import UBI glibc-2.34-60.el9_2.7

2023-10-05 15:00:37 +00:00 · 2023-10-05 15:00:37 +00:00 · 2719f87b6c
commit 2719f87b6c
parent 7c0506058f
23 changed files with 5409 additions and 1 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,2 @@
 SOURCES/glibc-2.34.tar.xz
 SOURCES/glibc-upstream-2.34-373.patch
--- a/.glibc.metadata
+++ b/.glibc.metadata
@ -1 +1,2 @@
 7c3b8890a6346793b6334cc5f2fea5d437d307b8 SOURCES/glibc-2.34.tar.xz
 6022f103e5596ad229f22bc966327d71208f7016 SOURCES/glibc-upstream-2.34-373.patch
--- a/SOURCES/glibc-RHEL-2425-1.patch
+++ b/SOURCES/glibc-RHEL-2425-1.patch
@ -0,0 +1,65 @@
 commit 51948fdf0fc0258feca719f6a88cbdcf82f2eafc
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Thu Mar 17 11:16:57 2022 +0530
    nss: Sort tests and tests-container and put one test per line
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit e2f68b54e8052da14680074fc5df03153216f218)
 Conflicts:
 	nss/Makefile
 	(reordered tests)
 diff --git a/nss/Makefile b/nss/Makefile
 index beb30ac2667fe998..5192db6097457f88 100644
 --- a/nss/Makefile
 +++ b/nss/Makefile
@@ -56,22 +56,31 @@ extra-objs		+= $(makedb-modules:=.o)
 tests-static            = tst-field
 tests-internal		= tst-field
 -tests			= test-netdb test-digits-dots tst-nss-getpwent bug17079 \
 -			  tst-nss-test1 \
 -			  tst-nss-test2 \
 -			  tst-nss-test4 \
 -			  tst-nss-test5 \
 -			  tst-nss-test_errno
 -xtests			= bug-erange
 -
 -tests-container = \
 -			  tst-nss-compat1 \
 -			  tst-nss-test3 \
 -			  tst-nss-files-hosts-long \
 -			  tst-nss-db-endpwent \
 -			  tst-nss-db-endgrent \
 -			  tst-nss-gai-actions \
 -			  tst-reload1 tst-reload2
 +
 +tests := \
 +  bug17079 \
 +  test-digits-dots \
 +  test-netdb \
 +  tst-nss-getpwent \
 +  tst-nss-test1 \
 +  tst-nss-test2 \
 +  tst-nss-test4 \
 +  tst-nss-test5 \
 +  tst-nss-test_errno \
 +# tests
 +
 +xtests = bug-erange
 +
 +tests-container := \
 +  tst-nss-compat1 \
 +  tst-nss-db-endgrent \
 +  tst-nss-db-endpwent \
 +  tst-nss-files-hosts-long \
 +  tst-nss-gai-actions \
 +  tst-nss-test3 \
 +  tst-reload1 \
 +  tst-reload2 \
 +# tests-container
 # Tests which need libdl
 ifeq (yes,$(build-shared))
--- a/SOURCES/glibc-RHEL-2425-10.patch
+++ b/SOURCES/glibc-RHEL-2425-10.patch
@ -0,0 +1,156 @@
 commit 4d59769087f2143f619b4b38bf93590a86f5c806
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Mon Mar 7 19:48:48 2022 +0530
    gaih_inet: make gethosts into a function
    The macro is quite a pain to debug, so make gethosts into a function to
    make it easier to maintain.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit cfa3bd48cb19a70e4367a9978dbba09d9df27a72)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 145ea6fa381ad14b..6be109d07f7fcce0 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -268,63 +268,54 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
   return true;
 }
 -#define gethosts(_family) \
 - {									      \
 -  struct hostent th;							      \
 -  char *localcanon = NULL;						      \
 -  no_data = 0;								      \
 -  while (1)								      \
 -    {									      \
 -      status = DL_CALL_FCT (fct, (name, _family, &th,			      \
 -				  tmpbuf->data, tmpbuf->length,		      \
 -				  &errno, &h_errno, NULL, &localcanon));      \
 -      if (status != NSS_STATUS_TRYAGAIN || h_errno != NETDB_INTERNAL	      \
 -	  || errno != ERANGE)						      \
 -	break;								      \
 -      if (!scratch_buffer_grow (tmpbuf))				      \
 -	{								      \
 -	  __resolv_context_put (res_ctx);				      \
 -	  result = -EAI_MEMORY;						      \
 -	  goto out;							      \
 -	}								      \
 -    }									      \
 -  if (status == NSS_STATUS_NOTFOUND					      \
 -      || status == NSS_STATUS_TRYAGAIN || status == NSS_STATUS_UNAVAIL)	      \
 -    {									      \
 -      if (h_errno == NETDB_INTERNAL)					      \
 -	{								      \
 -	  __resolv_context_put (res_ctx);				      \
 -	  result = -EAI_SYSTEM;						      \
 -	  goto out;							      \
 -	}								      \
 -      if (h_errno == TRY_AGAIN)						      \
 -	no_data = EAI_AGAIN;						      \
 -      else								      \
 -	no_data = h_errno == NO_DATA;					      \
 -    }									      \
 -  else if (status == NSS_STATUS_SUCCESS)				      \
 -    {									      \
 -      if (!convert_hostent_to_gaih_addrtuple (req, _family, &th, res))	      \
 -	{								      \
 -	  __resolv_context_put (res_ctx);				      \
 -	  result = -EAI_SYSTEM;						      \
 -	  goto out;							      \
 -	}								      \
 -									      \
 -      if (localcanon != NULL && res->canon == NULL)			      \
 -	{								      \
 -	  char *canonbuf = __strdup (localcanon);			      \
 -	  if (canonbuf == NULL)						      \
 -	    {								      \
 -	      __resolv_context_put (res_ctx);				      \
 -	      result = -EAI_SYSTEM;					      \
 -	      goto out;							      \
 -	    }								      \
 -	  res->canon = canonbuf;					      \
 -	}								      \
 -    }									      \
 - }
 +static int
 +gethosts (nss_gethostbyname3_r fct, int family, const char *name,
 +	  const struct addrinfo *req, struct scratch_buffer *tmpbuf,
 +	  struct gaih_result *res, enum nss_status *statusp, int *no_datap)
 +{
 +  struct hostent th;
 +  char *localcanon = NULL;
 +  enum nss_status status;
 +
 +  *no_datap = 0;
 +  while (1)
 +    {
 +      *statusp = status = DL_CALL_FCT (fct, (name, family, &th,
 +					     tmpbuf->data, tmpbuf->length,
 +					     &errno, &h_errno, NULL,
 +					     &localcanon));
 +      if (status != NSS_STATUS_TRYAGAIN || h_errno != NETDB_INTERNAL
 +	  || errno != ERANGE)
 +	break;
 +      if (!scratch_buffer_grow (tmpbuf))
 +	return -EAI_MEMORY;
 +    }
 +  if (status == NSS_STATUS_NOTFOUND
 +      || status == NSS_STATUS_TRYAGAIN || status == NSS_STATUS_UNAVAIL)
 +    {
 +      if (h_errno == NETDB_INTERNAL)
 +	return -EAI_SYSTEM;
 +      if (h_errno == TRY_AGAIN)
 +	*no_datap = EAI_AGAIN;
 +      else
 +	*no_datap = h_errno == NO_DATA;
 +    }
 +  else if (status == NSS_STATUS_SUCCESS)
 +    {
 +      if (!convert_hostent_to_gaih_addrtuple (req, family, &th, res))
 +	return -EAI_SYSTEM;
 +
 +      if (localcanon != NULL && res->canon == NULL)
 +	{
 +	  char *canonbuf = __strdup (localcanon);
 +	  if (canonbuf == NULL)
 +	    return  -EAI_SYSTEM;
 +	  res->canon = canonbuf;
 +	}
 +    }
 +  return 0;
 +}
 /* This function is called if a canonical name is requested, but if
    the service function did not provide it.  It tries to obtain the
@@ -741,7 +732,12 @@ get_nss_addresses (const char *name, const struct addrinfo *req,
 	      if (req->ai_family == AF_INET6
 		  || req->ai_family == AF_UNSPEC)
 		{
 -		  gethosts (AF_INET6);
 +		  if ((result = gethosts (fct, AF_INET6, name, req, tmpbuf,
 +					  res, &status, &no_data)) != 0)
 +		    {
 +		      __resolv_context_put (res_ctx);
 +		      goto out;
 +		    }
 		  no_inet6_data = no_data;
 		  inet6_status = status;
 		}
@@ -753,7 +749,12 @@ get_nss_addresses (const char *name, const struct addrinfo *req,
 			 know we are not going to need them.  */
 		      && ((req->ai_flags & AI_ALL) || !res->got_ipv6)))
 		{
 -		  gethosts (AF_INET);
 +		  if ((result = gethosts (fct, AF_INET, name, req, tmpbuf,
 +					  res, &status, &no_data)) != 0)
 +		    {
 +		      __resolv_context_put (res_ctx);
 +		      goto out;
 +		    }
 		  if (req->ai_family == AF_INET)
 		    {
--- a/SOURCES/glibc-RHEL-2425-11.patch
+++ b/SOURCES/glibc-RHEL-2425-11.patch
@ -0,0 +1,178 @@
 commit 6e3fed9d20d6b7ef4b69dd7cfcdd7bbaf1c9a9cb
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Mon Mar 7 20:24:37 2022 +0530
    gaih_inet: split loopback lookup into its own function
    Flatten the condition nesting and replace the alloca for RET.AT/ATR with
    a single array LOCAL_AT[2].  This gets rid of alloca and alloca
    accounting.
    `git diff -b` is probably the best way to view this change since much of
    the diff is whitespace changes.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 657472b2a50f67b12e5bbe5827582c9c2bb82dc3)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 6be109d07f7fcce0..827c43b369836de9 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -1004,6 +1004,32 @@ try_simple_gethostbyname (const char *name, const struct addrinfo *req,
   return -EAI_NODATA;
 }
 +/* Add local address information into RES.  RES->AT is assumed to have enough
 +   space for two tuples and is zeroed out.  */
 +
 +static void
 +get_local_addresses (const struct addrinfo *req, struct gaih_result *res)
 +{
 +  struct gaih_addrtuple *atr = res->at;
 +  if (req->ai_family == AF_UNSPEC)
 +    res->at->next = res->at + 1;
 +
 +  if (req->ai_family == AF_UNSPEC || req->ai_family == AF_INET6)
 +    {
 +      res->at->family = AF_INET6;
 +      if ((req->ai_flags & AI_PASSIVE) == 0)
 +	memcpy (res->at->addr, &in6addr_loopback, sizeof (struct in6_addr));
 +      atr = res->at->next;
 +    }
 +
 +  if (req->ai_family == AF_UNSPEC || req->ai_family == AF_INET)
 +    {
 +      atr->family = AF_INET;
 +      if ((req->ai_flags & AI_PASSIVE) == 0)
 +	atr->addr[0] = htonl (INADDR_LOOPBACK);
 +    }
 +}
 +
 static int
 gaih_inet (const char *name, const struct gaih_service *service,
 	   const struct addrinfo *req, struct addrinfo **pai,
@@ -1014,10 +1040,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
   const char *orig_name = name;
 -  /* Reserve stack memory for the scratch buffer in the getaddrinfo
 -     function.  */
 -  size_t alloca_used = sizeof (struct scratch_buffer);
 -
   int rc;
   if ((rc = get_servtuples (service, req, st, tmpbuf)) != 0)
     return rc;
@@ -1027,76 +1049,51 @@ gaih_inet (const char *name, const struct gaih_service *service,
   int result = 0;
   struct gaih_result res = {0};
 -  if (name != NULL)
 +  struct gaih_addrtuple local_at[2] = {0};
 +
 +  res.at = local_at;
 +
 +  if (__glibc_unlikely (name == NULL))
     {
 -      if (req->ai_flags & AI_IDN)
 -	{
 -	  char *out;
 -	  result = __idna_to_dns_encoding (name, &out);
 -	  if (result != 0)
 -	    return -result;
 -	  name = out;
 -	  malloc_name = true;
 -	}
 +      get_local_addresses (req, &res);
 +      goto process_list;
 +    }
 -      res.at = alloca_account (sizeof (struct gaih_addrtuple), alloca_used);
 -      res.at->scopeid = 0;
 -      res.at->next = NULL;
 +  if (req->ai_flags & AI_IDN)
 +    {
 +      char *out;
 +      result = __idna_to_dns_encoding (name, &out);
 +      if (result != 0)
 +	return -result;
 +      name = out;
 +      malloc_name = true;
 +    }
 -      if ((result = text_to_binary_address (name, req, &res)) != 0)
 -	goto free_and_return;
 -      else if (res.at != NULL)
 -	goto process_list;
 +  if ((result = text_to_binary_address (name, req, &res)) != 0)
 +    goto free_and_return;
 +  else if (res.at != NULL)
 +    goto process_list;
 -      if ((result = try_simple_gethostbyname (name, req, tmpbuf, &res)) != 0)
 -	goto free_and_return;
 -      else if (res.at != NULL)
 -	goto process_list;
 +  if ((result = try_simple_gethostbyname (name, req, tmpbuf, &res)) != 0)
 +    goto free_and_return;
 +  else if (res.at != NULL)
 +    goto process_list;
 #ifdef USE_NSCD
 -      if ((result = get_nscd_addresses (name, req, &res)) != 0)
 -	goto free_and_return;
 -      else if (res.at != NULL)
 -	goto process_list;
 +  if ((result = get_nscd_addresses (name, req, &res)) != 0)
 +    goto free_and_return;
 +  else if (res.at != NULL)
 +    goto process_list;
 #endif
 -      if ((result = get_nss_addresses (name, req, tmpbuf, &res)) != 0)
 -	goto free_and_return;
 -      else if (res.at != NULL)
 -	goto process_list;
 -
 -      /* None of the lookups worked, so name not found.  */
 -      result = -EAI_NONAME;
 -      goto free_and_return;
 -    }
 -  else
 -    {
 -      struct gaih_addrtuple *atr;
 -      atr = res.at = alloca_account (sizeof (struct gaih_addrtuple),
 -				     alloca_used);
 -      memset (res.at, '\0', sizeof (struct gaih_addrtuple));
 -
 -      if (req->ai_family == AF_UNSPEC)
 -	{
 -	  res.at->next = __alloca (sizeof (struct gaih_addrtuple));
 -	  memset (res.at->next, '\0', sizeof (struct gaih_addrtuple));
 -	}
 -
