld.so if this is
+      the code for the DSO.  */
+diff --git a/include/unistd.h b/include/unistd.h
+index e241603b8131a9e9..ada957f9d04d272a 100644
+--- a/include/unistd.h
++++ b/include/unistd.h
+@@ -203,6 +203,9 @@ libc_hidden_proto (__tcsetpgrp)
+ extern int __libc_enable_secure attribute_relro;
+ rtld_hidden_proto (__libc_enable_secure)
+ 
++/* Original value of __environ.  Initialized by _init_first (dynamic)
++   or __libc_start_main (static).  */
++extern char **__environ_startup attribute_hidden;
+ 
+ /* Various internal function.  */
+ extern void __libc_check_standard_fds (void) attribute_hidden;
+diff --git a/posix/environ.c b/posix/environ.c
+index a0ed0d80eab207f8..2430b47d8eee148c 100644
+--- a/posix/environ.c
++++ b/posix/environ.c
+@@ -10,3 +10,5 @@ weak_alias (__environ, environ)
+ /* The SVR4 ABI says `_environ' will be the name to use
+    in case the user overrides the weak alias `environ'.  */
+ weak_alias (__environ, _environ)
++
++char **__environ_startup;
+diff --git a/stdlib/Makefile b/stdlib/Makefile
+index ff1418f5bb2ea5c9..217600ba60e3c7d4 100644
+--- a/stdlib/Makefile
++++ b/stdlib/Makefile
+@@ -312,6 +312,7 @@ tests := \
+   tst-setcontext9 \
+   tst-setcontext10 \
+   tst-setcontext11 \
++  tst-setenv-malloc \
+   tst-stdbit-Wconversion \
+   tst-stdbit-builtins \
+   tst-stdc_bit_ceil \
+diff --git a/stdlib/setenv.c b/stdlib/setenv.c
+index d12401ca77cee5a7..79982aa12ac20078 100644
+--- a/stdlib/setenv.c
++++ b/stdlib/setenv.c
+@@ -191,52 +191,52 @@ __add_to_environ (const char *name, const char *value, const char *combined,
+ 	ep[1] = NULL;
+       else
+ 	{
+-	  /* We cannot use __environ as is and need to copy over the
+-	     __environ contents into an array managed via
+-	     __environ_array_list.  */
+-
+-	  struct environ_array *target_array;
+-	  if (__environ_array_list != NULL
+-	      && required_size <= __environ_array_list->allocated)
+-	    /* Existing array has enough room.  Contents is copied below.  */
+-	    target_array = __environ_array_list;
+-	  else
++	  /* We cannot use __environ as is and need a larger allocation.  */
++
++	  if (start_environ == __environ_startup
++	      || __environ_is_from_array_list (start_environ))
+ 	    {
+-	      /* Allocate a new array.  */
+-	      target_array = __environ_new_array (required_size);
++	      /* Allocate a new array, managed in the list.  */
++	      struct environ_array *target_array
++		= __environ_new_array (required_size);
+ 	      if (target_array == NULL)
+ 		{
+ 		  UNLOCK;
+ 		  return -1;
+ 		}
++	      result_environ = &target_array->array[0];
++
++	      /* Copy over the __environ array contents.  This code
++		 handles the case start_environ == ep == NULL, too.  */
++	      size_t i;
++	      for (i = 0; start_environ + i < ep; ++i)
++		/* Regular store because unless there has been direct
++		   manipulation of the environment, target_array is still
++		   a private copy.  */
++		result_environ[i] = atomic_load_relaxed (start_environ + i);
++	    }
++	  else
++	    {
++	      /* Otherwise the application installed its own pointer.
++		 Historically, this pointer was managed using realloc.
++		 Continue doing so.  This disables multi-threading
++		 support.  */
++	      result_environ = __libc_reallocarray (start_environ,
++						    required_size,
++						    sizeof (*result_environ));
++	      if (result_environ == NULL)
++		{
++		  UNLOCK;
++		  return -1;
++		}
+ 	    }
+-
+-	  /* Copy over the __environ array contents.  This forward
+-	     copy slides backwards part of the array if __environ
+-	     points into target_array->array.  This happens if an
+-	     application makes an assignment like:
+-
+-	       environ = &environ[1];
+-
+-	     The forward copy avoids clobbering values that still
+-	     needing copying.  This code handles the case
+-	     start_environ == ep == NULL, too.  */
+-	  size_t i;
+-	  for (i = 0; start_environ + i < ep; ++i)
+-	    /* Regular store because unless there has been direct
+-	       manipulation of the environment, target_array is still
+-	       a private copy.  */
+-	    target_array->array[i] = atomic_load_relaxed (start_environ + i);
+ 
+ 	  /* This is the new place where we should add the element.  */
+-	  ep = target_array->array + i;
++	  ep = result_environ + (required_size - 2);
+ 
+ 	  /* Add the null terminator in case there was a pointer there
+ 	     previously.  */
+ 	  ep[1] = NULL;
+-
+-	  /* And __environ should be repointed to our array.  */
+-	  result_environ = &target_array->array[0];
+ 	}
+     }
+ 
+diff --git a/stdlib/tst-setenv-malloc.c b/stdlib/tst-setenv-malloc.c
+new file mode 100644
+index 0000000000000000..18a9d36842e67aa5
+--- /dev/null
++++ b/stdlib/tst-setenv-malloc.c
+@@ -0,0 +1,64 @@
++/* Test using setenv with a malloc-allocated environ variable.
++   Copyright (C) 2025 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++/* This test is not in the scope for POSIX or any other standard, but
++   some applications assume that environ is a heap-allocated pointer
++   after a call to setenv on an empty environment.  */
++
++#include <stdlib.h>
++#include <unistd.h>
++#include <support/check.h>
++#include <support/support.h>
++
++static const char *original_path;
++static char **save_environ;
++
++static void
++rewrite_environ (void)
++{
++  save_environ = environ;
++  environ = xmalloc (sizeof (*environ));
++  *environ = NULL;
++  TEST_COMPARE (setenv ("A", "1", 1), 0);
++  TEST_COMPARE (setenv ("B", "2", 1), 0);
++  TEST_VERIFY (environ != save_environ);
++  TEST_COMPARE_STRING (environ[0], "A=1");
++  TEST_COMPARE_STRING (environ[1], "B=2");
++  TEST_COMPARE_STRING (environ[2], NULL);
++  TEST_COMPARE_STRING (getenv ("PATH"), NULL);
++  free (environ);
++  environ = save_environ;
++  TEST_COMPARE_STRING (getenv ("PATH"), original_path);
++}
++
++static int
++do_test (void)
++{
++  original_path = getenv ("PATH");
++  rewrite_environ ();
++
++  /* Test again after reallocated the environment due to an initial
++     setenv call.  */
++  TEST_COMPARE (setenv ("TST_SETENV_MALLOC", "1", 1), 0);
++  TEST_VERIFY (environ != save_environ);
++  rewrite_environ ();
++
++  return 0;
++}
++
++#include <support/test-driver.c>

