new file mode 100644

@@ -0,0 +1,124 @@

+From b075241890641122df79c130149601c942a310a5 Mon Sep 17 00:00:00 2001

+From: Alexey Makhalov <amakhalov@vmware.com>

+Date: Wed, 19 Jul 2017 19:53:14 +0000

+Subject: [PATCH 1/2] Fix range check in do_tunable_update_val

+

+Current implementation of tunables does not set arena_max and arena_test

+values. Any value provided by glibc.malloc.arena_max and

+glibc.malloc.arena_test parameters is ignored.

+

+These tunables have minval value set to 1 (see elf/dl-tunables.list file)

+and undefined maxval value. In that case default value (which is 0. see

+scripts/gen-tunables.awk) is being used to set maxval.

+

+For instance, generated tunable_list[] entry for arena_max is:

+(gdb) p *cur

+$1 = {name = 0x7ffff7df6217 "glibc.malloc.arena_max",

+ type = {type_code = TUNABLE_TYPE_SIZE_T, min = 1, max = 0},

+  val = {numval = 0, strval = 0x0}, initialized = false,

+   security_level = TUNABLE_SECLEVEL_SXID_IGNORE,

+    env_alias = 0x7ffff7df622e "MALLOC_ARENA_MAX"}

+

+As a result, any value of glibc.malloc.arena_max is ignored by

+TUNABLE_SET_VAL_IF_VALID_RANGE macro

+  __type min = (__cur)->type.min;                        <- initialized to 1

+  __type max = (__cur)->type.max;                        <- initialized to 0!

+  if (min == max)                                        <- false

+    {

+      min = __default_min;

+      max = __default_max;

+    }

+  if ((__type) (__val) >= min && (__type) (val) <= max)  <- false

+    {

+      (__cur)->val.numval = val;

+      (__cur)->initialized = true;

+    }

+

+Assigning correct min/max values at a build time fixes a problem.

+Plus, a bit of optimization: Setting of default min/max values for the given

+type at a run time might be eliminated.

+---

+ elf/dl-tunables.c        | 15 ++++-----------

+ scripts/gen-tunables.awk | 12 ++++++++++--

+ 2 files changed, 14 insertions(+), 13 deletions(-)

+

+diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c

+index 44c160c..8e02a95 100644

+--- a/elf/dl-tunables.c

+@@ -86,18 +86,11 @@ get_next_env (char **envp, char **name, size_t *namelen, char **val,

+   return NULL;

+ }

+ 

+-#define TUNABLE_SET_VAL_IF_VALID_RANGE(__cur, __val, __type, __default_min, \

+-				       __default_max)			      \

++#define TUNABLE_SET_VAL_IF_VALID_RANGE(__cur, __val, __type)		      \

+ ({									      \

+   __type min = (__cur)->type.min;					      \

+   __type max = (__cur)->type.max;					      \

+ 									      \

+-  if (min == max)							      \

+-    {									      \

+-      min = __default_min;						      \

+-      max = __default_max;						      \

+-    }									      \

+-									      \

+   if ((__type) (__val) >= min && (__type) (val) <= max)			      \

+     {									      \

+       (__cur)->val.numval = val;					      \

+@@ -117,17 +110,17 @@ do_tunable_update_val (tunable_t *cur, const void *valp)

+     {

+     case TUNABLE_TYPE_INT_32:

+ 	{

+-	  TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, int64_t, INT32_MIN, INT32_MAX);

++	  TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, int64_t);

+ 	  break;

+ 	}

+     case TUNABLE_TYPE_UINT_64:

+ 	{

+-	  TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t, 0, UINT64_MAX);

++	  TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t);

+ 	  break;

+ 	}

+     case TUNABLE_TYPE_SIZE_T:

+ 	{

+-	  TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t, 0, SIZE_MAX);

++	  TUNABLE_SET_VAL_IF_VALID_RANGE (cur, val, uint64_t);

+ 	  break;

+ 	}

+     case TUNABLE_TYPE_STRING:

+diff --git a/scripts/gen-tunables.awk b/scripts/gen-tunables.awk

+index ccdd0c6..6221990 100644

+--- a/scripts/gen-tunables.awk

+@@ -1,6 +1,14 @@

+ # Generate dl-tunable-list.h from dl-tunables.list

+ 

+ BEGIN {

++  min_of["STRING"]="0"

++  max_of["STRING"]="0"

++  min_of["INT_32"]="INT32_MIN"

++  max_of["INT_32"]="INT32_MAX"

++  min_of["UINT_64"]="0"

++  max_of["UINT_64"]="UINT64_MAX"

++  min_of["SIZE_T"]="0"

++  max_of["SIZE_T"]="SIZE_MAX"

+   tunable=""

+   ns=""

+   top_ns=""

+@@ -43,10 +51,10 @@ $1 == "}" {

+       types[top_ns,ns,tunable] = "STRING"

+     }

+     if (!minvals[top_ns,ns,tunable]) {

+-      minvals[top_ns,ns,tunable] = "0"

++      minvals[top_ns,ns,tunable] = min_of[types[top_ns,ns,tunable]]

+     }

+     if (!maxvals[top_ns,ns,tunable]) {

+-      maxvals[top_ns,ns,tunable] = "0"

++      maxvals[top_ns,ns,tunable] = max_of[types[top_ns,ns,tunable]]

+     }

+     if (!env_alias[top_ns,ns,tunable]) {

+       env_alias[top_ns,ns,tunable] = "NULL"

+-- 

+2.9.3

+

new file mode 100644

@@ -0,0 +1,251 @@

+From e72b84cec44852dd76365cb7e1bf691b56a8adfc Mon Sep 17 00:00:00 2001

+From: Alexey Makhalov <amakhalov@vmware.com>

+Date: Tue, 29 Aug 2017 21:10:08 +0000

+Subject: [PATCH 2/2] malloc arena fix

+

+---

+ elf/dl-tunables.list |  5 ++++

+ malloc/arena.c       | 64 ++++++++++++++++++++++++++++++++++++++++++++++++++++

+ malloc/malloc.c      | 31 +++++++++++++++++++++++++

+ malloc/malloc.h      |  1 +

+ 4 files changed, 101 insertions(+)

+

+diff --git a/elf/dl-tunables.list b/elf/dl-tunables.list

+index c188c6a..15a1a14 100644

+--- a/elf/dl-tunables.list

+@@ -76,6 +76,11 @@ glibc {

+       minval: 1

+       security_level: SXID_IGNORE

+     }

++    arena_stickiness {

++      type: SIZE_T

++      env_alias: MALLOC_ARENA_STICKINESS

++      security_level: SXID_IGNORE

++    }

+     tcache_max {

+       type: SIZE_T

+       security_level: SXID_ERASE

+diff --git a/malloc/arena.c b/malloc/arena.c

+index dc14fae..f0edf2b 100644

+--- a/malloc/arena.c

+@@ -63,6 +63,12 @@ typedef struct _heap_info

+   char pad[-6 * SIZE_SZ & MALLOC_ALIGN_MASK];

+ } heap_info;

+ 

++typedef struct _arena_tracker

++{

++  mstate arena; /* Arena most recently tracked for growth. */

++  size_t growth; /* Current size in bytes. */

++} arena_tracker;

++

+ /* Get a compile-time error if the heap_info padding is not correct

+    to make alignment work as expected in sYSMALLOc.  */

+ extern int sanity_check_heap_info_alignment[(sizeof (heap_info)

+@@ -73,6 +79,8 @@ extern int sanity_check_heap_info_alignment[(sizeof (heap_info)

+ 

+ static __thread mstate thread_arena attribute_tls_model_ie;

+ 

++static __thread arena_tracker thread_arena_tracker attribute_tls_model_ie;

++

+ /* Arena free list.  free_list_lock synchronizes access to the

+    free_list variable below, and the next_free and attached_threads

+    members of struct malloc_state objects.  No other locks must be

+@@ -236,6 +244,7 @@ TUNABLE_CALLBACK_FNDECL (set_perturb_byte, int32_t)