 -      if (req->ai_family == AF_UNSPEC || req->ai_family == AF_INET6)
 -	{
 -	  res.at->family = AF_INET6;
 -	  if ((req->ai_flags & AI_PASSIVE) == 0)
 -	    memcpy (res.at->addr, &in6addr_loopback, sizeof (struct in6_addr));
 -	  atr = res.at->next;
 -	}
 +  if ((result = get_nss_addresses (name, req, tmpbuf, &res)) != 0)
 +    goto free_and_return;
 +  else if (res.at != NULL)
 +    goto process_list;
 -      if (req->ai_family == AF_UNSPEC || req->ai_family == AF_INET)
 -	{
 -	  atr->family = AF_INET;
 -	  if ((req->ai_flags & AI_PASSIVE) == 0)
 -	    atr->addr[0] = htonl (INADDR_LOOPBACK);
 -	}
 -    }
 +  /* None of the lookups worked, so name not found.  */
 +  result = -EAI_NONAME;
 +  goto free_and_return;
 process_list:
   {
--- a/SOURCES/glibc-RHEL-2425-12.patch
+++ b/SOURCES/glibc-RHEL-2425-12.patch
@ -0,0 +1,208 @@
 commit 92478a808f477480adbc5ca3d9a4a1bc27fc13ae
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Mon Mar 7 20:38:31 2022 +0530
    gaih_inet: Split result generation into its own function
    Simplify the loop a wee bit and clean up variable names too.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit ac4653ef503d1e87893d1a6714748a1cdf4bf7ad)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 827c43b369836de9..1008f247365ea009 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -1030,6 +1030,87 @@ get_local_addresses (const struct addrinfo *req, struct gaih_result *res)
     }
 }
 +/* Generate results in PAI and its count in NADDRS.  Return 0 on success or an
 +   error code on failure.  */
 +
 +static int
 +generate_addrinfo (const struct addrinfo *req, struct gaih_result *res,
 +		   const struct gaih_servtuple *st, struct addrinfo **pai,
 +		   unsigned int *naddrs)
 +{
 +  size_t socklen;
 +  sa_family_t family;
 +
 +  /* Buffer is the size of an unformatted IPv6 address in printable format.  */
 +  for (struct gaih_addrtuple *at = res->at; at != NULL; at = at->next)
 +    {
 +      family = at->family;
 +      if (family == AF_INET6)
 +	{
 +	  socklen = sizeof (struct sockaddr_in6);
 +
 +	  /* If we looked up IPv4 mapped address discard them here if
 +	     the caller isn't interested in all address and we have
 +	     found at least one IPv6 address.  */
 +	  if (res->got_ipv6
 +	      && (req->ai_flags & (AI_V4MAPPED|AI_ALL)) == AI_V4MAPPED
 +	      && IN6_IS_ADDR_V4MAPPED (at->addr))
 +	    continue;
 +	}
 +      else
 +	socklen = sizeof (struct sockaddr_in);
 +
 +      for (int i = 0; st[i].set; i++)
 +	{
 +	  struct addrinfo *ai;
 +	  ai = *pai = malloc (sizeof (struct addrinfo) + socklen);
 +	  if (ai == NULL)
 +	    return -EAI_MEMORY;
 +
 +	  ai->ai_flags = req->ai_flags;
 +	  ai->ai_family = family;
 +	  ai->ai_socktype = st[i].socktype;
 +	  ai->ai_protocol = st[i].protocol;
 +	  ai->ai_addrlen = socklen;
 +	  ai->ai_addr = (void *) (ai + 1);
 +
 +	  /* We only add the canonical name once.  */
 +	  ai->ai_canonname = res->canon;
 +	  res->canon = NULL;
 +
 +#ifdef _HAVE_SA_LEN
 +	  ai->ai_addr->sa_len = socklen;
 +#endif /* _HAVE_SA_LEN */
 +	  ai->ai_addr->sa_family = family;
 +
 +	  /* In case of an allocation error the list must be NULL
 +	     terminated.  */
 +	  ai->ai_next = NULL;
 +
 +	  if (family == AF_INET6)
 +	    {
 +	      struct sockaddr_in6 *sin6p = (struct sockaddr_in6 *) ai->ai_addr;
 +	      sin6p->sin6_port = st[i].port;
 +	      sin6p->sin6_flowinfo = 0;
 +	      memcpy (&sin6p->sin6_addr, at->addr, sizeof (struct in6_addr));
 +	      sin6p->sin6_scope_id = at->scopeid;
 +	    }
 +	  else
 +	    {
 +	      struct sockaddr_in *sinp = (struct sockaddr_in *) ai->ai_addr;
 +	      sinp->sin_port = st[i].port;
 +	      memcpy (&sinp->sin_addr, at->addr, sizeof (struct in_addr));
 +	      memset (sinp->sin_zero, '\0', sizeof (sinp->sin_zero));
 +	    }
 +
 +	  pai = &(ai->ai_next);
 +	}
 +
 +      ++*naddrs;
 +    }
 +  return 0;
 +}
 +
 static int
 gaih_inet (const char *name, const struct gaih_service *service,
 	   const struct addrinfo *req, struct addrinfo **pai,
@@ -1096,98 +1177,13 @@ gaih_inet (const char *name, const struct gaih_service *service,
   goto free_and_return;
 process_list:
 -  {
 -    /* Set up the canonical name if we need it.  */
 -    if ((result = process_canonname (req, orig_name, &res)) != 0)
 -      goto free_and_return;
 -
 -    struct gaih_addrtuple *at2 = res.at;
 -    size_t socklen;
 -    sa_family_t family;
 -
 -    /*
 -      buffer is the size of an unformatted IPv6 address in printable format.
 -     */
 -    while (at2 != NULL)
 -      {
 -	family = at2->family;
 -	if (family == AF_INET6)
 -	  {
 -	    socklen = sizeof (struct sockaddr_in6);
 -
 -	    /* If we looked up IPv4 mapped address discard them here if
 -	       the caller isn't interested in all address and we have
 -	       found at least one IPv6 address.  */
 -	    if (res.got_ipv6
 -		&& (req->ai_flags & (AI_V4MAPPED|AI_ALL)) == AI_V4MAPPED
 -		&& IN6_IS_ADDR_V4MAPPED (at2->addr))
 -	      goto ignore;
 -	  }
 -	else
 -	  socklen = sizeof (struct sockaddr_in);
 -
 -	for (int i = 0; st[i].set; i++)
 -	  {
 -	    struct addrinfo *ai;
 -	    ai = *pai = malloc (sizeof (struct addrinfo) + socklen);
 -	    if (ai == NULL)
 -	      {
 -		result = -EAI_MEMORY;
 -		goto free_and_return;
 -	      }
 -
 -	    ai->ai_flags = req->ai_flags;
 -	    ai->ai_family = family;
 -	    ai->ai_socktype = st[i].socktype;
 -	    ai->ai_protocol = st[i].protocol;
 -	    ai->ai_addrlen = socklen;
 -	    ai->ai_addr = (void *) (ai + 1);
 -
 -	    /* We only add the canonical name once.  */
 -	    ai->ai_canonname = res.canon;
 -	    res.canon = NULL;
 -
 -#ifdef _HAVE_SA_LEN
 -	    ai->ai_addr->sa_len = socklen;
 -#endif /* _HAVE_SA_LEN */
 -	    ai->ai_addr->sa_family = family;
 -
 -	    /* In case of an allocation error the list must be NULL
 -	       terminated.  */
 -	    ai->ai_next = NULL;
 -
 -	    if (family == AF_INET6)
 -	      {
 -		struct sockaddr_in6 *sin6p =
 -		  (struct sockaddr_in6 *) ai->ai_addr;
 -
 -		sin6p->sin6_port = st[i].port;
 -		sin6p->sin6_flowinfo = 0;
 -		memcpy (&sin6p->sin6_addr,
 -			at2->addr, sizeof (struct in6_addr));
 -		sin6p->sin6_scope_id = at2->scopeid;
 -	      }
 -	    else
 -	      {
 -		struct sockaddr_in *sinp =
 -		  (struct sockaddr_in *) ai->ai_addr;
 -		sinp->sin_port = st[i].port;
 -		memcpy (&sinp->sin_addr,
 -			at2->addr, sizeof (struct in_addr));
 -		memset (sinp->sin_zero, '\0', sizeof (sinp->sin_zero));
 -	      }
 -
 -	    pai = &(ai->ai_next);
 -	  }
 -
 -	++*naddrs;
 +  /* Set up the canonical name if we need it.  */
 +  if ((result = process_canonname (req, orig_name, &res)) != 0)
 +    goto free_and_return;
 -      ignore:
 -	at2 = at2->next;
 -      }
 -  }
 +  result = generate_addrinfo (req, &res, st, pai, naddrs);
 - free_and_return:
 +free_and_return:
   if (malloc_name)
     free ((char *) name);
   free (addrmem);
--- a/SOURCES/glibc-RHEL-2425-13.patch
+++ b/SOURCES/glibc-RHEL-2425-13.patch
@ -0,0 +1,34 @@
 commit cc4544ef8069a14c67a46b7e8e28eff1dc102050
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Wed Mar 2 11:45:29 2022 +0530
    gethosts: Return EAI_MEMORY on allocation failure
    All other cases of failures due to lack of memory return EAI_MEMORY, so
    it seems wrong to return EAI_SYSTEM here.  The only reason
    convert_hostent_to_gaih_addrtuple could fail is on calloc failure.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit b587456c0e7b59dcfdbd2d44db000a3bc8244e57)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 1008f247365ea009..37260d6e6f292186 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -303,13 +303,13 @@ gethosts (nss_gethostbyname3_r fct, int family, const char *name,
   else if (status == NSS_STATUS_SUCCESS)
     {
       if (!convert_hostent_to_gaih_addrtuple (req, family, &th, res))
 -	return -EAI_SYSTEM;
 +	return -EAI_MEMORY;
       if (localcanon != NULL && res->canon == NULL)
 	{
 	  char *canonbuf = __strdup (localcanon);
 	  if (canonbuf == NULL)
 -	    return  -EAI_SYSTEM;
 +	    return  -EAI_MEMORY;
 	  res->canon = canonbuf;
 	}
     }
--- a/SOURCES/glibc-RHEL-2425-14.patch
+++ b/SOURCES/glibc-RHEL-2425-14.patch
@ -0,0 +1,316 @@
 commit e09ee267c03e3150c2c9ba28625ab130705a485e
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Fri Sep 15 13:51:12 2023 -0400
    getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
    When an NSS plugin only implements the _gethostbyname2_r and
    _getcanonname_r callbacks, getaddrinfo could use memory that was freed
    during tmpbuf resizing, through h_name in a previous query response.
    The backing store for res->at->name when doing a query with
    gethostbyname3_r or gethostbyname2_r is tmpbuf, which is reallocated in
    gethosts during the query.  For AF_INET6 lookup with AI_ALL |
    AI_V4MAPPED, gethosts gets called twice, once for a v6 lookup and second
    for a v4 lookup.  In this case, if the first call reallocates tmpbuf
    enough number of times, resulting in a malloc, th->h_name (that
    res->at->name refers to) ends up on a heap allocated storage in tmpbuf.
    Now if the second call to gethosts also causes the plugin callback to
    return NSS_STATUS_TRYAGAIN, tmpbuf will get freed, resulting in a UAF
    reference in res->at->name.  This then gets dereferenced in the
    getcanonname_r plugin call, resulting in the use after free.
    Fix this by copying h_name over and freeing it at the end.  This
    resolves BZ #30843, which is assigned CVE-2023-4806.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit 973fe93a5675c42798b2161c6f29c01b0e243994)
 diff --git a/nss/Makefile b/nss/Makefile
 index 5192db6097457f88..18a27d79d26f094a 100644
 --- a/nss/Makefile
 +++ b/nss/Makefile
@@ -80,6 +80,7 @@ tests-container := \
   tst-nss-test3 \
   tst-reload1 \
   tst-reload2 \
 +  tst-nss-gai-hv2-canonname \
 # tests-container
 # Tests which need libdl
@@ -143,7 +144,8 @@ libnss_compat-inhibit-o	= $(filter-out .os,$(object-suffixes))
 ifeq ($(build-static-nss),yes)
 tests-static		+= tst-nss-static
 endif
 -extra-test-objs		+= nss_test1.os nss_test2.os nss_test_errno.os
 +extra-test-objs		+= nss_test1.os nss_test2.os nss_test_errno.os \
 +			   nss_test_gai_hv2_canonname.os
 include ../Rules
@@ -178,12 +180,16 @@ rtld-tests-LDFLAGS += -Wl,--dynamic-list=nss_test.ver
 libof-nss_test1 = extramodules
 libof-nss_test2 = extramodules
 libof-nss_test_errno = extramodules
 +libof-nss_test_gai_hv2_canonname = extramodules
 $(objpfx)/libnss_test1.so: $(objpfx)nss_test1.os $(link-libc-deps)
 	$(build-module)
 $(objpfx)/libnss_test2.so: $(objpfx)nss_test2.os $(link-libc-deps)
 	$(build-module)
 $(objpfx)/libnss_test_errno.so: $(objpfx)nss_test_errno.os $(link-libc-deps)
 	$(build-module)
 +$(objpfx)/libnss_test_gai_hv2_canonname.so: \
 +  $(objpfx)nss_test_gai_hv2_canonname.os $(link-libc-deps)
 +	$(build-module)
 $(objpfx)nss_test2.os : nss_test1.c
 # Use the nss_files suffix for these objects as well.
 $(objpfx)/libnss_test1.so$(libnss_files.so-version): $(objpfx)/libnss_test1.so
@@ -193,10 +199,14 @@ $(objpfx)/libnss_test2.so$(libnss_files.so-version): $(objpfx)/libnss_test2.so
 $(objpfx)/libnss_test_errno.so$(libnss_files.so-version): \
   $(objpfx)/libnss_test_errno.so
 	$(make-link)
 +$(objpfx)/libnss_test_gai_hv2_canonname.so$(libnss_files.so-version): \
 +  $(objpfx)/libnss_test_gai_hv2_canonname.so
 +	$(make-link)
 $(patsubst %,$(objpfx)%.out,$(tests) $(tests-container)) : \
 	$(objpfx)/libnss_test1.so$(libnss_files.so-version) \
 	$(objpfx)/libnss_test2.so$(libnss_files.so-version) \
 -	$(objpfx)/libnss_test_errno.so$(libnss_files.so-version)
 +	$(objpfx)/libnss_test_errno.so$(libnss_files.so-version) \
 +	$(objpfx)/libnss_test_gai_hv2_canonname.so$(libnss_files.so-version)
 ifeq (yes,$(have-thread-library))
 $(objpfx)tst-cancel-getpwuid_r: $(shared-thread-library)
 diff --git a/nss/nss_test_gai_hv2_canonname.c b/nss/nss_test_gai_hv2_canonname.c
 new file mode 100644
 index 0000000000000000..4439c83c9f40cf43
 --- /dev/null
 +++ b/nss/nss_test_gai_hv2_canonname.c
@@ -0,0 +1,56 @@
 +/* NSS service provider that only provides gethostbyname2_r.