SOURCES/glibc-upstream-2.39-138.patch

+commit 9a0e174a39a3a65f628c6a55e29fe35f6d67bf42
+Author: Michael Jeanson <mjeanson@efficios.com>
+Date:   Thu Nov 7 22:23:49 2024 +0100
+
+    nptl: initialize rseq area prior to registration
+    
+    Per the rseq syscall documentation, 3 fields are required to be
+    initialized by userspace prior to registration, they are 'cpu_id',
+    'rseq_cs' and 'flags'. Since we have no guarantee that 'struct pthread'
+    is cleared on all architectures, explicitly set those 3 fields prior to
+    registration.
+    
+    Signed-off-by: Michael Jeanson <mjeanson@efficios.com>
+    Reviewed-by: Florian Weimer <fweimer@redhat.com>
+    (cherry picked from commit 97f60abd25628425971f07e9b0e7f8eec0741235)
+
+diff --git a/nptl/descr.h b/nptl/descr.h
+index 4697f633e16c7359..a83df327e4bcba2e 100644
+--- a/nptl/descr.h
++++ b/nptl/descr.h
+@@ -417,6 +417,8 @@ struct pthread
+     {
+       uint32_t cpu_id_start;
+       uint32_t cpu_id;
++      uint64_t rseq_cs;
++      uint32_t flags;
+     };
+     char pad[32];		/* Original rseq area size.  */
+   } rseq_area __attribute__ ((aligned (32)));
+diff --git a/sysdeps/unix/sysv/linux/rseq-internal.h b/sysdeps/unix/sysv/linux/rseq-internal.h
+index 7ea935b4adab8c20..37a8f630b6519ff0 100644
+--- a/sysdeps/unix/sysv/linux/rseq-internal.h
++++ b/sysdeps/unix/sysv/linux/rseq-internal.h
+@@ -51,11 +51,21 @@ rseq_register_current_thread (struct pthread *self, bool do_rseq)
+         /* The initial implementation used only 20 bytes out of 32,
+            but still expected size 32.  */
+         size = RSEQ_AREA_SIZE_INITIAL;
++
++      /* Initialize the rseq fields that are read by the kernel on
++         registration, there is no guarantee that struct pthread is
++         cleared on all architectures.  */
++      THREAD_SETMEM (self, rseq_area.cpu_id, RSEQ_CPU_ID_UNINITIALIZED);
++      THREAD_SETMEM (self, rseq_area.rseq_cs, 0);
++      THREAD_SETMEM (self, rseq_area.flags, 0);
++
+       int ret = INTERNAL_SYSCALL_CALL (rseq, &self->rseq_area,
+                                        size, 0, RSEQ_SIG);
+       if (!INTERNAL_SYSCALL_ERROR_P (ret))
+         return true;
+     }
++  /* When rseq is disabled by tunables or the registration fails, inform
++     userspace by setting 'cpu_id' to RSEQ_CPU_ID_REGISTRATION_FAILED.  */
+   THREAD_SETMEM (self, rseq_area.cpu_id, RSEQ_CPU_ID_REGISTRATION_FAILED);
+   return false;
+ }

