staging/stintel/toolchain/musl, branch master

musl: update to 1.2.6

2026-05-25T21:37:21Z

Update musl C library to 1.2.6. Fixes CVE-2025-26519 * Patches refreshed. Unnecessary upstream patch removed. * Add a post-release patch for timezone handling in datetime string matching (affecting at least uhttpd): bug report: https://www.openwall.com/lists/musl/2026/03/22/3 fix: https://www.openwall.com/lists/musl/2026/03/30/6 1.2.6 release notes https://git.musl-libc.org/cgit/musl/tree/WHATSNEW?id=9fa28ece75d8a2191de7c5bb53bed224c5947417 new features: - posix_getdents interface (new in POSIX-2024) - renameat2 interface (linux extension) - iconv support for CP858 - vdso clock_gettime for riscv{32,64}, powerpc{,64}, and s390x - loongarch64 TLSDESC support - exposed __getauxval for compiler runtime use detecting cpu features compatibility: - initgroups no longer artificially limits number of supplementary groups - getusershell now skips blank lines and comments - exit is now explicitly thread-safe (possible future requirement) - atexit now fails rather than deadlocking if called from late dtor - strerror now has error strings for EUCLEAN and ENAVAIL - isatty no longer collapses errors to ENOTTY - sched.h namespace pollution with _GNU_SOURCE is reduced - hasmntopt now matches only whole options, not arbitrary substrings - shadow.h no longer declares an unimplemented sgetspent interface - vdso with missing sysv hash table (only gnu hash) is now supported conformance: - pwrite now handles O_APPEND correctly, reports error if it can't - mbnrtowcs now conforms to new POSIX-2024 requirement for partial character - iconv GBK now properly includes euro symbol - strptime now accepts conversion specifiers added in POSIX-2024 - inet_ntop IPv6 "zero compression" now conforms to RFC 5952 bugs fixed: - iconv euc-kr decoder could do oob writes on invalid inputs (CVE-2025-26519) - iconv shift_jis decoder could produce wrong outputs for some invalid inputs - printf did not honor hex float precision correctly in some cases - lost or delayed wakes in sem_post under race condition - termios input speed handling was wrong - strcasestr failed to match zero-length needle - fma handled corner case with negative zero wrongly - syslog LOG_MAKEPRI macro was incorrect - timer_create is no longer affected by known pthread_barrier bugs - sysconf(_SC_MINSIGSTKSZ) computed min size incorrectly - statx emulation left some fields uninitialized - mntent wrongly included final newline in parsed field output - SIGEV_THREAD timers could abort process if SIGTIMER became unblocked - bind_textdomain_codeset returned wrong value arch-specific bugs fixed: - early dynamic linker handled page size wrong on dynamic pagesize archs - arm and aarch64 crti/n files had wrong alignment - m68k POLLWRNORM and POLLWRBAND values were incorrect - x32 mq ABI was mismatched Signed-off-by: Hannu Nyman Link: https://github.com/openwrt/openwrt/pull/22547 Signed-off-by: Hauke Mehrtens

toolchain: musl: backport patches with CVE fixes

2026-05-12T23:59:29Z

This fixes: * CVE-2026-6042: Algorithmic Complexity DoS in musl libc iconv * CVE-2026-40200: musl libc: stack corruption in qsort with sufficiently large inputs Link: https://github.com/openwrt/openwrt/pull/23329 Signed-off-by: Hauke Mehrtens

toolchain/musl: fix build regression on x86_64

2025-05-06T12:29:09Z

Fix whitespace mangling which broke matching opcodes in the CFI patch Signed-off-by: Felix Fietkau

musl: add pending patch to fix CFI annotations

2025-05-05T11:57:08Z

Fixes debugging at least on aarch64, possibly others. Signed-off-by: Felix Fietkau

toolchain/musl: add support for renameat2()

2024-06-13T12:16:32Z

Backport an upstream patch to support the renameat2 syscall, added in Linux 3.15 and supported by glibc since 2.28. It is commonly used in filesystem or security contexts, and needed building upstream kernel bpf selftests. Link: https://inbox.vuxu.org/musl/20240421153640.379015-1-Tony.Ambardar@gmail.com/ Signed-off-by: Tony Ambardar Link: https://github.com/openwrt/openwrt/pull/15697 Signed-off-by: Christian Marangi

toolchain/musl: fix loongarch64 ldso file name

2024-05-04T06:12:56Z

GCC has changed musl dynamic linker name from ld-musl-loongarch-lp64d.so.1 to ld-musl-loongarch64.so.1 recently [1]. This means there are two dynamic linker names will be used across different ersions of GCC. But musl 1.2.5 only supports the new name while the GCC we're currently using uses the old name. To maintain compatibility with all versions of GCC, the musl is then patched to generate two symbolic links to libc.so with both old and new names. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=8bccee51f0deac64b79cd9ad75df599422f4c8ff Signed-off-by: Weijie Gao