 +   Copyright The GNU Toolchain Authors.
 +   This file is part of the GNU C Library.
 +
 +   The GNU C Library is free software; you can redistribute it and/or
 +   modify it under the terms of the GNU Lesser General Public
 +   License as published by the Free Software Foundation; either
 +   version 2.1 of the License, or (at your option) any later version.
 +
 +   The GNU C Library is distributed in the hope that it will be useful,
 +   but WITHOUT ANY WARRANTY; without even the implied warranty of
 +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +   Lesser General Public License for more details.
 +
 +   You should have received a copy of the GNU Lesser General Public
 +   License along with the GNU C Library; if not, see
 +   <https://www.gnu.org/licenses/>.  */
 +
 +#include <nss.h>
 +#include <stdlib.h>
 +#include <string.h>
 +#include "nss/tst-nss-gai-hv2-canonname.h"
 +
 +/* Catch misnamed and functions.  */
 +#pragma GCC diagnostic error "-Wmissing-prototypes"
 +NSS_DECLARE_MODULE_FUNCTIONS (test_gai_hv2_canonname)
 +
 +extern enum nss_status _nss_files_gethostbyname2_r (const char *, int,
 +						    struct hostent *, char *,
 +						    size_t, int *, int *);
 +
 +enum nss_status
 +_nss_test_gai_hv2_canonname_gethostbyname2_r (const char *name, int af,
 +					      struct hostent *result,
 +					      char *buffer, size_t buflen,
 +					      int *errnop, int *herrnop)
 +{
 +  return _nss_files_gethostbyname2_r (name, af, result, buffer, buflen, errnop,
 +				      herrnop);
 +}
 +
 +enum nss_status
 +_nss_test_gai_hv2_canonname_getcanonname_r (const char *name, char *buffer,
 +					    size_t buflen, char **result,
 +					    int *errnop, int *h_errnop)
 +{
 +  /* We expect QUERYNAME, which is a small enough string that it shouldn't fail
 +     the test.  */
 +  if (memcmp (QUERYNAME, name, sizeof (QUERYNAME))
 +      || buflen < sizeof (QUERYNAME))
 +    abort ();
 +
 +  strncpy (buffer, name, buflen);
 +  *result = buffer;
 +  return NSS_STATUS_SUCCESS;
 +}
 diff --git a/nss/tst-nss-gai-hv2-canonname.c b/nss/tst-nss-gai-hv2-canonname.c
 new file mode 100644
 index 0000000000000000..d5f10c07d6a90773
 --- /dev/null
 +++ b/nss/tst-nss-gai-hv2-canonname.c
@@ -0,0 +1,63 @@
 +/* Test NSS query path for plugins that only implement gethostbyname2
 +   (#30843).
 +   Copyright The GNU Toolchain Authors.
 +   This file is part of the GNU C Library.
 +
 +   The GNU C Library is free software; you can redistribute it and/or
 +   modify it under the terms of the GNU Lesser General Public
 +   License as published by the Free Software Foundation; either
 +   version 2.1 of the License, or (at your option) any later version.
 +
 +   The GNU C Library is distributed in the hope that it will be useful,
 +   but WITHOUT ANY WARRANTY; without even the implied warranty of
 +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +   Lesser General Public License for more details.
 +
 +   You should have received a copy of the GNU Lesser General Public
 +   License along with the GNU C Library; if not, see
 +   <https://www.gnu.org/licenses/>.  */
 +
 +#include <nss.h>
 +#include <netdb.h>
 +#include <stdlib.h>
 +#include <string.h>
 +#include <support/check.h>
 +#include <support/xstdio.h>
 +#include "nss/tst-nss-gai-hv2-canonname.h"
 +
 +#define PREPARE do_prepare
 +
 +static void do_prepare (int a, char **av)
 +{
 +  FILE *hosts = xfopen ("/etc/hosts", "w");
 +  for (unsigned i = 2; i < 255; i++)
 +    {
 +      fprintf (hosts, "ff01::ff02:ff03:%u:2\ttest.example.com\n", i);
 +      fprintf (hosts, "192.168.0.%u\ttest.example.com\n", i);
 +    }
 +  xfclose (hosts);
 +}
 +
 +static int
 +do_test (void)
 +{
 +  __nss_configure_lookup ("hosts", "test_gai_hv2_canonname");
 +
 +  struct addrinfo hints = {};
 +  struct addrinfo *result = NULL;
 +
 +  hints.ai_family = AF_INET6;
 +  hints.ai_flags = AI_ALL | AI_V4MAPPED | AI_CANONNAME;
 +
 +  int ret = getaddrinfo (QUERYNAME, NULL, &hints, &result);
 +
 +  if (ret != 0)
 +    FAIL_EXIT1 ("getaddrinfo failed: %s\n", gai_strerror (ret));
 +
 +  TEST_COMPARE_STRING (result->ai_canonname, QUERYNAME);
 +
 +  freeaddrinfo(result);
 +  return 0;
 +}
 +
 +#include <support/test-driver.c>
 diff --git a/nss/tst-nss-gai-hv2-canonname.h b/nss/tst-nss-gai-hv2-canonname.h
 new file mode 100644
 index 0000000000000000..14f2a9cb0867dff9
 --- /dev/null
 +++ b/nss/tst-nss-gai-hv2-canonname.h
@@ -0,0 +1 @@
 +#define QUERYNAME "test.example.com"
 diff --git a/nss/tst-nss-gai-hv2-canonname.root/postclean.req b/nss/tst-nss-gai-hv2-canonname.root/postclean.req
 new file mode 100644
 index 0000000000000000..e69de29bb2d1d643
 diff --git a/nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script b/nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script
 new file mode 100644
 index 0000000000000000..31848b4a28524af6
 --- /dev/null
 +++ b/nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script
@@ -0,0 +1,2 @@
 +cp $B/nss/libnss_test_gai_hv2_canonname.so $L/libnss_test_gai_hv2_canonname.so.2
 +su
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 37260d6e6f292186..10dc63542f337693 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -120,6 +120,7 @@ struct gaih_result
 {
   struct gaih_addrtuple *at;
   char *canon;
 +  char *h_name;
   bool free_at;
   bool got_ipv6;
 };
@@ -165,6 +166,7 @@ gaih_result_reset (struct gaih_result *res)
   if (res->free_at)
     free (res->at);
   free (res->canon);
 +  free (res->h_name);
   memset (res, 0, sizeof (*res));
 }
@@ -203,9 +205,8 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
   return 0;
 }
 -/* Convert struct hostent to a list of struct gaih_addrtuple objects.  h_name
 -   is not copied, and the struct hostent object must not be deallocated
 -   prematurely.  The new addresses are appended to the tuple array in RES.  */
 +/* Convert struct hostent to a list of struct gaih_addrtuple objects.  The new
 +   addresses are appended to the tuple array in RES.  */
 static bool
 convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
 				   struct hostent *h, struct gaih_result *res)
@@ -238,6 +239,15 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
   res->at = array;
   res->free_at = true;
 +  /* Duplicate h_name because it may get reclaimed when the underlying storage
 +     is freed.  */
 +  if (res->h_name == NULL)
 +    {
 +      res->h_name = __strdup (h->h_name);
 +      if (res->h_name == NULL)
 +	return false;
 +    }
 +
   /* Update the next pointers on reallocation.  */
   for (size_t i = 0; i < old; i++)
     array[i].next = array + i + 1;
@@ -262,7 +272,6 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
 	}
       array[i].next = array + i + 1;
     }
 -  array[0].name = h->h_name;
   array[count - 1].next = NULL;
   return true;
@@ -324,15 +333,15 @@ gethosts (nss_gethostbyname3_r fct, int family, const char *name,
    memory allocation failure.  The returned string is allocated on the
    heap; the caller has to free it.  */
 static char *
 -getcanonname (nss_action_list nip, struct gaih_addrtuple *at, const char *name)
 +getcanonname (nss_action_list nip, const char *hname, const char *name)
 {
   nss_getcanonname_r *cfct = __nss_lookup_function (nip, "getcanonname_r");
   char *s = (char *) name;
   if (cfct != NULL)
     {
       char buf[256];
 -      if (DL_CALL_FCT (cfct, (at->name ?: name, buf, sizeof (buf),
 -			      &s, &errno, &h_errno)) != NSS_STATUS_SUCCESS)
 +      if (DL_CALL_FCT (cfct, (hname ?: name, buf, sizeof (buf), &s, &errno,
 +			      &h_errno)) != NSS_STATUS_SUCCESS)
 	/* If the canonical name cannot be determined, use the passed
 	   string.  */
 	s = (char *) name;
@@ -771,7 +780,7 @@ get_nss_addresses (const char *name, const struct addrinfo *req,
 		  if ((req->ai_flags & AI_CANONNAME) != 0
 		      && res->canon == NULL)
 		    {
 -		      char *canonbuf = getcanonname (nip, res->at, name);
 +		      char *canonbuf = getcanonname (nip, res->h_name, name);
 		      if (canonbuf == NULL)
 			{
 			  __resolv_context_put (res_ctx);
--- a/SOURCES/glibc-RHEL-2425-15.patch
+++ b/SOURCES/glibc-RHEL-2425-15.patch
@ -0,0 +1,37 @@
 commit 57e349b1b0df1aee2dcd19dae1f324bde25ff8f0
 Author: H.J. Lu <hjl.tools@gmail.com>
 Date:   Wed Dec 8 07:02:27 2021 -0800
    Disable DT_RUNPATH on NSS tests [BZ #28455]
    The glibc internal NSS functions should always load NSS modules from
    the system.  For testing purpose, disable DT_RUNPATH on NSS tests so
    that the glibc internal NSS functions can load testing NSS modules
    via DT_RPATH.
    This partially fixes BZ #28455.
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
 Conflicts:
 	nss/Makefile
 	  (different test backport order)
 diff --git a/nss/Makefile b/nss/Makefile
 index 18a27d79d26f094a..648adf4bb7b1ee6a 100644
 --- a/nss/Makefile
 +++ b/nss/Makefile
@@ -214,3 +214,13 @@ endif
 $(objpfx)tst-nss-files-alias-leak.out: $(objpfx)/libnss_files.so
 $(objpfx)tst-nss-files-alias-truncated.out: $(objpfx)/libnss_files.so
 +
 +# Disable DT_RUNPATH on NSS tests so that the glibc internal NSS
 +# functions can load testing NSS modules via DT_RPATH.
 +LDFLAGS-tst-nss-test1 = -Wl,--disable-new-dtags
 +LDFLAGS-tst-nss-test2 = -Wl,--disable-new-dtags
 +LDFLAGS-tst-nss-test3 = -Wl,--disable-new-dtags
 +LDFLAGS-tst-nss-test4 = -Wl,--disable-new-dtags
 +LDFLAGS-tst-nss-test5 = -Wl,--disable-new-dtags
 +LDFLAGS-tst-nss-test_errno = -Wl,--disable-new-dtags
 +LDFLAGS-tst-nss-test_gai_hv2_canonname = -Wl,--disable-new-dtags
--- a/SOURCES/glibc-RHEL-2425-16.patch
+++ b/SOURCES/glibc-RHEL-2425-16.patch
@ -0,0 +1,84 @@
 commit ec6b95c3303c700eb89eebeda2d7264cc184a796
 Author: Romain Geissler <romain.geissler@amadeus.com>
 Date:   Mon Sep 25 01:21:51 2023 +0100
    Fix leak in getaddrinfo introduced by the fix for CVE-2023-4806 [BZ #30843]
    This patch fixes a very recently added leak in getaddrinfo.
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
 diff --git a/nss/Makefile b/nss/Makefile
 index 648adf4bb7b1ee6a..bfdb0fd5a9a90873 100644
 --- a/nss/Makefile
 +++ b/nss/Makefile
@@ -147,6 +147,15 @@ endif
 extra-test-objs		+= nss_test1.os nss_test2.os nss_test_errno.os \
 			   nss_test_gai_hv2_canonname.os
 +ifeq ($(run-built-tests),yes)
 +ifneq (no,$(PERL))
 +tests-special += $(objpfx)mtrace-tst-nss-gai-hv2-canonname.out
 +endif
 +endif
 +
 +generated += mtrace-tst-nss-gai-hv2-canonname.out \
 +		tst-nss-gai-hv2-canonname.mtrace
 +
 include ../Rules
 ifeq (yes,$(have-selinux))
@@ -215,6 +224,17 @@ endif
 $(objpfx)tst-nss-files-alias-leak.out: $(objpfx)/libnss_files.so
 $(objpfx)tst-nss-files-alias-truncated.out: $(objpfx)/libnss_files.so
 +tst-nss-gai-hv2-canonname-ENV = \
 +		MALLOC_TRACE=$(objpfx)tst-nss-gai-hv2-canonname.mtrace \
 +		LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
 +$(objpfx)mtrace-tst-nss-gai-hv2-canonname.out: \
 +  $(objpfx)tst-nss-gai-hv2-canonname.out
 +	{ test -r $(objpfx)tst-nss-gai-hv2-canonname.mtrace \
 +	|| ( echo "tst-nss-gai-hv2-canonname.mtrace does not exist"; exit 77; ) \
 +	&& $(common-objpfx)malloc/mtrace \
 +	$(objpfx)tst-nss-gai-hv2-canonname.mtrace; } > $@; \
 +	$(evaluate-test)
 +
 # Disable DT_RUNPATH on NSS tests so that the glibc internal NSS
 # functions can load testing NSS modules via DT_RPATH.
 LDFLAGS-tst-nss-test1 = -Wl,--disable-new-dtags
 diff --git a/nss/tst-nss-gai-hv2-canonname.c b/nss/tst-nss-gai-hv2-canonname.c
 index d5f10c07d6a90773..7db53cf09da8dcb6 100644
 --- a/nss/tst-nss-gai-hv2-canonname.c
 +++ b/nss/tst-nss-gai-hv2-canonname.c
@@ -21,6 +21,7 @@
 #include <netdb.h>
 #include <stdlib.h>
 #include <string.h>
 +#include <mcheck.h>
 #include <support/check.h>
 #include <support/xstdio.h>
 #include "nss/tst-nss-gai-hv2-canonname.h"
@@ -41,6 +42,8 @@ static void do_prepare (int a, char **av)
 static int
 do_test (void)
 {
 +  mtrace ();
 +
   __nss_configure_lookup ("hosts", "test_gai_hv2_canonname");
   struct addrinfo hints = {};
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 10dc63542f337693..d6046a707f1d742a 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -1196,9 +1196,7 @@ free_and_return:
   if (malloc_name)
     free ((char *) name);
   free (addrmem);
 -  if (res.free_at)
 -    free (res.at);
 -  free (res.canon);
 +  gaih_result_reset (&res);
   return result;
 }
--- a/SOURCES/glibc-RHEL-2425-2.patch
+++ b/SOURCES/glibc-RHEL-2425-2.patch
@ -0,0 +1,41 @@
 commit 01671608a3bddde369cdd42aed12e1c019b87158
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Wed Aug 4 02:21:01 2021 +0530
    gethosts: Remove unused argument _type
    The generated code is unchanged.