+ TUNABLE_CALLBACK_FNDECL (set_trim_threshold, size_t)

+ TUNABLE_CALLBACK_FNDECL (set_arena_max, size_t)

+ TUNABLE_CALLBACK_FNDECL (set_arena_test, size_t)

++TUNABLE_CALLBACK_FNDECL (set_arena_stickiness, size_t)

+ #if USE_TCACHE

+ TUNABLE_CALLBACK_FNDECL (set_tcache_max, size_t)

+ TUNABLE_CALLBACK_FNDECL (set_tcache_count, size_t)

+@@ -327,6 +336,7 @@ ptmalloc_init (void)

+   TUNABLE_GET (mmap_max, int32_t, TUNABLE_CALLBACK (set_mmaps_max));

+   TUNABLE_GET (arena_max, size_t, TUNABLE_CALLBACK (set_arena_max));

+   TUNABLE_GET (arena_test, size_t, TUNABLE_CALLBACK (set_arena_test));

++  TUNABLE_GET (arena_stickiness, size_t, TUNABLE_CALLBACK (set_arena_stickiness));

+ #if USE_TCACHE

+   TUNABLE_GET (tcache_max, size_t, TUNABLE_CALLBACK (set_tcache_max));

+   TUNABLE_GET (tcache_count, size_t, TUNABLE_CALLBACK (set_tcache_count));

+@@ -392,6 +402,13 @@ ptmalloc_init (void)

+                     __libc_mallopt (M_MMAP_THRESHOLD, atoi (&envline[16]));

+                 }

+               break;

++            case 16:

++              if (!__builtin_expect (__libc_enable_secure, 0))

++                {

++                  if (memcmp (envline, "ARENA_STICKINESS", 16) == 0)

++                    __libc_mallopt (M_ARENA_STICKINESS, atoi (&envline[17]));

++                }

++              break;

+             default:

+               break;

+             }

+@@ -974,6 +991,53 @@ arena_get_retry (mstate ar_ptr, size_t bytes)

+   return ar_ptr;

+ }

+ 

++static void

++internal_function

++arena_stickiness_track_alloc (void *victim)

++{

++  if (!victim || chunk_is_mmapped (mem2chunk (victim)))

++    return;

++

++  if (thread_arena_tracker.arena != arena_for_chunk (mem2chunk (victim))) {

++    thread_arena_tracker.growth = 0;

++    thread_arena_tracker.arena = arena_for_chunk (mem2chunk (victim));

++  } else {

++    thread_arena_tracker.growth += chunksize (mem2chunk (victim));

++    if (thread_arena_tracker.growth >= mp_.arena_stickiness) {

++      /* Swtich thread to the next arena */

++      mstate replaced_arena = thread_arena;

++      mstate next_to_use = replaced_arena->next;

++

++      __libc_lock_lock (free_list_lock);

++      detach_arena (replaced_arena);

++#if 0

++      /* If this was the last attached thread for this arena, put the

++	 arena on the free list.  */

++      if (replaced_arena->attached_threads == 0)

++	{

++	  replaced_arena->next_free = free_list;

++	  free_list = replaced_arena;

++	}

++#endif

++      if (next_to_use->attached_threads == 0)

++        remove_from_free_list (next_to_use);

++      ++next_to_use->attached_threads;

++

++      __libc_lock_unlock (free_list_lock);

++      thread_arena = next_to_use;

++    }

++  }

++}

++

++/* chunk must be valid and not mmaped.  */

++static void

++internal_function

++arena_stickiness_track_free (mchunkptr chunk)

++{

++  if (thread_arena_tracker.arena == arena_for_chunk (chunk))

++    thread_arena_tracker.growth -= chunksize (chunk);

++}

++

+ static void __attribute__ ((section ("__libc_thread_freeres_fn")))

+ arena_thread_freeres (void)