SOURCES/glibc-upstream-2.39-139.patch

+commit 350db2839387659e1500a54d276e401c9c6b2dee
+Author: Michael Jeanson <mjeanson@efficios.com>
+Date:   Wed Nov 20 14:15:42 2024 -0500
+
+    nptl: initialize cpu_id_start prior to rseq registration
+    
+    When adding explicit initialization of rseq fields prior to
+    registration, I glossed over the fact that 'cpu_id_start' is also
+    documented as initialized by user-space.
+    
+    While current kernels don't validate the content of this field on
+    registration, future ones could.
+    
+    Signed-off-by: Michael Jeanson <mjeanson@efficios.com>
+    Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+    (cherry picked from commit d9f40387d3305d97e30a8cf8724218c42a63680a)
+
+diff --git a/sysdeps/unix/sysv/linux/rseq-internal.h b/sysdeps/unix/sysv/linux/rseq-internal.h
+index 37a8f630b6519ff0..ef3eab1fefd4d90d 100644
+--- a/sysdeps/unix/sysv/linux/rseq-internal.h
++++ b/sysdeps/unix/sysv/linux/rseq-internal.h
+@@ -56,6 +56,7 @@ rseq_register_current_thread (struct pthread *self, bool do_rseq)
+          registration, there is no guarantee that struct pthread is
+          cleared on all architectures.  */
+       THREAD_SETMEM (self, rseq_area.cpu_id, RSEQ_CPU_ID_UNINITIALIZED);
++      THREAD_SETMEM (self, rseq_area.cpu_id_start, 0);
+       THREAD_SETMEM (self, rseq_area.rseq_cs, 0);
+       THREAD_SETMEM (self, rseq_area.flags, 0);
+ 

SOURCES/glibc-upstream-2.39-140.patch

+commit aa8768999e94fcee1695feb766c69dd8a93b706b
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Fri May 17 20:00:38 2024 -0700
+
+    Pass -nostdlib -nostartfiles together with -r [BZ #31753]
+    
+    Since -r in GCC 6/7/8 doesn't imply -nostdlib -nostartfiles, update the
+    link-static-libc.out rule to also pass -nostdlib -nostartfiles.  This
+    fixes BZ #31753.
+    
+    Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+    Reviewed-by: Florian Weimer <fweimer@redhat.com>
+    (cherry picked from commit 2be3352f0b1ebaa39596393fffe1062275186669)
+
+diff --git a/Makefile b/Makefile
+index 37bf70aa4ad4403f..ae9bc09327dd2d5b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -581,7 +581,8 @@ $(objpfx)lint-makefiles.out: scripts/lint-makefiles.sh
+ # definitions of any symbols.
+ tests-special += $(objpfx)link-static-libc.out
+ $(objpfx)link-static-libc.out:
+-	$(LINK.o) $(whole-archive) -r $(objpfx)libc.a -o /dev/null > $@ 2>&1; \
++	$(LINK.o) $(whole-archive) -nostdlib -nostartfiles -r \
++	  $(objpfx)libc.a -o /dev/null > $@ 2>&1; \
+ 	$(evaluate-test)
+ 
+ # Print test summary for tests in $1 .sum file;