    (cherry picked from commit b17e842a60819098d2a203ecc8b8371b7e1d6c65)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index f391dc0a59849aab..702d8a50e0c218d2 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -239,7 +239,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
   return true;
 }
 -#define gethosts(_family, _type) \
 +#define gethosts(_family) \
  {									      \
   struct hostent th;							      \
   char *localcanon = NULL;						      \
@@ -864,7 +864,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		      if (req->ai_family == AF_INET6
 			  || req->ai_family == AF_UNSPEC)
 			{
 -			  gethosts (AF_INET6, struct in6_addr);
 +			  gethosts (AF_INET6);
 			  no_inet6_data = no_data;
 			  inet6_status = status;
 			}
@@ -876,7 +876,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 				 know we are not going to need them.  */
 			      && ((req->ai_flags & AI_ALL) || !got_ipv6)))
 			{
 -			  gethosts (AF_INET, struct in_addr);
 +			  gethosts (AF_INET);
 			  if (req->ai_family == AF_INET)
 			    {
--- a/SOURCES/glibc-RHEL-2425-3.patch
+++ b/SOURCES/glibc-RHEL-2425-3.patch
@ -0,0 +1,248 @@
 commit b195fd86c616b147dad3a63498b79e0dedb4662b
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Mon Mar 7 22:17:36 2022 +0530
    gaih_inet: Simplify canon name resolution
    Simplify logic for allocation of canon to remove the canonbuf variable;
    canon now always points to an allocated block.  Also pull the canon name
    set into a separate function.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit d01411f6bc61429fc027c38827bf3103b48eef2e)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 702d8a50e0c218d2..5c0d873e1d766099 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -285,7 +285,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
 									      \
       if (localcanon != NULL && canon == NULL)				      \
 	{								      \
 -	  canonbuf = __strdup (localcanon);				      \
 +	  char *canonbuf = __strdup (localcanon);			      \
 	  if (canonbuf == NULL)						      \
 	    {								      \
 	      __resolv_context_put (res_ctx);				      \
@@ -323,6 +323,41 @@ getcanonname (nss_action_list nip, struct gaih_addrtuple *at, const char *name)
   return __strdup (name);
 }
 +/* Process looked up canonical name and if necessary, decode to IDNA.  Result
 +   is a new string written to CANONP and the earlier string is freed.  */
 +
 +static int
 +process_canonname (const struct addrinfo *req, const char *orig_name,
 +		   char **canonp)
 +{
 +  char *canon = *canonp;
 +
 +  if ((req->ai_flags & AI_CANONNAME) != 0)
 +    {
 +      bool do_idn = req->ai_flags & AI_CANONIDN;
 +      if (do_idn)
 +	{
 +	  char *out;
 +	  int rc = __idna_from_dns_encoding (canon ?: orig_name, &out);
 +	  if (rc == 0)
 +	    {
 +	      free (canon);
 +	      canon = out;
 +	    }
 +	  else if (rc == EAI_IDN_ENCODE)
 +	    /* Use the punycode name as a fallback.  */
 +	    do_idn = false;
 +	  else
 +	    return -rc;
 +	}
 +      if (!do_idn && canon == NULL && (canon = __strdup (orig_name)) == NULL)
 +	return -EAI_MEMORY;
 +    }
 +
 +  *canonp = canon;
 +  return 0;
 +}
 +
 static int
 gaih_inet (const char *name, const struct gaih_service *service,
 	   const struct addrinfo *req, struct addrinfo **pai,
@@ -332,7 +367,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
   struct gaih_servtuple *st = (struct gaih_servtuple *) &nullserv;
   struct gaih_addrtuple *at = NULL;
   bool got_ipv6 = false;
 -  const char *canon = NULL;
 +  char *canon = NULL;
   const char *orig_name = name;
   /* Reserve stack memory for the scratch buffer in the getaddrinfo
@@ -453,7 +488,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
   bool malloc_name = false;
   struct gaih_addrtuple *addrmem = NULL;
 -  char *canonbuf = NULL;
   int result = 0;
   if (name != NULL)
@@ -495,7 +529,15 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	    }
 	  if (req->ai_flags & AI_CANONNAME)
 -	    canon = name;
 +	    {
 +	      char *canonbuf = __strdup (name);
 +	      if (canonbuf == NULL)
 +		{
 +		  result = -EAI_MEMORY;
 +		  goto free_and_return;
 +		}
 +	      canon = canonbuf;
 +	    }
 	  goto process_list;
 	}
@@ -545,7 +587,15 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	    }
 	  if (req->ai_flags & AI_CANONNAME)
 -	    canon = name;
 +	    {
 +	      char *canonbuf = __strdup (name);
 +	      if (canonbuf == NULL)
 +		{
 +		  result = -EAI_MEMORY;
 +		  goto free_and_return;
 +		}
 +	      canon = canonbuf;
 +	    }
 	  goto process_list;
 	}
@@ -676,9 +726,9 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		      (*pat)->next = NULL;
 		      if (added_canon || air->canon == NULL)
 			(*pat)->name = NULL;
 -		      else if (canonbuf == NULL)
 +		      else if (canon == NULL)
 			{
 -			  canonbuf = __strdup (air->canon);
 +			  char *canonbuf = __strdup (air->canon);
 			  if (canonbuf == NULL)
 			    {
 			      result = -EAI_MEMORY;
@@ -748,9 +798,9 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	      /* Always start afresh; continue should discard previous results
 		 and the hosts database does not support merge.  */
 	      at = NULL;
 -	      free (canonbuf);
 +	      free (canon);
 	      free (addrmem);
 -	      canon = canonbuf = NULL;
 +	      canon = NULL;
 	      addrmem = NULL;
 	      got_ipv6 = false;
@@ -805,7 +855,16 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		      no_data = 1;
 		      if ((req->ai_flags & AI_CANONNAME) != 0 && canon == NULL)
 -			canon = at->name;
 +			{
 +			  char *canonbuf = __strdup (at->name);
 +			  if (canonbuf == NULL)
 +			    {
 +			      __resolv_context_put (res_ctx);
 +			      result = -EAI_MEMORY;
 +			      goto free_and_return;
 +			    }
 +			  canon = canonbuf;
 +			}
 		      struct gaih_addrtuple **pat = &at;
@@ -893,7 +952,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 			  if ((req->ai_flags & AI_CANONNAME) != 0
 			      && canon == NULL)
 			    {
 -			      canonbuf = getcanonname (nip, at, name);
 +			      char *canonbuf = getcanonname (nip, at, name);
 			      if (canonbuf == NULL)
 				{
 				  __resolv_context_put (res_ctx);
@@ -1004,6 +1063,10 @@ gaih_inet (const char *name, const struct gaih_service *service,
     }
   {
 +    /* Set up the canonical name if we need it.  */
 +    if ((result = process_canonname (req, orig_name, &canon)) != 0)
 +      goto free_and_return;
 +
     struct gaih_servtuple *st2;
     struct gaih_addrtuple *at2 = at;
     size_t socklen;
@@ -1014,48 +1077,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
      */
     while (at2 != NULL)
       {
 -	/* Only the first entry gets the canonical name.  */
 -	if (at2 == at && (req->ai_flags & AI_CANONNAME) != 0)
 -	  {
 -	    if (canon == NULL)
 -	      /* If the canonical name cannot be determined, use
 -		 the passed in string.  */
 -	      canon = orig_name;
 -
 -	    bool do_idn = req->ai_flags & AI_CANONIDN;
 -	    if (do_idn)
 -	      {
 -		char *out;
 -		int rc = __idna_from_dns_encoding (canon, &out);
 -		if (rc == 0)
 -		  canon = out;
 -		else if (rc == EAI_IDN_ENCODE)
 -		  /* Use the punycode name as a fallback.  */
 -		  do_idn = false;
 -		else
 -		  {
 -		    result = -rc;
 -		    goto free_and_return;
 -		  }
 -	      }
 -	    if (!do_idn)
 -	      {
 -		if (canonbuf != NULL)
 -		  /* We already allocated the string using malloc, but
 -		     the buffer is now owned by canon.  */
 -		  canonbuf = NULL;
 -		else
 -		  {
 -		    canon = __strdup (canon);
 -		    if (canon == NULL)
 -		      {
 -			result = -EAI_MEMORY;
 -			goto free_and_return;
 -		      }
 -		  }
 -	      }
 -	  }
 -
 	family = at2->family;
 	if (family == AF_INET6)
 	  {
@@ -1078,7 +1099,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	    ai = *pai = malloc (sizeof (struct addrinfo) + socklen);
 	    if (ai == NULL)
 	      {
 -		free ((char *) canon);
 		result = -EAI_MEMORY;
 		goto free_and_return;
 	      }
@@ -1138,7 +1158,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
   if (malloc_name)
     free ((char *) name);
   free (addrmem);
 -  free (canonbuf);
 +  free (canon);
   return result;
 }
--- a/SOURCES/glibc-RHEL-2425-4.patch
+++ b/SOURCES/glibc-RHEL-2425-4.patch
@ -0,0 +1,86 @@
 commit f7efb43738f255db32cfa4e84a491c09f6da66e2
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Thu Mar 3 23:07:42 2022 +0530
    getaddrinfo: Fix leak with AI_ALL [BZ #28852]
    Use realloc in convert_hostent_to_gaih_addrtuple and fix up pointers in
    the result list so that a single block is maintained for
    hostbyname3_r/hostbyname2_r and freed in gaih_inet.  This result is
    never merged with any other results, since the hosts database does not
    permit merging.
    Resolves BZ #28852.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 300460460706ce3ffe29a7df8966e68323ec5bf1)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 5c0d873e1d766099..ed70e6cb3944d219 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -189,19 +189,16 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
   return 0;
 }
 -/* Convert struct hostent to a list of struct gaih_addrtuple objects.
 -   h_name is not copied, and the struct hostent object must not be
 -   deallocated prematurely.  *RESULT must be NULL or a pointer to a
 -   linked-list.  The new addresses are appended at the end.  */
 +/* Convert struct hostent to a list of struct gaih_addrtuple objects.  h_name
 +   is not copied, and the struct hostent object must not be deallocated
 +   prematurely.  The new addresses are appended to the tuple array in
 +   RESULT.  */
 static bool
 convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
 				   int family,
 				   struct hostent *h,
 				   struct gaih_addrtuple **result)
 {
 -  while (*result)
 -    result = &(*result)->next;
 -
   /* Count the number of addresses in h->h_addr_list.  */
   size_t count = 0;
   for (char **p = h->h_addr_list; *p != NULL; ++p)
@@ -212,10 +209,30 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
   if (count == 0 || h->h_length > sizeof (((struct gaih_addrtuple) {}).addr))
     return true;
 -  struct gaih_addrtuple *array = calloc (count, sizeof (*array));
 +  struct gaih_addrtuple *array = *result;
 +  size_t old = 0;
 +
 +  while (array != NULL)
 +    {
 +      old++;
 +      array = array->next;
 +    }
 +
 +  array = realloc (*result, (old + count) * sizeof (*array));
 +
   if (array == NULL)
     return false;
 +  *result = array;
 +
 +  /* Update the next pointers on reallocation.  */
 +  for (size_t i = 0; i < old; i++)
 +    array[i].next = array + i + 1;
 +
 +  array += old;
 +
 +  memset (array, 0, count * sizeof (*array));
 +
   for (size_t i = 0; i < count; ++i)
     {
       if (family == AF_INET && req->ai_family == AF_INET6)
@@ -235,7 +252,6 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
   array[0].name = h->h_name;
   array[count - 1].next = NULL;
 -  *result = array;
   return true;
 }
--- a/SOURCES/glibc-RHEL-2425-5.patch
+++ b/SOURCES/glibc-RHEL-2425-5.patch
@ -0,0 +1,285 @@
 commit e05e5889b8a307fe4be55b03bcbd7a1c62fc2f2d
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Thu Feb 10 13:27:11 2022 +0530
    gaih_inet: Simplify service resolution
    Refactor the code to split out the service resolution code into a
    separate function.  Allocate the service tuples array just once to the
    size of the typeproto array, thus avoiding the unnecessary pointer
    chasing and stack allocations.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 8d6cf99f2fb81a097f9334c125e5c23604af1a98)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index ed70e6cb3944d219..8c78ef9570fe0f58 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -100,14 +100,12 @@ struct gaih_service
 struct gaih_servtuple
   {
 -    struct gaih_servtuple *next;
     int socktype;
     int protocol;
     int port;
 +    bool set;
   };
 -static const struct gaih_servtuple nullserv;
 -
 struct gaih_typeproto
   {
@@ -180,11 +178,11 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
     }
   while (r);
 -  st->next = NULL;
   st->socktype = tp->socktype;
   st->protocol = ((tp->protoflag & GAI_PROTO_PROTOANY)
 		  ? req->ai_protocol : tp->protocol);
   st->port = s->s_port;
 +  st->set = true;
   return 0;
 }
@@ -375,20 +373,11 @@ process_canonname (const struct addrinfo *req, const char *orig_name,
 }
 static int
 -gaih_inet (const char *name, const struct gaih_service *service,
 -	   const struct addrinfo *req, struct addrinfo **pai,
 -	   unsigned int *naddrs, struct scratch_buffer *tmpbuf)
 +get_servtuples (const struct gaih_service *service, const struct addrinfo *req,
 +		struct gaih_servtuple *st, struct scratch_buffer *tmpbuf)
 {