+ {

+diff --git a/malloc/malloc.c b/malloc/malloc.c

+index 54e406b..29787a5 100644

+--- a/malloc/malloc.c

+@@ -1723,6 +1723,7 @@ struct malloc_par

+   INTERNAL_SIZE_T mmap_threshold;

+   INTERNAL_SIZE_T arena_test;

+   INTERNAL_SIZE_T arena_max;

++  INTERNAL_SIZE_T arena_stickiness;

+ 

+   /* Memory map support */

+   int n_mmaps;

+@@ -1787,6 +1788,7 @@ static struct malloc_par mp_ =

+   .mmap_threshold = DEFAULT_MMAP_THRESHOLD,

+   .trim_threshold = DEFAULT_TRIM_THRESHOLD,

+ #define NARENAS_FROM_NCORES(n) ((n) * (sizeof (long) == 4 ? 2 : 8))

++  .arena_stickiness = 0,

+   .arena_test = NARENAS_FROM_NCORES (1)

+ #if USE_TCACHE

+   ,

+@@ -3083,6 +3085,10 @@ __libc_malloc (size_t bytes)

+ 

+   assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||

+           ar_ptr == arena_for_chunk (mem2chunk (victim)));

++

++  if (mp_.arena_stickiness > 0)

++    arena_stickiness_track_alloc (victim);

++

+   return victim;

+ }

+ libc_hidden_def (__libc_malloc)

+@@ -3126,6 +3132,9 @@ __libc_free (void *mem)

+ 

+   MAYBE_INIT_TCACHE ();

+ 

++  if (mp_.arena_stickiness > 0)

++    arena_stickiness_track_free (p);

++

+   ar_ptr = arena_for_chunk (p);

+   _int_free (ar_ptr, p, 0);

+ }

+@@ -3226,6 +3235,8 @@ __libc_realloc (void *oldmem, size_t bytes)

+       return newmem;

+     }

+ 

++  if (mp_.arena_stickiness > 0)

++    arena_stickiness_track_free (oldp);

+   __libc_lock_lock (ar_ptr->mutex);

+ 

+   newp = _int_realloc (ar_ptr, oldp, oldsize, nb);

+@@ -3234,6 +3245,9 @@ __libc_realloc (void *oldmem, size_t bytes)

+   assert (!newp || chunk_is_mmapped (mem2chunk (newp)) ||

+           ar_ptr == arena_for_chunk (mem2chunk (newp)));

+ 

++  if (mp_.arena_stickiness > 0)

++    arena_stickiness_track_alloc (newp);

++

+   if (newp == NULL)

+     {

+       /* Try harder to allocate memory in other arenas.  */

+@@ -3452,6 +3466,9 @@ __libc_calloc (size_t n, size_t elem_size)

+       return mem;

+     }

+ 

++  if (mp_.arena_stickiness > 0)

++    arena_stickiness_track_alloc (mem);

++

+   csz = chunksize (p);

+ 

+ #if MORECORE_CLEARS

+@@ -5145,6 +5162,15 @@ do_set_arena_max (size_t value)

+   return 1;

+ }

+ 

++static inline int

++__always_inline

++do_set_arena_stickiness (size_t value)

++{

++  LIBC_PROBE (memory_mallopt_arena_stickiness, 2, value, mp_.arena_stickiness);

++  mp_.arena_stickiness = value;

++  return 1;

++}

++

+ #if USE_TCACHE

+ static inline int

+ __always_inline

+@@ -5237,6 +5263,11 @@ __libc_mallopt (int param_number, int value)

+       if (value > 0)

+ 	do_set_arena_max (value);

+       break;

++

++    case M_ARENA_STICKINESS:

++      if (value > 0)

++	do_set_arena_stickiness (value);

++      break;

+     }

+   __libc_lock_unlock (av->mutex);

+   return res;

+diff --git a/malloc/malloc.h b/malloc/malloc.h

+index 339ab64..31bdb44 100644

+--- a/malloc/malloc.h

+@@ -121,6 +121,7 @@ extern struct mallinfo mallinfo (void) __THROW;