SOURCES/glibc-upstream-2.39-141.patch

+commit 51da74a97e0f024fd89b57304b3ab010a3cfaef1
+Author: Sam James <sam@gentoo.org>
+Date:   Mon Dec 9 23:11:25 2024 +0000
+
+    malloc: add indirection for malloc(-like) functions in tests [BZ #32366]
+    
+    GCC 15 introduces allocation dead code removal (DCE) for PR117370 in
+    r15-5255-g7828dc070510f8. This breaks various glibc tests which want
+    to assert various properties of the allocator without doing anything
+    obviously useful with the allocated memory.
+    
+    Alexander Monakov rightly pointed out that we can and should do better
+    than passing -fno-malloc-dce to paper over the problem. Not least because
+    GCC 14 already does such DCE where there's no testing of malloc's return
+    value against NULL, and LLVM has such optimisations too.
+    
+    Handle this by providing malloc (and friends) wrappers with a volatile
+    function pointer to obscure that we're calling malloc (et. al) from the
+    compiler.
+    
+    Reviewed-by: Paul Eggert <eggert@cs.ucla.edu>
+    (cherry picked from commit a9944a52c967ce76a5894c30d0274b824df43c7a)
+
+diff --git a/malloc/tst-aligned-alloc.c b/malloc/tst-aligned-alloc.c
+index 91167d1392c0e626..b0f05a8fec78d5e8 100644
+--- a/malloc/tst-aligned-alloc.c
++++ b/malloc/tst-aligned-alloc.c
+@@ -25,6 +25,8 @@
+ #include <libc-diag.h>
+ #include <support/check.h>
+ 
++#include "tst-malloc-aux.h"
++
+ static int
+ do_test (void)
+ {
+diff --git a/malloc/tst-compathooks-off.c b/malloc/tst-compathooks-off.c
+index d0106f3fb74ff3b1..4cce6e5a8076f6b6 100644
+--- a/malloc/tst-compathooks-off.c
++++ b/malloc/tst-compathooks-off.c
+@@ -25,6 +25,8 @@
+ #include <support/check.h>
+ #include <support/support.h>
+ 
++#include "tst-malloc-aux.h"
++
+ extern void (*volatile __free_hook) (void *, const void *);
+ extern void *(*volatile __malloc_hook)(size_t, const void *);
+ extern void *(*volatile __realloc_hook)(void *, size_t, const void *);
+diff --git a/malloc/tst-malloc-aux.h b/malloc/tst-malloc-aux.h
+new file mode 100644
+index 0000000000000000..54908b4a2464d510
+--- /dev/null
++++ b/malloc/tst-malloc-aux.h
+@@ -0,0 +1,41 @@
++/* Wrappers for malloc-like functions to allow testing the implementation
++   without optimization.
++   Copyright (C) 2024 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public License as
++   published by the Free Software Foundation; either version 2.1 of the
++   License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; see the file COPYING.LIB.  If
++   not, see <https://www.gnu.org/licenses/>.  */
++
++#ifndef TST_MALLOC_AUX_H
++#define TST_MALLOC_AUX_H
++
++#include <stddef.h>
++#include <stdlib.h>
++
++static void *(*volatile aligned_alloc_indirect)(size_t, size_t) = aligned_alloc;
++static void *(*volatile calloc_indirect)(size_t, size_t) = calloc;
++static void *(*volatile malloc_indirect)(size_t) = malloc;
++static void *(*volatile realloc_indirect)(void*, size_t) = realloc;
++
++#undef aligned_alloc
++#undef calloc
++#undef malloc
++#undef realloc
++
++#define aligned_alloc aligned_alloc_indirect
++#define calloc calloc_indirect
++#define malloc malloc_indirect
++#define realloc realloc_indirect
++
++#endif /* TST_MALLOC_AUX_H */
+diff --git a/malloc/tst-malloc-check.c b/malloc/tst-malloc-check.c
+index fde8863ad7561a71..cc88bff3b39a421c 100644
+--- a/malloc/tst-malloc-check.c
++++ b/malloc/tst-malloc-check.c
+@@ -20,6 +20,8 @@
+ #include <stdlib.h>
+ #include <libc-diag.h>
+ 
++#include "tst-malloc-aux.h"
++
+ static int errors = 0;
+ 
+ static void
+diff --git a/malloc/tst-malloc-too-large.c b/malloc/tst-malloc-too-large.c
+index 8e9e0d5fa2b4b907..2b91377e54cdc485 100644
+--- a/malloc/tst-malloc-too-large.c
++++ b/malloc/tst-malloc-too-large.c
+@@ -43,6 +43,7 @@
+ #include <unistd.h>
+ #include <sys/param.h>
+ 
++#include "tst-malloc-aux.h"
+ 
+ /* This function prepares for each 'too-large memory allocation' test by
+    performing a small successful malloc/free and resetting errno prior to
+diff --git a/malloc/tst-malloc.c b/malloc/tst-malloc.c
+index f7a6e4654c374d01..68af399022543111 100644
+--- a/malloc/tst-malloc.c
++++ b/malloc/tst-malloc.c
+@@ -22,6 +22,8 @@
+ #include <libc-diag.h>
+ #include <time.h>
+ 
++#include "tst-malloc-aux.h"
++
+ static int errors = 0;
+ 
+ static void
+diff --git a/malloc/tst-realloc.c b/malloc/tst-realloc.c
+index f50499ecb114d574..74a28fb45ed80bf5 100644
+--- a/malloc/tst-realloc.c
++++ b/malloc/tst-realloc.c
+@@ -23,6 +23,8 @@
+ #include <libc-diag.h>
+ #include <support/check.h>
+ 
++#include "tst-malloc-aux.h"
++
+ static int
+ do_test (void)
+ {
+diff --git a/support/support.h b/support/support.h
+index ba21ec9b5add7c02..1a77f7979330d60c 100644
+--- a/support/support.h
++++ b/support/support.h
+@@ -113,7 +113,7 @@ void *xposix_memalign (size_t alignment, size_t n)
+   __attribute_malloc__ __attribute_alloc_align__ ((1))
+   __attribute_alloc_size__ ((2)) __attr_dealloc_free __returns_nonnull;
+ char *xasprintf (const char *format, ...)
+-  __attribute__ ((format (printf, 1, 2), malloc)) __attr_dealloc_free
++  __attribute__ ((format (printf, 1, 2), __malloc__)) __attr_dealloc_free
+   __returns_nonnull;
+ char *xstrdup (const char *) __attr_dealloc_free __returns_nonnull;
+ char *xstrndup (const char *, size_t) __attr_dealloc_free __returns_nonnull;
+diff --git a/test-skeleton.c b/test-skeleton.c
+index ae185a4f2821de00..690f26e7cf229622 100644
+--- a/test-skeleton.c
++++ b/test-skeleton.c
+@@ -27,7 +27,6 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ #include <getopt.h>
+-#include <malloc.h>
+ #include <paths.h>
+ #include <search.h>
+ #include <signal.h>