 +  int i;
   const struct gaih_typeproto *tp = gaih_inet_typeproto;
 -  struct gaih_servtuple *st = (struct gaih_servtuple *) &nullserv;
 -  struct gaih_addrtuple *at = NULL;
 -  bool got_ipv6 = false;
 -  char *canon = NULL;
 -  const char *orig_name = name;
 -
 -  /* Reserve stack memory for the scratch buffer in the getaddrinfo
 -     function.  */
 -  size_t alloca_used = sizeof (struct scratch_buffer);
   if (req->ai_protocol || req->ai_socktype)
     {
@@ -410,98 +399,88 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	}
     }
 -  int port = 0;
 -  if (service != NULL)
 +  if (service != NULL && (tp->protoflag & GAI_PROTO_NOSERVICE) != 0)
 +    return -EAI_SERVICE;
 +
 +  if (service == NULL || service->num >= 0)
     {
 -      if ((tp->protoflag & GAI_PROTO_NOSERVICE) != 0)
 -	return -EAI_SERVICE;
 +      int port = service != NULL ? htons (service->num) : 0;
 -      if (service->num < 0)
 +      if (req->ai_socktype || req->ai_protocol)
 	{
 -	  if (tp->name[0])
 -	    {
 -	      st = (struct gaih_servtuple *)
 -		alloca_account (sizeof (struct gaih_servtuple), alloca_used);
 -
 -	      int rc = gaih_inet_serv (service->name, tp, req, st, tmpbuf);
 -	      if (__glibc_unlikely (rc != 0))
 -		return rc;
 -	    }
 -	  else
 -	    {
 -	      struct gaih_servtuple **pst = &st;
 -	      for (tp++; tp->name[0]; tp++)
 -		{
 -		  struct gaih_servtuple *newp;
 +	  st[0].socktype = tp->socktype;
 +	  st[0].protocol = ((tp->protoflag & GAI_PROTO_PROTOANY)
 +			  ? req->ai_protocol : tp->protocol);
 +	  st[0].port = port;
 +	  st[0].set = true;
 -		  if ((tp->protoflag & GAI_PROTO_NOSERVICE) != 0)
 -		    continue;
 +	  return 0;
 +	}
 -		  if (req->ai_socktype != 0
 -		      && req->ai_socktype != tp->socktype)
 -		    continue;
 -		  if (req->ai_protocol != 0
 -		      && !(tp->protoflag & GAI_PROTO_PROTOANY)
 -		      && req->ai_protocol != tp->protocol)
 -		    continue;
 +      /* Neither socket type nor protocol is set.  Return all socket types
 +	 we know about.  */
 +      for (i = 0, ++tp; tp->name[0]; ++tp)
 +	if (tp->defaultflag)
 +	  {
 +	    st[i].socktype = tp->socktype;
 +	    st[i].protocol = tp->protocol;
 +	    st[i].port = port;
 +	    st[i++].set = true;
 +	  }
 -		  newp = (struct gaih_servtuple *)
 -		    alloca_account (sizeof (struct gaih_servtuple),
 -				    alloca_used);
 +      return 0;
 +    }
 -		  if (gaih_inet_serv (service->name,
 -				      tp, req, newp, tmpbuf) != 0)
 -		    continue;
 +  if (tp->name[0])
 +    return gaih_inet_serv (service->name, tp, req, st, tmpbuf);
 -		  *pst = newp;
 -		  pst = &(newp->next);
 -		}
 -	      if (st == (struct gaih_servtuple *) &nullserv)
 -		return -EAI_SERVICE;
 -	    }
 -	}
 -      else
 -	{
 -	  port = htons (service->num);
 -	  goto got_port;
 -	}
 -    }
 -  else
 +  for (i = 0, tp++; tp->name[0]; tp++)
     {
 -    got_port:
 +      if ((tp->protoflag & GAI_PROTO_NOSERVICE) != 0)
 +	continue;
 -      if (req->ai_socktype || req->ai_protocol)
 -	{
 -	  st = alloca_account (sizeof (struct gaih_servtuple), alloca_used);
 -	  st->next = NULL;
 -	  st->socktype = tp->socktype;
 -	  st->protocol = ((tp->protoflag & GAI_PROTO_PROTOANY)
 -			  ? req->ai_protocol : tp->protocol);
 -	  st->port = port;
 -	}
 -      else
 -	{
 -	  /* Neither socket type nor protocol is set.  Return all socket types
 -	     we know about.  */
 -	  struct gaih_servtuple **lastp = &st;
 -	  for (++tp; tp->name[0]; ++tp)
 -	    if (tp->defaultflag)
 -	      {
 -		struct gaih_servtuple *newp;
 +      if (req->ai_socktype != 0
 +	  && req->ai_socktype != tp->socktype)
 +	continue;
 +      if (req->ai_protocol != 0
 +	  && !(tp->protoflag & GAI_PROTO_PROTOANY)
 +	  && req->ai_protocol != tp->protocol)
 +	continue;
 -		newp = alloca_account (sizeof (struct gaih_servtuple),
 -				       alloca_used);
 -		newp->next = NULL;
 -		newp->socktype = tp->socktype;
 -		newp->protocol = tp->protocol;
 -		newp->port = port;
 +      if (gaih_inet_serv (service->name,
 +			  tp, req, &st[i], tmpbuf) != 0)
 +	continue;
 -		*lastp = newp;
 -		lastp = &newp->next;
 -	      }
 -	}
 +      i++;
     }
 +  if (!st[0].set)
 +    return -EAI_SERVICE;
 +
 +  return 0;
 +}
 +
 +static int
 +gaih_inet (const char *name, const struct gaih_service *service,
 +	   const struct addrinfo *req, struct addrinfo **pai,
 +	   unsigned int *naddrs, struct scratch_buffer *tmpbuf)
 +{
 +  struct gaih_servtuple st[sizeof (gaih_inet_typeproto)
 +			   / sizeof (struct gaih_typeproto)] = {0};
 +
 +  struct gaih_addrtuple *at = NULL;
 +  bool got_ipv6 = false;
 +  char *canon = NULL;
 +  const char *orig_name = name;
 +
 +  /* Reserve stack memory for the scratch buffer in the getaddrinfo
 +     function.  */
 +  size_t alloca_used = sizeof (struct scratch_buffer);
 +
 +  int rc;
 +  if ((rc = get_servtuples (service, req, st, tmpbuf)) != 0)
 +    return rc;
 +
   bool malloc_name = false;
   struct gaih_addrtuple *addrmem = NULL;
   int result = 0;
@@ -1083,7 +1062,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
     if ((result = process_canonname (req, orig_name, &canon)) != 0)
       goto free_and_return;
 -    struct gaih_servtuple *st2;
     struct gaih_addrtuple *at2 = at;
     size_t socklen;
     sa_family_t family;
@@ -1109,7 +1087,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	else
 	  socklen = sizeof (struct sockaddr_in);
 -	for (st2 = st; st2 != NULL; st2 = st2->next)
 +	for (int i = 0; st[i].set; i++)
 	  {
 	    struct addrinfo *ai;
 	    ai = *pai = malloc (sizeof (struct addrinfo) + socklen);
@@ -1121,8 +1099,8 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	    ai->ai_flags = req->ai_flags;
 	    ai->ai_family = family;
 -	    ai->ai_socktype = st2->socktype;
 -	    ai->ai_protocol = st2->protocol;
 +	    ai->ai_socktype = st[i].socktype;
 +	    ai->ai_protocol = st[i].protocol;
 	    ai->ai_addrlen = socklen;
 	    ai->ai_addr = (void *) (ai + 1);
@@ -1144,7 +1122,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		struct sockaddr_in6 *sin6p =
 		  (struct sockaddr_in6 *) ai->ai_addr;
 -		sin6p->sin6_port = st2->port;
 +		sin6p->sin6_port = st[i].port;
 		sin6p->sin6_flowinfo = 0;
 		memcpy (&sin6p->sin6_addr,
 			at2->addr, sizeof (struct in6_addr));
@@ -1154,7 +1132,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	      {
 		struct sockaddr_in *sinp =
 		  (struct sockaddr_in *) ai->ai_addr;
 -		sinp->sin_port = st2->port;
 +		sinp->sin_port = st[i].port;
 		memcpy (&sinp->sin_addr,
 			at2->addr, sizeof (struct in_addr));
 		memset (sinp->sin_zero, '\0', sizeof (sinp->sin_zero));
--- a/SOURCES/glibc-RHEL-2425-6.patch
+++ b/SOURCES/glibc-RHEL-2425-6.patch
--- a/SOURCES/glibc-RHEL-2425-7.patch
+++ b/SOURCES/glibc-RHEL-2425-7.patch
@ -0,0 +1,179 @@
 commit 3b5a3e5009088a029525277f36228eeb95032358
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Fri Mar 4 14:57:12 2022 +0530
    gaih_inet: Split simple gethostbyname into its own function
    Add a free_at flag in gaih_result to indicate if res.at needs to be
    freed by the caller.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit b44389cb7fa28a59804571dac09cc32ebfac03d1)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 57b6834c8bb3887c..3870b2dc2edc89cd 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -120,6 +120,7 @@ struct gaih_result
 {
   struct gaih_addrtuple *at;
   char *canon;
 +  bool free_at;
 };
 /* Values for `protoflag'.  */
@@ -565,6 +566,62 @@ out:
   return result;
 }
 +/* If possible, call the simple, old functions, which do not support IPv6 scope
 +   ids, nor retrieving the canonical name.  */
 +
 +static int
 +try_simple_gethostbyname (const char *name, const struct addrinfo *req,
 +			  struct scratch_buffer *tmpbuf,
 +			  struct gaih_result *res)
 +{
 +  res->at = NULL;
 +
 +  if (req->ai_family != AF_INET || (req->ai_flags & AI_CANONNAME) != 0)
 +    return 0;
 +
 +  int rc;
 +  struct hostent th;
 +  struct hostent *h;
 +
 +  while (1)
 +    {
 +      rc = __gethostbyname2_r (name, AF_INET, &th, tmpbuf->data,
 +			       tmpbuf->length, &h, &h_errno);
 +      if (rc != ERANGE || h_errno != NETDB_INTERNAL)
 +	break;
 +      if (!scratch_buffer_grow (tmpbuf))
 +	return -EAI_MEMORY;
 +    }
 +
 +  if (rc == 0)
 +    {
 +      if (h != NULL)
 +	{
 +	  /* We found data, convert it.  RES->AT from the conversion will
 +	     either be an allocated block or NULL, both of which are safe to
 +	     pass to free ().  */
 +	  if (!convert_hostent_to_gaih_addrtuple (req, AF_INET, h, &res->at))
 +	    return -EAI_MEMORY;
 +
 +	  res->free_at = true;
 +	  return 0;
 +	}
 +      if (h_errno == NO_DATA)
 +	return -EAI_NODATA;
 +
 +      return -EAI_NONAME;
 +    }
 +
 +  if (h_errno == NETDB_INTERNAL)
 +    return -EAI_SYSTEM;
 +  if (h_errno == TRY_AGAIN)
 +    return -EAI_AGAIN;
 +
 +  /* We made requests but they turned out no data.
 +     The name is known, though.  */
 +  return -EAI_NODATA;
 +}
 +
 static int
 gaih_inet (const char *name, const struct gaih_service *service,
 	   const struct addrinfo *req, struct addrinfo **pai,
@@ -610,6 +667,11 @@ gaih_inet (const char *name, const struct gaih_service *service,
       else if (res.at != NULL)
 	goto process_list;
 +      if ((result = try_simple_gethostbyname (name, req, tmpbuf, &res)) != 0)
 +	goto free_and_return;
 +      else if (res.at != NULL)
 +	goto process_list;
 +
       int no_data = 0;
       int no_inet6_data = 0;
       nss_action_list nip;
@@ -619,69 +681,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
       struct resolv_context *res_ctx = NULL;
       bool do_merge = false;
 -      /* If we do not have to look for IPv6 addresses or the canonical
 -	 name, use the simple, old functions, which do not support
 -	 IPv6 scope ids, nor retrieving the canonical name.  */
 -      if (req->ai_family == AF_INET
 -	  && (req->ai_flags & AI_CANONNAME) == 0)
 -	{
 -	  int rc;
 -	  struct hostent th;
 -	  struct hostent *h;
 -
 -	  while (1)
 -	    {
 -	      rc = __gethostbyname2_r (name, AF_INET, &th,
 -				       tmpbuf->data, tmpbuf->length,
 -				       &h, &h_errno);
 -	      if (rc != ERANGE || h_errno != NETDB_INTERNAL)
 -		break;
 -	      if (!scratch_buffer_grow (tmpbuf))
 -		{
 -		  result = -EAI_MEMORY;
 -		  goto free_and_return;
 -		}
 -	    }
 -
 -	  if (rc == 0)
 -	    {
 -	      if (h != NULL)
 -		{
 -		  /* We found data, convert it.  */
 -		  if (!convert_hostent_to_gaih_addrtuple
 -		      (req, AF_INET, h, &addrmem))
 -		    {
 -		      result = -EAI_MEMORY;
 -		      goto free_and_return;
 -		    }
 -		  res.at = addrmem;
 -		}
 -	      else
 -		{
 -		  if (h_errno == NO_DATA)
 -		    result = -EAI_NODATA;
 -		  else
 -		    result = -EAI_NONAME;
 -		  goto free_and_return;
 -		}
 -	    }
 -	  else
 -	    {
 -	      if (h_errno == NETDB_INTERNAL)
 -		result = -EAI_SYSTEM;
 -	      else if (h_errno == TRY_AGAIN)
 -		result = -EAI_AGAIN;
 -	      else
 -		/* We made requests but they turned out no data.
 -		   The name is known, though.  */
 -		result = -EAI_NODATA;
 -
 -	      goto free_and_return;
 -	    }
 -
 -	  goto process_list;
 -	}
 -
 #ifdef USE_NSCD
       if (__nss_not_use_nscd_hosts > 0
 	  && ++__nss_not_use_nscd_hosts > NSS_NSCD_RETRY)
@@ -1165,6 +1164,8 @@ gaih_inet (const char *name, const struct gaih_service *service,
   if (malloc_name)
     free ((char *) name);
   free (addrmem);
 +  if (res.free_at)
 +    free (res.at);
   free (res.canon);
   return result;
--- a/SOURCES/glibc-RHEL-2425-8.patch
+++ b/SOURCES/glibc-RHEL-2425-8.patch
@ -0,0 +1,328 @@
 commit 5914a1d55b468ccf0fb6d997a7a4e378339df735
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Mon Mar 7 15:53:45 2022 +0530
    gaih_inet: Split nscd lookup code into its own function.
    Add a new member got_ipv6 to indicate if the results have an IPv6
    result and use it instead of the local got_ipv6.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit e7e5315b7fa065a9c8bf525ca9a32f46fa4837e5)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 3870b2dc2edc89cd..7c497a88f8b5b9f8 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -121,6 +121,7 @@ struct gaih_result
   struct gaih_addrtuple *at;
   char *canon;
   bool free_at;
 +  bool got_ipv6;
 };
 /* Values for `protoflag'.  */
@@ -316,7 +317,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
 	  res.canon = canonbuf;						      \
 	}								      \
       if (_family == AF_INET6 && *pat != NULL)				      \
 -	got_ipv6 = true;						      \
 +	res.got_ipv6 = true;						      \
     }									      \
  }
@@ -467,6 +468,128 @@ get_servtuples (const struct gaih_service *service, const struct addrinfo *req,
   return 0;
 }
 +#ifdef USE_NSCD
 +/* Query addresses from nscd cache, returning a non-zero value on error.