+ #define M_PERTURB           -6

+ #define M_ARENA_TEST        -7

+ #define M_ARENA_MAX         -8

++#define M_ARENA_STICKINESS  -9

+ 

+ /* General SVID/XPG interface to tunable parameters. */

+ extern int mallopt (int __param, int __val) __THROW;

+-- 

+2.9.3

+

@@ -4,7 +4,7 @@

 Summary:	Main C library

 Name:		glibc

 Version:	2.26

-Release:	1%{?dist}

+Release:	2%{?dist}

 License:	LGPLv2+

 URL:		http://www.gnu.org/software/libc

 Group:		Applications/System

@@ -16,6 +16,8 @@ Source1:	locale-gen.sh

 Source2:	locale-gen.conf

 Patch0:   	http://www.linuxfromscratch.org/patches/downloads/glibc/glibc-2.25-fhs-1.patch

 Patch1:		glibc-2.24-bindrsvport-blacklist.patch

+Patch2:		0001-Fix-range-check-in-do_tunable_update_val.patch

+Patch3:		0002-malloc-arena-fix.patch

 Provides:	rtld(GNU_HASH)

 Requires:       filesystem

 %description

@@ -71,6 +73,8 @@ Name Service Cache Daemon

 sed -i 's/\\$$(pwd)/`pwd`/' timezone/Makefile

 %patch0 -p1

 %patch1 -p1

+%patch2 -p1

+%patch3 -p1

 install -vdm 755 %{_builddir}/%{name}-build

 # do not try to explicitly provide GLIBC_PRIVATE versioned libraries

 %define __find_provides %{_builddir}/%{name}-%{version}/find_provides.sh

@@ -114,12 +118,6 @@ cd %{_builddir}/%{name}-build

 # just rerun/continue make to workaroung it.

 make %{?_smp_mflags} || make %{?_smp_mflags} || make %{?_smp_mflags}

-%check

-# disable security hardening for tests

-rm -f $(dirname $(gcc -print-libgcc-file-name))/../specs

-cd %{_builddir}/glibc-build

-make %{?_smp_mflags} check

-

 %install

 #	Do not remove static libs

 pushd %{_builddir}/glibc-build

@@ -169,6 +167,19 @@ popd

 sed -i 's@#! /bin/bash@#! /bin/sh@' %{buildroot}/usr/bin/ldd

 sed -i 's@#!/bin/bash@#!/bin/sh@' %{buildroot}/usr/bin/tzselect

+%check

+cd %{_builddir}/glibc-build

+make %{?_smp_mflags} check ||:

+# 2 intermittent failures and 2 stable false positives are OK

+# XPASS for: elf/tst-protected1a and elf/tst-protected1b

+[ `grep ^XPASS tests.sum | wc -l` -ne 2 -a `grep "^XPASS: elf/tst-protected1[ab]" tests.sum | wc -l` -ne 2 ] && exit 1 ||:

+

+# FAIL (intermittent) for posix/tst-spawn3 and stdio-common/test-vfprintf

+n=0

+grep "^FAIL: posix/tst-spawn3" tests.sum >/dev/null && n=$((n+1)) ||:

+grep "^FAIL: stdio-common/test-vfprintf" tests.sum >/dev/null && n=$((n+1)) ||:

+# check for exact 'n' failures

+[ `grep ^FAIL tests.sum | wc -l` -ne $n ] && exit 1 ||:

 %post -p /sbin/ldconfig

@@ -257,6 +268,10 @@ sed -i 's@#!/bin/bash@#!/bin/sh@' %{buildroot}/usr/bin/tzselect

 %changelog

+*   Tue Aug 29 2017 Alexey Makhalov <amakhalov@vmware.com> 2.26-2

+-   Fix tunables setter.

+-   Add malloc arena fix.

+-   Fix makecheck.

 *   Tue Aug 15 2017 Alexey Makhalov <amakhalov@vmware.com> 2.26-1

 -   Version update

 *   Tue Aug 08 2017 Anish Swaminathan <anishs@vmware.com> 2.25-4