SOURCES/glibc-upstream-2.39-142.patch

+commit 2c882bf9c15d206aaf04766d1b8e3ae5b1002cc2
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Thu Dec 5 08:39:44 2024 +0800
+
+    math: Exclude internal math symbols for tests [BZ #32414]
+    
+    Since internal tests don't have access to internal symbols in libm,
+    exclude them for internal tests.  Also make tst-strtod5 and tst-strtod5i
+    depend on $(libm) to support older versions of GCC which can't inline
+    copysign family functions.  This fixes BZ #32414.
+    
+    Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+    Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com>
+    (cherry picked from commit 5df09b444835fca6e64b3d4b4a5beb19b3b2ba21)
+
+diff --git a/include/math.h b/include/math.h
+index fa11a710a6c152a4..035fd160ffb9e032 100644
+--- a/include/math.h
++++ b/include/math.h
+@@ -130,7 +130,10 @@ fabsf128 (_Float128 x)
+ }
+ # endif
+ 
+-# if !(defined __FINITE_MATH_ONLY__ && __FINITE_MATH_ONLY__ > 0)
++
++/* NB: Internal tests don't have access to internal symbols.  */
++# if !IS_IN (testsuite_internal) \
++     && !(defined __FINITE_MATH_ONLY__ && __FINITE_MATH_ONLY__ > 0)
+ #  ifndef NO_MATH_REDIRECT
+ /* Declare some functions for use within GLIBC.  Compilers typically
+    inline those functions as a single instruction.  Use an asm to
+diff --git a/stdlib/Makefile b/stdlib/Makefile
+index 70d7291c6e3454a8..ff1418f5bb2ea5c9 100644
+--- a/stdlib/Makefile
++++ b/stdlib/Makefile
+@@ -607,6 +607,8 @@ $(objpfx)bug-strtod2: $(libm)
+ $(objpfx)tst-strtod-round: $(libm)
+ $(objpfx)tst-tininess: $(libm)
+ $(objpfx)tst-strtod-underflow: $(libm)
++$(objpfx)tst-strtod5: $(libm)
++$(objpfx)tst-strtod5i: $(libm)
+ $(objpfx)tst-strtod6: $(libm)
+ $(objpfx)tst-strtod-nan-locale: $(libm)
+ $(objpfx)tst-strtod-nan-sign: $(libm)

SOURCES/glibc-upstream-2.39-143.patch

+commit 2c8a7f14fac3628b6a06cc76cdfda54a7ac20386
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Tue Dec 17 18:12:03 2024 +0100
+
+    x86: Avoid integer truncation with large cache sizes (bug 32470)
+    
+    Some hypervisors report 1 TiB L3 cache size.  This results
+    in some variables incorrectly getting zeroed, causing crashes
+    in memcpy/memmove because invariants are violated.
+    
+    (cherry picked from commit 61c3450db96dce96ad2b24b4f0b548e6a46d68e5)
+
+diff --git a/sysdeps/x86/dl-cacheinfo.h b/sysdeps/x86/dl-cacheinfo.h
+index 5a98f70364220da4..1f68968a9a457586 100644
+--- a/sysdeps/x86/dl-cacheinfo.h
++++ b/sysdeps/x86/dl-cacheinfo.h
+@@ -959,11 +959,11 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+     non_temporal_threshold = maximum_non_temporal_threshold;
+ 
+   /* NB: The REP MOVSB threshold must be greater than VEC_SIZE * 8.  */
+-  unsigned int minimum_rep_movsb_threshold;
++  unsigned long int minimum_rep_movsb_threshold;
+   /* NB: The default REP MOVSB threshold is 4096 * (VEC_SIZE / 16) for
+      VEC_SIZE == 64 or 32.  For VEC_SIZE == 16, the default REP MOVSB
+      threshold is 2048 * (VEC_SIZE / 16).  */
+-  unsigned int rep_movsb_threshold;
++  unsigned long int rep_movsb_threshold;
+   if (CPU_FEATURE_USABLE_P (cpu_features, AVX512F)
+       && !CPU_FEATURE_PREFERRED_P (cpu_features, Prefer_No_AVX512))
+     {