 +   RES members have the lookup result; RES->AT is NULL if there were no errors
 +   but also no results.  */
 +
 +static int
 +get_nscd_addresses (const char *name, const struct addrinfo *req,
 +		    struct gaih_result *res)
 +{
 +  if (__nss_not_use_nscd_hosts > 0
 +      && ++__nss_not_use_nscd_hosts > NSS_NSCD_RETRY)
 +    __nss_not_use_nscd_hosts = 0;
 +
 +  res->at = NULL;
 +
 +  if (__nss_not_use_nscd_hosts || __nss_database_custom[NSS_DBSIDX_hosts])
 +    return 0;
 +
 +  /* Try to use nscd.  */
 +  struct nscd_ai_result *air = NULL;
 +  int err = __nscd_getai (name, &air, &h_errno);
 +
 +  if (__glibc_unlikely (air == NULL))
 +    {
 +      /* The database contains a negative entry.  */
 +      if (err == 0)
 +	return -EAI_NONAME;
 +      if (__nss_not_use_nscd_hosts == 0)
 +	{
 +	  if (h_errno == NETDB_INTERNAL && errno == ENOMEM)
 +	    return -EAI_MEMORY;
 +	  if (h_errno == TRY_AGAIN)
 +	    return -EAI_AGAIN;
 +	  return -EAI_SYSTEM;
 +	}
 +      return 0;
 +    }
 +
 +  /* Transform into gaih_addrtuple list.  */
 +  int result = 0;
 +  char *addrs = air->addrs;
 +
 +  struct gaih_addrtuple *addrfree = calloc (air->naddrs, sizeof (*addrfree));
 +  struct gaih_addrtuple *at = calloc (air->naddrs, sizeof (*at));
 +  if (at == NULL)
 +    {
 +      result = -EAI_MEMORY;
 +      goto out;
 +    }
 +
 +  res->free_at = true;
 +
 +  int count = 0;
 +  for (int i = 0; i < air->naddrs; ++i)
 +    {
 +      socklen_t size = (air->family[i] == AF_INET
 +			? INADDRSZ : IN6ADDRSZ);
 +
 +      if (!((air->family[i] == AF_INET
 +	     && req->ai_family == AF_INET6
 +	     && (req->ai_flags & AI_V4MAPPED) != 0)
 +	    || req->ai_family == AF_UNSPEC
 +	    || air->family[i] == req->ai_family))
 +	{
 +	  /* Skip over non-matching result.  */
 +	  addrs += size;
 +	  continue;
 +	}
 +
 +      if (air->family[i] == AF_INET && req->ai_family == AF_INET6
 +	  && (req->ai_flags & AI_V4MAPPED))
 +	{
 +	  at[count].family = AF_INET6;
 +	  at[count].addr[3] = *(uint32_t *) addrs;
 +	  at[count].addr[2] = htonl (0xffff);
 +	}
 +      else if (req->ai_family == AF_UNSPEC
 +	       || air->family[count] == req->ai_family)
 +	{
 +	  at[count].family = air->family[count];
 +	  memcpy (at[count].addr, addrs, size);
 +	  if (air->family[count] == AF_INET6)
 +	    res->got_ipv6 = true;
 +	}
 +      at[count].next = at + count + 1;
 +      count++;
 +      addrs += size;
 +    }
 +
 +  if ((req->ai_flags & AI_CANONNAME) && air->canon != NULL)
 +    {
 +      char *canonbuf = __strdup (air->canon);
 +      if (canonbuf == NULL)
 +	{
 +	  result = -EAI_MEMORY;
 +	  goto out;
 +	}
 +      res->canon = canonbuf;
 +    }
 +
 +  if (count == 0)
 +    {
 +      result = -EAI_NONAME;
 +      goto out;
 +    }
 +
 +  at[count - 1].next = NULL;
 +
 +  res->at = at;
 +
 +out:
 +  free (air);
 +  if (result != 0)
 +    {
 +      free (at);
 +      res->free_at = false;
 +    }
 +
 +  return result;
 +}
 +#endif
 +
 /* Convert numeric addresses to binary into RES.  On failure, RES->AT is set to
    NULL and an error code is returned.  If AI_NUMERIC_HOST is not requested and
    the function cannot determine a result, RES->AT is set to NULL and 0
@@ -630,7 +753,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
   struct gaih_servtuple st[sizeof (gaih_inet_typeproto)
 			   / sizeof (struct gaih_typeproto)] = {0};
 -  bool got_ipv6 = false;
   const char *orig_name = name;
   /* Reserve stack memory for the scratch buffer in the getaddrinfo
@@ -672,6 +794,13 @@ gaih_inet (const char *name, const struct gaih_service *service,
       else if (res.at != NULL)
 	goto process_list;
 +#ifdef USE_NSCD
 +      if ((result = get_nscd_addresses (name, req, &res)) != 0)
 +	goto free_and_return;
 +      else if (res.at != NULL)
 +	goto process_list;
 +#endif
 +
       int no_data = 0;
       int no_inet6_data = 0;
       nss_action_list nip;
@@ -681,115 +810,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
       struct resolv_context *res_ctx = NULL;
       bool do_merge = false;
 -#ifdef USE_NSCD
 -      if (__nss_not_use_nscd_hosts > 0
 -	  && ++__nss_not_use_nscd_hosts > NSS_NSCD_RETRY)
 -	__nss_not_use_nscd_hosts = 0;
 -
 -      if (!__nss_not_use_nscd_hosts
 -	  && !__nss_database_custom[NSS_DBSIDX_hosts])
 -	{
 -	  /* Try to use nscd.  */
 -	  struct nscd_ai_result *air = NULL;
 -	  int err = __nscd_getai (name, &air, &h_errno);
 -	  if (air != NULL)
 -	    {
 -	      /* Transform into gaih_addrtuple list.  */
 -	      bool added_canon = (req->ai_flags & AI_CANONNAME) == 0;
 -	      char *addrs = air->addrs;
 -
 -	      addrmem = calloc (air->naddrs, sizeof (*addrmem));
 -	      if (addrmem == NULL)
 -		{
 -		  result = -EAI_MEMORY;
 -		  goto free_and_return;
 -		}
 -
 -	      struct gaih_addrtuple *addrfree = addrmem;
 -	      struct gaih_addrtuple **pat = &res.at;
 -
 -	      for (int i = 0; i < air->naddrs; ++i)
 -		{
 -		  socklen_t size = (air->family[i] == AF_INET
 -				    ? INADDRSZ : IN6ADDRSZ);
 -
 -		  if (!((air->family[i] == AF_INET
 -			 && req->ai_family == AF_INET6
 -			 && (req->ai_flags & AI_V4MAPPED) != 0)
 -			|| req->ai_family == AF_UNSPEC
 -			|| air->family[i] == req->ai_family))
 -		    {
 -		      /* Skip over non-matching result.  */
 -		      addrs += size;
 -		      continue;
 -		    }
 -
 -		  if (*pat == NULL)
 -		    {
 -		      *pat = addrfree++;
 -		      (*pat)->scopeid = 0;
 -		    }
 -		  uint32_t *pataddr = (*pat)->addr;
 -		  (*pat)->next = NULL;
 -		  if (added_canon || air->canon == NULL)
 -		    (*pat)->name = NULL;
 -		  else if (res.canon == NULL)
 -		    {
 -		      char *canonbuf = __strdup (air->canon);
 -		      if (canonbuf == NULL)
 -			{
 -			  result = -EAI_MEMORY;
 -			  goto free_and_return;
 -			}
 -		      res.canon = (*pat)->name = canonbuf;
 -		    }
 -
 -		  if (air->family[i] == AF_INET
 -		      && req->ai_family == AF_INET6
 -		      && (req->ai_flags & AI_V4MAPPED))
 -		    {
 -		      (*pat)->family = AF_INET6;
 -		      pataddr[3] = *(uint32_t *) addrs;
 -		      pataddr[2] = htonl (0xffff);
 -		      pataddr[1] = 0;
 -		      pataddr[0] = 0;
 -		      pat = &((*pat)->next);
 -		      added_canon = true;
 -		    }
 -		  else if (req->ai_family == AF_UNSPEC
 -			   || air->family[i] == req->ai_family)
 -		    {
 -		      (*pat)->family = air->family[i];
 -		      memcpy (pataddr, addrs, size);
 -		      pat = &((*pat)->next);
 -		      added_canon = true;
 -		      if (air->family[i] == AF_INET6)
 -			got_ipv6 = true;
 -		    }
 -		  addrs += size;
 -		}
 -
 -	      free (air);
 -
 -	      goto process_list;
 -	    }
 -	  else if (err == 0)
 -	    /* The database contains a negative entry.  */
 -	    goto free_and_return;
 -	  else if (__nss_not_use_nscd_hosts == 0)
 -	    {
 -	      if (h_errno == NETDB_INTERNAL && errno == ENOMEM)
 -		result = -EAI_MEMORY;
 -	      else if (h_errno == TRY_AGAIN)
 -		result = -EAI_AGAIN;
 -	      else
 -		result = -EAI_SYSTEM;
 -
 -	      goto free_and_return;
 -	    }
 -	}
 -#endif
 -
       no_more = !__nss_database_get (nss_database_hosts, &nip);
       /* If we are looking for both IPv4 and IPv6 address we don't
@@ -897,7 +917,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 			  no_data = 0;
 			  if (req->ai_family == AF_INET6)
 -			    got_ipv6 = true;
 +			    res.got_ipv6 = true;
 			}
 		      else
 			*pat = ((*pat)->next);
@@ -940,7 +960,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 			  && (req->ai_flags & AI_V4MAPPED)
 			  /* Avoid generating the mapped addresses if we
 			     know we are not going to need them.  */
 -			  && ((req->ai_flags & AI_ALL) || !got_ipv6)))
 +			  && ((req->ai_flags & AI_ALL) || !res.got_ipv6)))
 		    {
 		      gethosts (AF_INET);
@@ -1091,7 +1111,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	    /* If we looked up IPv4 mapped address discard them here if
 	       the caller isn't interested in all address and we have
 	       found at least one IPv6 address.  */
 -	    if (got_ipv6
 +	    if (res.got_ipv6
 		&& (req->ai_flags & (AI_V4MAPPED|AI_ALL)) == AI_V4MAPPED
 		&& IN6_IS_ADDR_V4MAPPED (at2->addr))
 	      goto ignore;
--- a/SOURCES/glibc-RHEL-2425-9.patch
+++ b/SOURCES/glibc-RHEL-2425-9.patch
@ -0,0 +1,673 @@
 commit ec71cb961121760f81e55af5489e658dc89e96e6
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Mon Mar 7 15:56:22 2022 +0530
    gaih_inet: separate nss lookup loop into its own function
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
    (cherry picked from commit 906cecbe0889e601c91d9aba738049c73ebe4dd2)
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 7c497a88f8b5b9f8..145ea6fa381ad14b 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -159,6 +159,14 @@ static const struct addrinfo default_hints =
     .ai_next = NULL
   };
 +static void
 +gaih_result_reset (struct gaih_result *res)
 +{
 +  if (res->free_at)
 +    free (res->at);
 +  free (res->canon);
 +  memset (res, 0, sizeof (*res));
 +}
 static int
 gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
@@ -197,13 +205,10 @@ gaih_inet_serv (const char *servicename, const struct gaih_typeproto *tp,
 /* Convert struct hostent to a list of struct gaih_addrtuple objects.  h_name
    is not copied, and the struct hostent object must not be deallocated
 -   prematurely.  The new addresses are appended to the tuple array in
 -   RESULT.  */
 +   prematurely.  The new addresses are appended to the tuple array in RES.  */
 static bool
 -convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
 -				   int family,
 -				   struct hostent *h,
 -				   struct gaih_addrtuple **result)
 +convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
 +				   struct hostent *h, struct gaih_result *res)
 {
   /* Count the number of addresses in h->h_addr_list.  */
   size_t count = 0;
@@ -215,7 +220,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
   if (count == 0 || h->h_length > sizeof (((struct gaih_addrtuple) {}).addr))
     return true;
 -  struct gaih_addrtuple *array = *result;
 +  struct gaih_addrtuple *array = res->at;
   size_t old = 0;
   while (array != NULL)
@@ -224,12 +229,14 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
       array = array->next;
     }
 -  array = realloc (*result, (old + count) * sizeof (*array));
 +  array = realloc (res->at, (old + count) * sizeof (*array));
   if (array == NULL)
     return false;
 -  *result = array;
 +  res->got_ipv6 = family == AF_INET6;
 +  res->at = array;
 +  res->free_at = true;
   /* Update the next pointers on reallocation.  */
   for (size_t i = 0; i < old; i++)
@@ -278,7 +285,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
 	{								      \
 	  __resolv_context_put (res_ctx);				      \
 	  result = -EAI_MEMORY;						      \
 -	  goto free_and_return;						      \
 +	  goto out;							      \
 	}								      \
     }									      \
   if (status == NSS_STATUS_NOTFOUND					      \
@@ -288,7 +295,7 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
 	{								      \
 	  __resolv_context_put (res_ctx);				      \
 	  result = -EAI_SYSTEM;						      \
 -	  goto free_and_return;						      \
 +	  goto out;							      \
 	}								      \
       if (h_errno == TRY_AGAIN)						      \
 	no_data = EAI_AGAIN;						      \
@@ -297,27 +304,24 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo *req,
     }									      \
   else if (status == NSS_STATUS_SUCCESS)				      \
     {									      \
 -      if (!convert_hostent_to_gaih_addrtuple (req, _family, &th, &addrmem))   \
 +      if (!convert_hostent_to_gaih_addrtuple (req, _family, &th, res))	      \
 	{								      \
 	  __resolv_context_put (res_ctx);				      \
 	  result = -EAI_SYSTEM;						      \
 -	  goto free_and_return;						      \
 +	  goto out;							      \
 	}								      \
 -      *pat = addrmem;							      \
 									      \
 -      if (localcanon != NULL && res.canon == NULL)			      \
 +      if (localcanon != NULL && res->canon == NULL)			      \
 	{								      \
 	  char *canonbuf = __strdup (localcanon);			      \
 	  if (canonbuf == NULL)						      \
 	    {								      \
 	      __resolv_context_put (res_ctx);				      \
 	      result = -EAI_SYSTEM;					      \
 -	      goto free_and_return;					      \
 +	      goto out;							      \
 	    }								      \
 -	  res.canon = canonbuf;						      \
 +	  res->canon = canonbuf;					      \
 	}								      \
 -      if (_family == AF_INET6 && *pat != NULL)				      \
 -	res.got_ipv6 = true;						      \
     }									      \
  }
@@ -590,6 +594,260 @@ out:
 }
 #endif
 +static int
 +get_nss_addresses (const char *name, const struct addrinfo *req,
 +		   struct scratch_buffer *tmpbuf, struct gaih_result *res)
 +{
 +  int no_data = 0;
 +  int no_inet6_data = 0;
 +  nss_action_list nip;
 +  enum nss_status inet6_status = NSS_STATUS_UNAVAIL;
 +  enum nss_status status = NSS_STATUS_UNAVAIL;
 +  int no_more;
 +  struct resolv_context *res_ctx = NULL;
 +  bool do_merge = false;
 +  int result = 0;
 +
 +  no_more = !__nss_database_get (nss_database_hosts, &nip);
 +
 +  /* If we are looking for both IPv4 and IPv6 address we don't
 +     want the lookup functions to automatically promote IPv4
 +     addresses to IPv6 addresses, so we use the no_inet6