toolchain/musl: Update to 1.2.5

2024-04-14T15:38:09Z

Update musl C library to 1.2.5 This release adds extension functions statx and preadv2/pwritev2, with fallback implementations for older kernels, and adds two new ports: loongarch64 and riscv32. Minor changes to the printf family of functions have been made for conformance to new standards interpretations/requirements. TLSDESC support for riscv64 has also been added. Bugs fixed include some DNS issues related to new TCP fallback functionality, several rare race conditions, potentially incorrect return value when glob aborts, and several signifiant arch-specific bugs affecting TLSDESC on arm, riscv64 icache flushing, and sh sigsetjmp and dlsym RTLD_NEXT. 1.2.5 release notes: new features: - statx function (linux extension; via syscall and fallback using fstatat) - clone function is now usable and gives _Fork-like consistency in child - statvfs now provides f_type result - preadv2 and pwritev2 (linux extension) syscall wrappers - riscv64 TLSDESC support new ports: - loongarch64 - riscv32 compatibility: - DNS resolver can now handle answers with long CNAME chains - string.h no longer provides (C23-incompat) non-prototype decl of basename - fstatat statx backend now matches stat syscall non-automounting behavior - mntent interfaces now handle escaped whitespace in paths/options standards updates: - printf %lc of nul wchar now produces output - snprintf and swprintf no longer fail on n > INT_MAX - ppoll is now exposed in default feature profile bugs fixed: - some long DNS answers were wrongly rejected despite new TCP support - glob could wrongly return GLOB_NOMATCH if aborted before any matches - multithreaded set*id could malfunction from thread sequencing logic bug - certain use of threads after fork could deadlock thread-list lock - posix_spawn child could deadlock in race with async parent death - mbrtowc return value was wrong if argument n exceeded UINT_MAX - 80-bit extended acoshl and powl got some corner cases wrong - syslog incorrectly generated localized timestamps arch-specific bugs fixed: - arm (32-bit) TLSDESC malfunctioned due to addends being processed wrong - riscv64 icache flush operation was non-functional - sh sigsetjmp failed to properly restore call-saved register r8 on return - sh dlsym RTLD_NEXT did not identify calling module correctly Signed-off-by: Hannu Nyman [Removed patch adding basename hack again] Signed-off-by: Hauke Mehrtens

toolchain: musl: add PKG_CPE_ID

2023-09-14T20:39:20Z

Vulnerabilities of musl libc are tracked as cpe:/a:musl-libc:musl Signed-off-by: Arne Zachlod

toolchain/musl: update to 1.2.4

2023-05-15T18:39:17Z

Release notes: new features: - large dns record lookups via tcp fallback - new getaddrinfo EAI_NODATA result to distinguish NODATA/NxDomain - support for new RELR compressed format for relative relocations - sysconf keys for querying signal stack size requirements - real vfork on riscv64 performance: - mallocng no longer uses MADV_FREE (high performance cost, little gain) - vdso clock_gettime is supported once again on 32-bit arm compatibility: - gethostbyname family now distinguishes NO_DATA from HOST_NOT_FOUND - res_send now works with caller-provided edns0 queries - arpa/nameser.h RR types list is now up-to-date - previously-missing POSIX confstr keys have been added - mntent interfaces now accept missing fields - alt signal stack, if any, is now used for internal signals - the LFS64 macros are no longer exposed without _LARGEFILE64_SOURCE - memmem (POSIX-future) is now exposed in default feature profile - pthread_atfork now admits calls from an application-provided malloc - debugger tracking of shared libraries now works on MIPS PIE binaries - sendmsg now supports up to SCM_MAX_FD fds in SCM_RIGHTS messages bugs fixed: - gethostbyname[2]_r wrongly returned nonzero (error) on negative result - parallel v4/v6 address queries could fail on query id collisions - spurious getaddrinfo/AI_ADDRCONFIG failures due to errno clobbering - dns search domains ending in dot (including lone dot) broke lookups - ipv6 servers in resolv.conf broke lookups on systems with v6 disabled - systems with bindv6only failed to query both v4 and v6 nameservers - res_mkquery mishandled consecutive final dots in name - res_send could malfunction for very small answer buffer sizes - resolver dns backend accepted answers with wrong (A vs AAAA) RR type - getservbyport_r returned junk or ENOENT (vs ERANGE) on buffer size errors - dns result parsing of malformed responses could process uninitialized data - freopen didn't reset stream orientation (byte/wide) & encoding rule - fwprintf didn't print most fields on open_wmemstream FILEs - wide printf %lc ignored field width - wide printf erroneously processed %n after encoding errors - use of wide printf %9$ argument slot overflowed undersized buffer - swprintf malfunctioned on nul character in output - strverscmp ordered digit sequences vs nondigits incorrectly - timer_create/SIGEV_THREAD failure leaked the thread - semaphores were subject to missed-wake under certain usage patterns - several possible rare deadlocks with lock handling at thread exit - several possible rare deadlocks with aio and multithreaded fork - dynamic linker relro processing was broken on archs w/variable pagesize - async cancellation could run cancellation handlers in invalid context - pthread_detach was wrongly a cancellation point in rare race code path - use-after-close/double-close errors in mq_notify error paths - mq_notify event thread wrongly ran with signals unmasked - wcs{,n}cmp, wmemcmp returned wrong results when difference overflowed - accept4, pipe2, and dup3 handled unknown flags wrong in fallback cases - CPU_SETSIZE macro had wrong unit - select fallback for pre-time64 kernels truncated timeout (vs clamping) arch-specific bugs fixed: - x32 new socketcalls took fallback path due to pointer sign extension - x32 wait4 didn't fill rusage structure (time64 regression) - x32 semtimedop mismatched timespec ABI with kernel (time64 regression) - sigaction signal mask was bogus on or1k, microblaze, mips, and riscv - powerpc-sf longjmp asm clobbered value argument - or1k poll function passed timeout to syscall in wrong form Removed upstreamed: - 800-mips_pie_debug.patch Manually rebased: - 600-nftw-support-common-gnu-extension.patch Signed-off-by: Linhui Liu

toolchain/musl: remove libgcc_initial hack

2023-02-19T18:44:39Z

This reverts r15599 [0]. This was added to fix an uclibc rebuild issue, but since uclibc isn't supported anymore [Fixes:] this can be removed. [0] https://git.openwrt.org/?p=openwrt/svn-archive/archive.git;a=commitdiff;h=016a052efeee6bc2da3f501a8c66b5aea20350b4 Fixes: 63fb1752 "toolchain: remove uClibc-ng" Signed-off-by: Andre Heider