SOURCES/glibc-upstream-2.39-144.patch

+commit 61daaa76390e0ff73eade3a688d3626b7e7e0c20
+Author: Noah Goldstein <goldstein.w.n@gmail.com>
+Date:   Fri May 24 12:38:50 2024 -0500
+
+    x86: Improve large memset perf with non-temporal stores [RHEL-29312]
+    
+    Previously we use `rep stosb` for all medium/large memsets. This is
+    notably worse than non-temporal stores for large (above a
+    few MBs) memsets.
+    See:
+    https://docs.google.com/spreadsheets/d/1opzukzvum4n6-RUVHTGddV6RjAEil4P2uMjjQGLbLcU/edit?usp=sharing
+    For data using different stategies for large memset on ICX and SKX.
+    
+    Using non-temporal stores can be up to 3x faster on ICX and 2x faster
+    on SKX. Historically, these numbers would not have been so good
+    because of the zero-over-zero writeback optimization that `rep stosb`
+    is able to do. But, the zero-over-zero writeback optimization has been
+    removed as a potential side-channel attack, so there is no longer any
+    good reason to only rely on `rep stosb` for large memsets. On the flip
+    size, non-temporal writes can avoid data in their RFO requests saving
+    memory bandwidth.
+    
+    All of the other changes to the file are to re-organize the
+    code-blocks to maintain "good" alignment given the new code added in
+    the `L(stosb_local)` case.
+    
+    The results from running the GLIBC memset benchmarks on TGL-client for
+    N=20 runs:
+    
+    Geometric Mean across the suite New / Old EXEX256: 0.979
+    Geometric Mean across the suite New / Old EXEX512: 0.979
+    Geometric Mean across the suite New / Old AVX2   : 0.986
+    Geometric Mean across the suite New / Old SSE2   : 0.979
+    
+    Most of the cases are essentially unchanged, this is mostly to show
+    that adding the non-temporal case didn't add any regressions to the
+    other cases.
+    
+    The results on the memset-large benchmark suite on TGL-client for N=20
+    runs:
+    
+    Geometric Mean across the suite New / Old EXEX256: 0.926
+    Geometric Mean across the suite New / Old EXEX512: 0.925
+    Geometric Mean across the suite New / Old AVX2   : 0.928
+    Geometric Mean across the suite New / Old SSE2   : 0.924
+    
+    So roughly a 7.5% speedup. This is lower than what we see on servers
+    (likely because clients typically have faster single-core bandwidth so
+    saving bandwidth on RFOs is less impactful), but still advantageous.
+    
+    Full test-suite passes on x86_64 w/ and w/o multiarch.
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    
+    (cherry picked from commit 5bf0ab80573d66e4ae5d94b094659094336da90f)
+
+diff --git a/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S b/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S
+index 97839a22483b0613..637caadb406b2544 100644
+--- a/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S
++++ b/sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S
+@@ -21,10 +21,13 @@
+    2. If size is less than VEC, use integer register stores.
+    3. If size is from VEC_SIZE to 2 * VEC_SIZE, use 2 VEC stores.
+    4. If size is from 2 * VEC_SIZE to 4 * VEC_SIZE, use 4 VEC stores.
+-   5. On machines ERMS feature, if size is greater or equal than
+-      __x86_rep_stosb_threshold then REP STOSB will be used.
+-   6. If size is more to 4 * VEC_SIZE, align to 4 * VEC_SIZE with
+-      4 VEC stores and store 4 * VEC at a time until done.  */
++   5. If size is more to 4 * VEC_SIZE, align to 1 * VEC_SIZE with
++      4 VEC stores and store 4 * VEC at a time until done.
++   6. On machines ERMS feature, if size is range
++	  [__x86_rep_stosb_threshold, __x86_shared_non_temporal_threshold)
++	  then REP STOSB will be used.
++   7. If size >= __x86_shared_non_temporal_threshold, use a
++	  non-temporal stores.  */
+ 
+ #include <sysdep.h>
+ 
+@@ -147,6 +150,41 @@ L(entry_from_wmemset):
+ 	VMOVU	%VMM(0), -VEC_SIZE(%rdi,%rdx)
+ 	VMOVU	%VMM(0), (%rdi)
+ 	VZEROUPPER_RETURN
++
++	/* If have AVX512 mask instructions put L(less_vec) close to
++	   entry as it doesn't take much space and is likely a hot target.  */
++#ifdef USE_LESS_VEC_MASK_STORE
++    /* Align to ensure the L(less_vec) logic all fits in 1x cache lines.  */
++	.p2align 6,, 47
++	.p2align 4
++L(less_vec):
++L(less_vec_from_wmemset):
++	/* Less than 1 VEC.  */
++# if VEC_SIZE != 16 && VEC_SIZE != 32 && VEC_SIZE != 64
++#  error Unsupported VEC_SIZE!
++# endif
++	/* Clear high bits from edi. Only keeping bits relevant to page