 +     function variant.  */
 +  res_ctx = __resolv_context_get ();
 +  if (res_ctx == NULL)
 +    no_more = 1;
 +
 +  while (!no_more)
 +    {
 +      /* Always start afresh; continue should discard previous results
 +	 and the hosts database does not support merge.  */
 +      gaih_result_reset (res);
 +
 +      if (do_merge)
 +	{
 +	  __set_h_errno (NETDB_INTERNAL);
 +	  __set_errno (EBUSY);
 +	  break;
 +	}
 +
 +      no_data = 0;
 +      nss_gethostbyname4_r *fct4 = NULL;
 +
 +      /* gethostbyname4_r sends out parallel A and AAAA queries and
 +	 is thus only suitable for PF_UNSPEC.  */
 +      if (req->ai_family == PF_UNSPEC)
 +	fct4 = __nss_lookup_function (nip, "gethostbyname4_r");
 +
 +      if (fct4 != NULL)
 +	{
 +	  while (1)
 +	    {
 +	      status = DL_CALL_FCT (fct4, (name, &res->at,
 +					   tmpbuf->data, tmpbuf->length,
 +					   &errno, &h_errno,
 +					   NULL));
 +	      if (status == NSS_STATUS_SUCCESS)
 +		break;
 +	      /* gethostbyname4_r may write into AT, so reset it.  */
 +	      res->at = NULL;
 +	      if (status != NSS_STATUS_TRYAGAIN
 +		  || errno != ERANGE || h_errno != NETDB_INTERNAL)
 +		{
 +		  if (h_errno == TRY_AGAIN)
 +		    no_data = EAI_AGAIN;
 +		  else
 +		    no_data = h_errno == NO_DATA;
 +		  break;
 +		}
 +
 +	      if (!scratch_buffer_grow (tmpbuf))
 +		{
 +		  __resolv_context_put (res_ctx);
 +		  result = -EAI_MEMORY;
 +		  goto out;
 +		}
 +	    }
 +
 +	  if (status == NSS_STATUS_SUCCESS)
 +	    {
 +	      assert (!no_data);
 +	      no_data = 1;
 +
 +	      if ((req->ai_flags & AI_CANONNAME) != 0 && res->canon == NULL)
 +		{
 +		  char *canonbuf = __strdup (res->at->name);
 +		  if (canonbuf == NULL)
 +		    {
 +		      __resolv_context_put (res_ctx);
 +		      result = -EAI_MEMORY;
 +		      goto out;
 +		    }
 +		  res->canon = canonbuf;
 +		}
 +
 +	      struct gaih_addrtuple **pat = &res->at;
 +
 +	      while (*pat != NULL)
 +		{
 +		  if ((*pat)->family == AF_INET
 +		      && req->ai_family == AF_INET6
 +		      && (req->ai_flags & AI_V4MAPPED) != 0)
 +		    {
 +		      uint32_t *pataddr = (*pat)->addr;
 +		      (*pat)->family = AF_INET6;
 +		      pataddr[3] = pataddr[0];
 +		      pataddr[2] = htonl (0xffff);
 +		      pataddr[1] = 0;
 +		      pataddr[0] = 0;
 +		      pat = &((*pat)->next);
 +		      no_data = 0;
 +		    }
 +		  else if (req->ai_family == AF_UNSPEC
 +			   || (*pat)->family == req->ai_family)
 +		    {
 +		      pat = &((*pat)->next);
 +
 +		      no_data = 0;
 +		      if (req->ai_family == AF_INET6)
 +			res->got_ipv6 = true;
 +		    }
 +		  else
 +		    *pat = ((*pat)->next);
 +		}
 +	    }
 +
 +	  no_inet6_data = no_data;
 +	}
 +      else
 +	{
 +	  nss_gethostbyname3_r *fct = NULL;
 +	  if (req->ai_flags & AI_CANONNAME)
 +	    /* No need to use this function if we do not look for
 +	       the canonical name.  The function does not exist in
 +	       all NSS modules and therefore the lookup would
 +	       often fail.  */
 +	    fct = __nss_lookup_function (nip, "gethostbyname3_r");
 +	  if (fct == NULL)
 +	    /* We are cheating here.  The gethostbyname2_r
 +	       function does not have the same interface as
 +	       gethostbyname3_r but the extra arguments the
 +	       latter takes are added at the end.  So the
 +	       gethostbyname2_r code will just ignore them.  */
 +	    fct = __nss_lookup_function (nip, "gethostbyname2_r");
 +
 +	  if (fct != NULL)
 +	    {
 +	      if (req->ai_family == AF_INET6
 +		  || req->ai_family == AF_UNSPEC)
 +		{
 +		  gethosts (AF_INET6);
 +		  no_inet6_data = no_data;
 +		  inet6_status = status;
 +		}
 +	      if (req->ai_family == AF_INET
 +		  || req->ai_family == AF_UNSPEC
 +		  || (req->ai_family == AF_INET6
 +		      && (req->ai_flags & AI_V4MAPPED)
 +		      /* Avoid generating the mapped addresses if we
 +			 know we are not going to need them.  */
 +		      && ((req->ai_flags & AI_ALL) || !res->got_ipv6)))
 +		{
 +		  gethosts (AF_INET);
 +
 +		  if (req->ai_family == AF_INET)
 +		    {
 +		      no_inet6_data = no_data;
 +		      inet6_status = status;
 +		    }
 +		}
 +
 +	      /* If we found one address for AF_INET or AF_INET6,
 +		 don't continue the search.  */
 +	      if (inet6_status == NSS_STATUS_SUCCESS
 +		  || status == NSS_STATUS_SUCCESS)
 +		{
 +		  if ((req->ai_flags & AI_CANONNAME) != 0
 +		      && res->canon == NULL)
 +		    {
 +		      char *canonbuf = getcanonname (nip, res->at, name);
 +		      if (canonbuf == NULL)
 +			{
 +			  __resolv_context_put (res_ctx);
 +			  result = -EAI_MEMORY;
 +			  goto out;
 +			}
 +		      res->canon = canonbuf;
 +		    }
 +		  status = NSS_STATUS_SUCCESS;
 +		}
 +	      else
 +		{
 +		  /* We can have different states for AF_INET and
 +		     AF_INET6.  Try to find a useful one for both.  */
 +		  if (inet6_status == NSS_STATUS_TRYAGAIN)
 +		    status = NSS_STATUS_TRYAGAIN;
 +		  else if (status == NSS_STATUS_UNAVAIL
 +			   && inet6_status != NSS_STATUS_UNAVAIL)
 +		    status = inet6_status;
 +		}
 +	    }
 +	  else
 +	    {
 +	      /* Could not locate any of the lookup functions.
 +		 The NSS lookup code does not consistently set
 +		 errno, so we need to supply our own error
 +		 code here.  The root cause could either be a
 +		 resource allocation failure, or a missing
 +		 service function in the DSO (so it should not
 +		 be listed in /etc/nsswitch.conf).  Assume the
 +		 former, and return EBUSY.  */
 +	      status = NSS_STATUS_UNAVAIL;
 +	      __set_h_errno (NETDB_INTERNAL);
 +	      __set_errno (EBUSY);
 +	    }
 +	}
 +
 +      if (nss_next_action (nip, status) == NSS_ACTION_RETURN)
 +	break;
 +
 +      /* The hosts database does not support MERGE.  */
 +      if (nss_next_action (nip, status) == NSS_ACTION_MERGE)
 +	do_merge = true;
 +
 +      nip++;
 +      if (nip->module == NULL)
 +	no_more = -1;
 +    }
 +
 +  __resolv_context_put (res_ctx);
 +
 +  /* If we have a failure which sets errno, report it using
 +     EAI_SYSTEM.  */
 +  if ((status == NSS_STATUS_TRYAGAIN || status == NSS_STATUS_UNAVAIL)
 +      && h_errno == NETDB_INTERNAL)
 +    {
 +      result = -EAI_SYSTEM;
 +      goto out;
 +    }
 +
 +  if (no_data != 0 && no_inet6_data != 0)
 +    {
 +      /* If both requests timed out report this.  */
 +      if (no_data == EAI_AGAIN && no_inet6_data == EAI_AGAIN)
 +	result = -EAI_AGAIN;
 +      else
 +	/* We made requests but they turned out no data.  The name
 +	   is known, though.  */
 +	result = -EAI_NODATA;
 +    }
 +
 +out:
 +  if (result != 0)
 +    gaih_result_reset (res);
 +  return result;
 +}
 +
 /* Convert numeric addresses to binary into RES.  On failure, RES->AT is set to
    NULL and an error code is returned.  If AI_NUMERIC_HOST is not requested and
    the function cannot determine a result, RES->AT is set to NULL and 0
@@ -723,7 +981,7 @@ try_simple_gethostbyname (const char *name, const struct addrinfo *req,
 	  /* We found data, convert it.  RES->AT from the conversion will
 	     either be an allocated block or NULL, both of which are safe to
 	     pass to free ().  */
 -	  if (!convert_hostent_to_gaih_addrtuple (req, AF_INET, h, &res->at))
 +	  if (!convert_hostent_to_gaih_addrtuple (req, AF_INET, h, res))
 	    return -EAI_MEMORY;
 	  res->free_at = true;
@@ -801,264 +1059,14 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	goto process_list;
 #endif
 -      int no_data = 0;
 -      int no_inet6_data = 0;
 -      nss_action_list nip;
 -      enum nss_status inet6_status = NSS_STATUS_UNAVAIL;
 -      enum nss_status status = NSS_STATUS_UNAVAIL;
 -      int no_more;
 -      struct resolv_context *res_ctx = NULL;
 -      bool do_merge = false;
 -
 -      no_more = !__nss_database_get (nss_database_hosts, &nip);
 -
 -      /* If we are looking for both IPv4 and IPv6 address we don't
 -	 want the lookup functions to automatically promote IPv4
 -	 addresses to IPv6 addresses, so we use the no_inet6
 -	 function variant.  */
 -      res_ctx = __resolv_context_get ();
 -      if (res_ctx == NULL)
 -	no_more = 1;
 -
 -      while (!no_more)
 -	{
 -	  /* Always start afresh; continue should discard previous results
 -	     and the hosts database does not support merge.  */
 -	  res.at = NULL;
 -	  free (res.canon);
 -	  free (addrmem);
 -	  res.canon = NULL;
 -	  addrmem = NULL;
 -	  got_ipv6 = false;
 -
 -	  if (do_merge)
 -	    {
 -	      __set_h_errno (NETDB_INTERNAL);
 -	      __set_errno (EBUSY);
 -	      break;
 -	    }
 -
 -	  no_data = 0;
 -	  nss_gethostbyname4_r *fct4 = NULL;
 -
 -	  /* gethostbyname4_r sends out parallel A and AAAA queries and
 -	     is thus only suitable for PF_UNSPEC.  */
 -	  if (req->ai_family == PF_UNSPEC)
 -	    fct4 = __nss_lookup_function (nip, "gethostbyname4_r");
 -
 -	  if (fct4 != NULL)
 -	    {
 -	      while (1)
 -		{
 -		  status = DL_CALL_FCT (fct4, (name, &res.at,
 -					       tmpbuf->data, tmpbuf->length,
 -					       &errno, &h_errno,
 -					       NULL));
 -		  if (status == NSS_STATUS_SUCCESS)
 -		    break;
 -		  /* gethostbyname4_r may write into AT, so reset it.  */
 -		  res.at = NULL;
 -		  if (status != NSS_STATUS_TRYAGAIN
 -		      || errno != ERANGE || h_errno != NETDB_INTERNAL)
 -		    {
 -		      if (h_errno == TRY_AGAIN)
 -			no_data = EAI_AGAIN;
 -		      else
 -			no_data = h_errno == NO_DATA;
 -		      break;
 -		    }
 -
 -		  if (!scratch_buffer_grow (tmpbuf))
 -		    {
 -		      __resolv_context_put (res_ctx);
 -		      result = -EAI_MEMORY;
 -		      goto free_and_return;
 -		    }
 -		}
 -
 -	      if (status == NSS_STATUS_SUCCESS)
 -		{
 -		  assert (!no_data);
 -		  no_data = 1;
 -
 -		  if ((req->ai_flags & AI_CANONNAME) != 0 && res.canon == NULL)
 -		    {
 -		      char *canonbuf = __strdup (res.at->name);
 -		      if (canonbuf == NULL)
 -			{
 -			  __resolv_context_put (res_ctx);
 -			  result = -EAI_MEMORY;
 -			  goto free_and_return;
 -			}
 -		      res.canon = canonbuf;
 -		    }
 -
 -		  struct gaih_addrtuple **pat = &res.at;
 -
 -		  while (*pat != NULL)
 -		    {
 -		      if ((*pat)->family == AF_INET
 -			  && req->ai_family == AF_INET6
 -			  && (req->ai_flags & AI_V4MAPPED) != 0)
 -			{
 -			  uint32_t *pataddr = (*pat)->addr;
 -			  (*pat)->family = AF_INET6;
 -			  pataddr[3] = pataddr[0];
 -			  pataddr[2] = htonl (0xffff);
 -			  pataddr[1] = 0;
 -			  pataddr[0] = 0;
 -			  pat = &((*pat)->next);
 -			  no_data = 0;
 -			}
 -		      else if (req->ai_family == AF_UNSPEC
 -			       || (*pat)->family == req->ai_family)
 -			{
 -			  pat = &((*pat)->next);
 -
 -			  no_data = 0;
 -			  if (req->ai_family == AF_INET6)
 -			    res.got_ipv6 = true;
 -			}
 -		      else
 -			*pat = ((*pat)->next);
 -		    }
 -		}
 -
 -	      no_inet6_data = no_data;
 -	    }
 -	  else
 -	    {
 -	      nss_gethostbyname3_r *fct = NULL;
 -	      if (req->ai_flags & AI_CANONNAME)
 -		/* No need to use this function if we do not look for
 -		   the canonical name.  The function does not exist in
 -		   all NSS modules and therefore the lookup would
 -		   often fail.  */
 -		fct = __nss_lookup_function (nip, "gethostbyname3_r");
 -	      if (fct == NULL)
 -		/* We are cheating here.  The gethostbyname2_r
 -		   function does not have the same interface as
 -		   gethostbyname3_r but the extra arguments the
 -		   latter takes are added at the end.  So the
 -		   gethostbyname2_r code will just ignore them.  */
 -		fct = __nss_lookup_function (nip, "gethostbyname2_r");
 -
 -	      if (fct != NULL)
 -		{
 -		  struct gaih_addrtuple **pat = &res.at;
 -
 -		  if (req->ai_family == AF_INET6
 -		      || req->ai_family == AF_UNSPEC)
 -		    {
 -		      gethosts (AF_INET6);
 -		      no_inet6_data = no_data;
 -		      inet6_status = status;
 -		    }
 -		  if (req->ai_family == AF_INET
 -		      || req->ai_family == AF_UNSPEC
 -		      || (req->ai_family == AF_INET6
 -			  && (req->ai_flags & AI_V4MAPPED)
 -			  /* Avoid generating the mapped addresses if we
 -			     know we are not going to need them.  */
 -			  && ((req->ai_flags & AI_ALL) || !res.got_ipv6)))
 -		    {
 -		      gethosts (AF_INET);
 -
 -		      if (req->ai_family == AF_INET)
 -			{
 -			  no_inet6_data = no_data;
 -			  inet6_status = status;
 -			}
 -		    }
 -
 -		  /* If we found one address for AF_INET or AF_INET6,
 -		     don't continue the search.  */
 -		  if (inet6_status == NSS_STATUS_SUCCESS
 -		      || status == NSS_STATUS_SUCCESS)
 -		    {
 -		      if ((req->ai_flags & AI_CANONNAME) != 0
 -			  && res.canon == NULL)
 -			{
 -			  char *canonbuf = getcanonname (nip, res.at, name);
 -			  if (canonbuf == NULL)
 -			    {
 -			      __resolv_context_put (res_ctx);
 -			      result = -EAI_MEMORY;
 -			      goto free_and_return;
 -			    }
 -			  res.canon = canonbuf;
 -			}
 -		      status = NSS_STATUS_SUCCESS;
 -		    }
 -		  else
 -		    {
 -		      /* We can have different states for AF_INET and
 -			 AF_INET6.  Try to find a useful one for both.  */
 -		      if (inet6_status == NSS_STATUS_TRYAGAIN)
 -			status = NSS_STATUS_TRYAGAIN;
 -		      else if (status == NSS_STATUS_UNAVAIL
 -			       && inet6_status != NSS_STATUS_UNAVAIL)
 -			status = inet6_status;
 -		    }
 -		}
 -	      else
 -		{
 -		  /* Could not locate any of the lookup functions.
