musl libc is @[email protected]

musl libc's microblogging presence is now at @musl" target="_blank" rel="nofollow noopener">fosstodon.org/@musl. The account here on birdsite will no longer receive updates.

The long-awaited musl 1.2.3 is finally here! openwall.com/lists/musl/202…

#musl IRC has moved to libera.chat

In light of Freenode ownership being compromised and all senior staff resigning, #musl IRC will be moving, probably to libera.chat (newly launched by former Freenode staff) or OFTC. Watch for an announcement once it's clear what the best choice is.

In other musl-related news, the EPERM problem in container runtime (runc/libseccomp) is finally being fixed: github.com/opencontainers… This was a longstanding problem constantly breaking new libc versions under existing container runtimes.

Docker for Mac DNS proxying issue impacting musl is reportedly fixed now. #issuecomment-760298977" target="_blank" rel="nofollow noopener">github.com/docker/for-mac… If any problems remain, please report.

musl 1.2.2 also features a new direct implementation of realpath() that doesn't depend on procfs being mounted or accurate, new fast soft sqrt, and some new functions like the OpenBSD-introduced reallocarray.

The big change in 1.2.2 is MT-fork transparency: the forked child of a multithreaded process is no longer restricted to calling only AS-safe functions. Motivations & justification are explained in git.musl-libc.org/cgit/musl/comm…

musl 1.2.2 release has now been tagged and posted. openwall.com/lists/musl/202…

It's plausible that nothing is actually affected, as the extent of brokenness was so bad that it shouldn't have worked at all. However it is plausible that some applications which "appeared to work" with ASCII-only input are vulnerable.

Security advisory: all musl libc users/dists should apply the fix for CVE-2020-28928 in wcsnrtombs. openwall.com/lists/musl/202…

The main attraction of musl 1.2.1, though, is the completely rewritten malloc implementation, "mallocng". It features strong hardening, fragmentation avoidance, and ability to return freed memory to the system on a fine granularity.

musl 1.2.1 also fixes a very old logic error in libc-internal lock skipping for single-threaded processes after they return from multi-threaded to single-threaded status. It was only observed causing deadlocks, but could be worse, and all users should patch or upgrade.

musl 1.2.1 is now available openwall.com/lists/musl/202…

All distros & users of musl in multithreaded contexts should patch. Proposed patch series here: openwall.com/lists/musl/202… Patch 0002 alone is extremely safe but may be performance regression, & is recommended course of action until full series is better vetted.

Bug report received yesterday turned up serious missing synchronization corner case in internal locking. openwall.com/lists/musl/202…

Also new in musl 1.2.0 is alignment of character data with Unicode 12.1.0 and major performance and maintainability improvements to the case-mapping functions.

Users planning to upgrade 32-bit systems to musl 1.2.0 need to read the time64 detailed release notes: musl.libc.org/time64.html For 64-bit users this is a normal incremental release like any other.

musl 1.2.0 is now released, making time64 official! #v1.2.0" target="_blank" rel="nofollow noopener">musl.libc.org/releases.html#… openwall.com/lists/musl/202…