++	   cross check. Note that we are using rax which is set in
++	   MEMSET_VDUP_TO_VEC0_AND_SET_RETURN as ptr from here on out.  */
++	andl	$(PAGE_SIZE - 1), %edi
++	/* Check if VEC_SIZE store cross page. Mask stores suffer
++	   serious performance degradation when it has to fault suppress.  */
++	cmpl	$(PAGE_SIZE - VEC_SIZE), %edi
++	/* This is generally considered a cold target.  */
++	ja	L(cross_page)
++# if VEC_SIZE > 32
++	movq	$-1, %rcx
++	bzhiq	%rdx, %rcx, %rcx
++	kmovq	%rcx, %k1
++# else
++	movl	$-1, %ecx
++	bzhil	%edx, %ecx, %ecx
++	kmovd	%ecx, %k1
++# endif
++	vmovdqu8 %VMM(0), (%rax){%k1}
++	VZEROUPPER_RETURN
++#endif
++
+ #if defined USE_MULTIARCH && IS_IN (libc)
+ END (MEMSET_SYMBOL (__memset, unaligned))
+ 
+@@ -185,54 +223,6 @@ L(last_2x_vec):
+ #endif
+ 	VZEROUPPER_RETURN
+ 
+-	/* If have AVX512 mask instructions put L(less_vec) close to
+-	   entry as it doesn't take much space and is likely a hot target.
+-	 */
+-#ifdef USE_LESS_VEC_MASK_STORE
+-	.p2align 4,, 10
+-L(less_vec):
+-L(less_vec_from_wmemset):
+-	/* Less than 1 VEC.  */
+-# if VEC_SIZE != 16 && VEC_SIZE != 32 && VEC_SIZE != 64
+-#  error Unsupported VEC_SIZE!
+-# endif
+-	/* Clear high bits from edi. Only keeping bits relevant to page
+-	   cross check. Note that we are using rax which is set in
+-	   MEMSET_VDUP_TO_VEC0_AND_SET_RETURN as ptr from here on out.  */
+-	andl	$(PAGE_SIZE - 1), %edi
+-	/* Check if VEC_SIZE store cross page. Mask stores suffer
+-	   serious performance degradation when it has to fault suppress.
+-	 */
+-	cmpl	$(PAGE_SIZE - VEC_SIZE), %edi
+-	/* This is generally considered a cold target.  */
+-	ja	L(cross_page)
+-# if VEC_SIZE > 32
+-	movq	$-1, %rcx
+-	bzhiq	%rdx, %rcx, %rcx
+-	kmovq	%rcx, %k1
+-# else
+-	movl	$-1, %ecx
+-	bzhil	%edx, %ecx, %ecx
+-	kmovd	%ecx, %k1
+-# endif
+-	vmovdqu8 %VMM(0), (%rax){%k1}
+-	VZEROUPPER_RETURN
+-
+-# if defined USE_MULTIARCH && IS_IN (libc)
+-	/* Include L(stosb_local) here if including L(less_vec) between
+-	   L(stosb_more_2x_vec) and ENTRY. This is to cache align the
+-	   L(stosb_more_2x_vec) target.  */
+-	.p2align 4,, 10
+-L(stosb_local):
+-	movzbl	%sil, %eax
+-	mov	%RDX_LP, %RCX_LP
+-	mov	%RDI_LP, %RDX_LP
+-	rep	stosb
+-	mov	%RDX_LP, %RAX_LP
+-	VZEROUPPER_RETURN
+-# endif
+-#endif
+-
+ #if defined USE_MULTIARCH && IS_IN (libc)
+ 	.p2align 4
+ L(stosb_more_2x_vec):
+@@ -318,21 +308,33 @@ L(return_vzeroupper):
+ 	ret
+ #endif
+ 
+-	.p2align 4,, 10
+-#ifndef USE_LESS_VEC_MASK_STORE
+-# if defined USE_MULTIARCH && IS_IN (libc)
++#ifdef USE_WITH_AVX2
++	.p2align 4
++#else
++	.p2align 4,, 4
++#endif
++
++#if defined USE_MULTIARCH && IS_IN (libc)
+ 	/* If no USE_LESS_VEC_MASK put L(stosb_local) here. Will be in
+ 	   range for 2-byte jump encoding.  */
+ L(stosb_local):
++	cmp	__x86_shared_non_temporal_threshold(%rip), %RDX_LP
++	jae	L(nt_memset)
+ 	movzbl	%sil, %eax
+ 	mov	%RDX_LP, %RCX_LP
+ 	mov	%RDI_LP, %RDX_LP
+ 	rep	stosb
++# if (defined USE_WITH_SSE2) || (defined USE_WITH_AVX512)
++	/* Use xchg to save 1-byte (this helps align targets below).  */
++	xchg	%RDX_LP, %RAX_LP
++# else
+ 	mov	%RDX_LP, %RAX_LP
+-	VZEROUPPER_RETURN
+ # endif
++	VZEROUPPER_RETURN
++#endif
++#ifndef USE_LESS_VEC_MASK_STORE
+ 	/* Define L(less_vec) only if not otherwise defined.  */
+-	.p2align 4
++	.p2align 4,, 12
+ L(less_vec):
+ 	/* Broadcast esi to partial register (i.e VEC_SIZE == 32 broadcast to
+ 	   xmm). This is only does anything for AVX2.  */
+@@ -423,4 +425,35 @@ L(between_2_3):
+ 	movb	%SET_REG8, -1(%LESS_VEC_REG, %rdx)
+ #endif
+ 	ret
+-END (MEMSET_SYMBOL (__memset, unaligned_erms))
++
++#if defined USE_MULTIARCH && IS_IN (libc)
++# ifdef USE_WITH_AVX512
++	/* Force align so the loop doesn't cross a cache-line.  */
++	.p2align 4
++# endif
++	.p2align 4,, 7
++    /* Memset using non-temporal stores.  */
++L(nt_memset):
++	VMOVU	%VMM(0), (VEC_SIZE * 0)(%rdi)
++	leaq	(VEC_SIZE * -4)(%rdi, %rdx), %rdx
++    /* Align DST.  */
++	orq	$(VEC_SIZE * 1 - 1), %rdi
++	incq	%rdi
++	.p2align 4,, 7
++L(nt_loop):
++	VMOVNT	%VMM(0), (VEC_SIZE * 0)(%rdi)
++	VMOVNT	%VMM(0), (VEC_SIZE * 1)(%rdi)
++	VMOVNT	%VMM(0), (VEC_SIZE * 2)(%rdi)
++	VMOVNT	%VMM(0), (VEC_SIZE * 3)(%rdi)
++	subq	$(VEC_SIZE * -4), %rdi
++	cmpq	%rdx, %rdi
++	jb	L(nt_loop)
++	sfence
++	VMOVU	%VMM(0), (VEC_SIZE * 0)(%rdx)
++	VMOVU	%VMM(0), (VEC_SIZE * 1)(%rdx)
++	VMOVU	%VMM(0), (VEC_SIZE * 2)(%rdx)
++	VMOVU	%VMM(0), (VEC_SIZE * 3)(%rdx)
++	VZEROUPPER_RETURN
++#endif
++
++END(MEMSET_SYMBOL(__memset, unaligned_erms))

SOURCES/glibc-upstream-2.39-145.patch

+commit 994b129a35ca5218ecddd1add74aea68f1314560
+Author: Noah Goldstein <goldstein.w.n@gmail.com>
+Date:   Fri Sep 27 15:50:10 2024 -0700
+
+    x86/string: Fixup alignment of main loop in str{n}cmp-evex [BZ #32212]
+    
+    The loop should be aligned to 32-bytes so that it can ideally run out
+    the DSB. This is particularly important on Skylake-Server where
+    deficiencies in it's DSB implementation make it prone to not being
+    able to run loops out of the DSB.
+    
+    For example running strcmp-evex on 200Mb string:
+    
+    32-byte aligned loop:
+        - 43,399,578,766      idq.dsb_uops
+    not 32-byte aligned loop:
+        - 6,060,139,704       idq.dsb_uops
+    
+    This results in a 25% performance degradation for the non-aligned
+    version.
+    
+    The fix is to just ensure the code layout is such that the loop is
+    aligned. (Which was previously the case but was accidentally dropped
+    in 84e7c46df).
+    
+    NB: The fix was actually 64-byte alignment. This is because 64-byte
+    alignment generally produces more stable performance than 32-byte
+    aligned code (cache line crosses can affect perf), so if we are going
+    past 16-byte alignmnent, might as well go to 64. 64-byte alignment
+    also matches most other functions we over-align, so it creates a
+    common point of optimization.
+    
+    Times are reported as ratio of Time_With_Patch /
+    Time_Without_Patch. Lower is better.
+    
+    The values being reported is the geometric mean of the ratio across
+    all tests in bench-strcmp and bench-strncmp.
+    
+    Note this patch is only attempting to improve the Skylake-Server
+    strcmp for long strings. The rest of the numbers are only to test for
+    regressions.
+    
+    Tigerlake Results Strings <= 512:
+        strcmp : 1.026
+        strncmp: 0.949
+    
+    Tigerlake Results Strings > 512:
+        strcmp : 0.994
+        strncmp: 0.998
+    
+    Skylake-Server Results Strings <= 512:
+        strcmp : 0.945
+        strncmp: 0.943
+    
+    Skylake-Server Results Strings > 512:
+        strcmp : 0.778
+        strncmp: 1.000
+    
+    The 2.6% regression on TGL-strcmp is due to slowdowns caused by
+    changes in alignment of code handling small sizes (most on the
+    page-cross logic). These should be safe to ignore because 1) We
+    previously only 16-byte aligned the function so this behavior is not
+    new and was essentially up to chance before this patch and 2) this
+    type of alignment related regression on small sizes really only comes
+    up in tight micro-benchmark loops and is unlikely to have any affect
+    on realworld performance.
+    
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    (cherry picked from commit 483443d3211532903d7e790211af5a1d55fdb1f3)
+
+diff --git a/sysdeps/x86_64/multiarch/strcmp-evex.S b/sysdeps/x86_64/multiarch/strcmp-evex.S
+index 06730ab2a18f72a0..cea034f394ab45e2 100644
+--- a/sysdeps/x86_64/multiarch/strcmp-evex.S
++++ b/sysdeps/x86_64/multiarch/strcmp-evex.S
+@@ -209,7 +209,9 @@
+    returned.  */
+ 
+ 	.section SECTION(.text), "ax", @progbits
+-	.align	16
++	/* Align 64 bytes here. This is to get the L(loop) block ideally
++	   aligned for the DSB.  */
++	.align	64
+ 	.type	STRCMP, @function
+ 	.globl	STRCMP
+ # ifdef USE_AS_STRCASECMP_L
+@@ -509,9 +511,7 @@ L(ret4):
+ 	ret
+ # endif
+ 
+-	/* 32 byte align here ensures the main loop is ideally aligned
+-	   for DSB.  */
+-	.p2align 5
++	.p2align 4,, 4
+ L(more_3x_vec):
+ 	/* Safe to compare 4x vectors.  */
+ 	VMOVU	(VEC_SIZE)(%rdi), %VMM(0)
+@@ -1426,10 +1426,9 @@ L(less_32_till_page):
+ L(ret_zero_page_cross_slow_case0):
+ 	xorl	%eax, %eax
+ 	ret
+-# endif
+-
+-
++# else
+ 	.p2align 4,, 10
++# endif
+ L(less_16_till_page):
+ 	cmpl	$((VEC_SIZE - 8) / SIZE_OF_CHAR), %eax
+ 	ja	L(less_8_till_page)
+@@ -1482,8 +1481,12 @@ L(less_16_till_page):
+ # endif
+ 	jmp	L(prepare_loop_aligned)
+ 
+-
+-
++# ifndef USE_AS_STRNCMP
++	/* Fits in aligning bytes.  */
++L(ret_zero_4_loop):
++	xorl	%eax, %eax
++	ret
++# endif
+ 
+ 	.p2align 4,, 10
+ L(less_8_till_page):
+@@ -1554,6 +1557,7 @@ L(ret_less_8_wcs):
+ 
+ #  ifdef USE_AS_STRNCMP
+ 	.p2align 4,, 2
++L(ret_zero_4_loop):
+ L(ret_zero_page_cross_slow_case1):
+ 	xorl	%eax, %eax
+ 	ret
+@@ -1586,10 +1590,6 @@ L(less_4_loop):
+ 	subq	$-(CHAR_PER_VEC * 4), %rdx
+ #  endif
+ 	jmp	L(prepare_loop_aligned)
+-
+-L(ret_zero_4_loop):
+-	xorl	%eax, %eax
+-	ret
+ L(ret_less_4_loop):
+ 	xorl	%r8d, %eax
+ 	subl	%r8d, %eax