 -		     The NSS lookup code does not consistently set
 -		     errno, so we need to supply our own error
 -		     code here.  The root cause could either be a
 -		     resource allocation failure, or a missing
 -		     service function in the DSO (so it should not
 -		     be listed in /etc/nsswitch.conf).  Assume the
 -		     former, and return EBUSY.  */
 -		  status = NSS_STATUS_UNAVAIL;
 -		  __set_h_errno (NETDB_INTERNAL);
 -		  __set_errno (EBUSY);
 -		}
 -	    }
 -
 -	  if (nss_next_action (nip, status) == NSS_ACTION_RETURN)
 -	    break;
 -
 -	  /* The hosts database does not support MERGE.  */
 -	  if (nss_next_action (nip, status) == NSS_ACTION_MERGE)
 -	    do_merge = true;
 -
 -	  nip++;
 -	  if (nip->module == NULL)
 -	    no_more = -1;
 -	}
 -
 -      __resolv_context_put (res_ctx);
 -
 -      /* If we have a failure which sets errno, report it using
 -	 EAI_SYSTEM.  */
 -      if ((status == NSS_STATUS_TRYAGAIN || status == NSS_STATUS_UNAVAIL)
 -	  && h_errno == NETDB_INTERNAL)
 -	{
 -	  result = -EAI_SYSTEM;
 -	  goto free_and_return;
 -	}
 -
 -      if (no_data != 0 && no_inet6_data != 0)
 -	{
 -	  /* If both requests timed out report this.  */
 -	  if (no_data == EAI_AGAIN && no_inet6_data == EAI_AGAIN)
 -	    result = -EAI_AGAIN;
 -	  else
 -	    /* We made requests but they turned out no data.  The name
 -	       is known, though.  */
 -	    result = -EAI_NODATA;
 -
 -	  goto free_and_return;
 -	}
 +      if ((result = get_nss_addresses (name, req, tmpbuf, &res)) != 0)
 +	goto free_and_return;
 +      else if (res.at != NULL)
 +	goto process_list;
 -    process_list:
 -      if (res.at == NULL)
 -	{
 -	  result = -EAI_NONAME;
 -	  goto free_and_return;
 -	}
 +      /* None of the lookups worked, so name not found.  */
 +      result = -EAI_NONAME;
 +      goto free_and_return;
     }
   else
     {
@@ -1089,6 +1097,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	}
     }
 +process_list:
   {
     /* Set up the canonical name if we need it.  */
     if ((result = process_canonname (req, orig_name, &res)) != 0)
--- a/SOURCES/glibc-RHEL-2437.patch
+++ b/SOURCES/glibc-RHEL-2437.patch
@ -0,0 +1,973 @@
 commit 1c37b8022e8763fedbb3f79c02e05c6acfe5a215
 Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
 Date:   Thu Mar 17 11:44:34 2022 +0530
    Simplify allocations and fix merge and continue actions [BZ #28931]
    Allocations for address tuples is currently a bit confusing because of
    the pointer chasing through PAT, making it hard to observe the sequence
    in which allocations have been made.  Narrow scope of the pointer
    chasing through PAT so that it is only used where necessary.
    This also tightens actions behaviour with the hosts database in
    getaddrinfo to comply with the manual text.  The "continue" action
    discards previous results and the "merge" action results in an immedate
    lookup failure.  Consequently, chaining of allocations across modules is
    no longer necessary, thus opening up cleanup opportunities.
    A test has been added that checks some combinations to ensure that they
    work correctly.
    Resolves: BZ #28931
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: DJ Delorie <dj@redhat.com>
 Conflicts:
 	nss/Makefile
 	(Missing tests)
 diff --git a/nss/Makefile b/nss/Makefile
 index 716bc8f6ef5276b0..beb30ac2667fe998 100644
 --- a/nss/Makefile
 +++ b/nss/Makefile
@@ -70,6 +70,7 @@ tests-container = \
 			  tst-nss-files-hosts-long \
 			  tst-nss-db-endpwent \
 			  tst-nss-db-endgrent \
 +			  tst-nss-gai-actions \
 			  tst-reload1 tst-reload2
 # Tests which need libdl
 diff --git a/nss/tst-nss-gai-actions.c b/nss/tst-nss-gai-actions.c
 new file mode 100644
 index 0000000000000000..efca6cd1837a172a
 --- /dev/null
 +++ b/nss/tst-nss-gai-actions.c
@@ -0,0 +1,149 @@
 +/* Test continue and merge NSS actions for getaddrinfo.
 +   Copyright The GNU Toolchain Authors.
 +   This file is part of the GNU C Library.
 +
 +   The GNU C Library is free software; you can redistribute it and/or
 +   modify it under the terms of the GNU Lesser General Public
 +   License as published by the Free Software Foundation; either
 +   version 2.1 of the License, or (at your option) any later version.
 +
 +   The GNU C Library is distributed in the hope that it will be useful,
 +   but WITHOUT ANY WARRANTY; without even the implied warranty of
 +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +   Lesser General Public License for more details.
 +
 +   You should have received a copy of the GNU Lesser General Public
 +   License along with the GNU C Library; if not, see
 +   <https://www.gnu.org/licenses/>.  */
 +
 +#include <dlfcn.h>
 +#include <gnu/lib-names.h>
 +#include <nss.h>
 +#include <stdio.h>
 +#include <stdlib.h>
 +#include <string.h>
 +
 +#include <support/check.h>
 +#include <support/format_nss.h>
 +#include <support/support.h>
 +#include <support/xstdio.h>
 +#include <support/xunistd.h>
 +
 +enum
 +{
 +  ACTION_MERGE = 0,
 +  ACTION_CONTINUE,
 +};
 +
 +static const char *
 +family_str (int family)
 +{
 +  switch (family)
 +    {
 +    case AF_UNSPEC:
 +      return "AF_UNSPEC";
 +    case AF_INET:
 +      return "AF_INET";
 +    default:
 +      __builtin_unreachable ();
 +    }
 +}
 +
 +static const char *
 +action_str (int action)
 +{
 +  switch (action)
 +    {
 +    case ACTION_MERGE:
 +      return "merge";
 +    case ACTION_CONTINUE:
 +      return "continue";
 +    default:
 +      __builtin_unreachable ();
 +    }
 +}
 +
 +static void
 +do_one_test (int action, int family, bool canon)
 +{
 +  struct addrinfo hints =
 +    {
 +      .ai_family = family,
 +    };
 +
 +  struct addrinfo *ai;
 +
 +  if (canon)
 +    hints.ai_flags = AI_CANONNAME;
 +
 +  printf ("***** Testing \"files [SUCCESS=%s] files\" for family %s, %s\n",
 +	  action_str (action), family_str (family),
 +	  canon ? "AI_CANONNAME" : "");
 +
 +  int ret = getaddrinfo ("example.org", "80", &hints, &ai);
 +
 +  switch (action)
 +    {
 +    case ACTION_MERGE:
 +      if (ret == 0)
 +	{
 +	  char *formatted = support_format_addrinfo (ai, ret);
 +
 +	  printf ("merge unexpectedly succeeded:\n %s\n", formatted);
 +	  support_record_failure ();
 +	  free (formatted);
 +	}
 +      else
 +	return;
 +    case ACTION_CONTINUE:
 +	{
 +	  char *formatted = support_format_addrinfo (ai, ret);
 +
 +	  /* Verify that the result appears exactly once.  */
 +	  const char *expected = "address: STREAM/TCP 192.0.0.1 80\n"
 +	    "address: DGRAM/UDP 192.0.0.1 80\n"
 +	    "address: RAW/IP 192.0.0.1 80\n";
 +
 +	  const char *contains = strstr (formatted, expected);
 +	  const char *contains2 = NULL;
 +
 +	  if (contains != NULL)
 +	    contains2 = strstr (contains + strlen (expected), expected);
 +
 +	  if (contains == NULL || contains2 != NULL)
 +	    {
 +	      printf ("continue failed:\n%s\n", formatted);
 +	      support_record_failure ();
 +	    }
 +
 +	  free (formatted);
 +	  break;
 +	}
 +    default:
 +      __builtin_unreachable ();
 +    }
 +}
 +
 +static void
 +do_one_test_set (int action)
 +{
 +  char buf[32];
 +
 +  snprintf (buf, sizeof (buf), "files [SUCCESS=%s] files",
 +	    action_str (action));
 +  __nss_configure_lookup ("hosts", buf);
 +
 +  do_one_test (action, AF_UNSPEC, false);
 +  do_one_test (action, AF_INET, false);
 +  do_one_test (action, AF_INET, true);
 +}
 +
 +static int
 +do_test (void)
 +{
 +  do_one_test_set (ACTION_CONTINUE);
 +  do_one_test_set (ACTION_MERGE);
 +  return 0;
 +}
 +
 +#include <support/test-driver.c>
 diff --git a/nss/tst-nss-gai-actions.root/etc/host.conf b/nss/tst-nss-gai-actions.root/etc/host.conf
 new file mode 100644
 index 0000000000000000..d1a59f73a90f2993
 --- /dev/null
 +++ b/nss/tst-nss-gai-actions.root/etc/host.conf
@@ -0,0 +1 @@
 +multi on
 diff --git a/nss/tst-nss-gai-actions.root/etc/hosts b/nss/tst-nss-gai-actions.root/etc/hosts
 new file mode 100644
 index 0000000000000000..50ce9774dc2c21d9
 --- /dev/null
 +++ b/nss/tst-nss-gai-actions.root/etc/hosts
@@ -0,0 +1,508 @@
 +192.0.0.1	example.org
 +192.0.0.2	example.org
 +192.0.0.3	example.org
 +192.0.0.4	example.org
 +192.0.0.5	example.org
 +192.0.0.6	example.org
 +192.0.0.7	example.org
 +192.0.0.8	example.org
 +192.0.0.9	example.org
 +192.0.0.10	example.org
 +192.0.0.11	example.org
 +192.0.0.12	example.org
 +192.0.0.13	example.org
 +192.0.0.14	example.org
 +192.0.0.15	example.org
 +192.0.0.16	example.org
 +192.0.0.17	example.org
 +192.0.0.18	example.org
 +192.0.0.19	example.org
 +192.0.0.20	example.org
 +192.0.0.21	example.org
 +192.0.0.22	example.org
 +192.0.0.23	example.org
 +192.0.0.24	example.org
 +192.0.0.25	example.org
 +192.0.0.26	example.org
 +192.0.0.27	example.org
 +192.0.0.28	example.org
 +192.0.0.29	example.org
 +192.0.0.30	example.org
 +192.0.0.31	example.org
 +192.0.0.32	example.org
 +192.0.0.33	example.org
 +192.0.0.34	example.org
 +192.0.0.35	example.org
 +192.0.0.36	example.org
 +192.0.0.37	example.org
 +192.0.0.38	example.org
 +192.0.0.39	example.org
 +192.0.0.40	example.org
 +192.0.0.41	example.org
 +192.0.0.42	example.org
 +192.0.0.43	example.org
 +192.0.0.44	example.org
 +192.0.0.45	example.org
 +192.0.0.46	example.org
 +192.0.0.47	example.org
 +192.0.0.48	example.org
 +192.0.0.49	example.org
 +192.0.0.50	example.org
 +192.0.0.51	example.org
 +192.0.0.52	example.org
 +192.0.0.53	example.org
 +192.0.0.54	example.org
 +192.0.0.55	example.org
 +192.0.0.56	example.org
 +192.0.0.57	example.org
 +192.0.0.58	example.org
 +192.0.0.59	example.org
 +192.0.0.60	example.org
 +192.0.0.61	example.org
 +192.0.0.62	example.org
 +192.0.0.63	example.org
 +192.0.0.64	example.org
 +192.0.0.65	example.org
 +192.0.0.66	example.org
 +192.0.0.67	example.org
 +192.0.0.68	example.org
 +192.0.0.69	example.org
 +192.0.0.70	example.org
 +192.0.0.71	example.org
 +192.0.0.72	example.org
 +192.0.0.73	example.org
 +192.0.0.74	example.org
 +192.0.0.75	example.org
 +192.0.0.76	example.org
 +192.0.0.77	example.org
 +192.0.0.78	example.org
 +192.0.0.79	example.org
 +192.0.0.80	example.org
 +192.0.0.81	example.org
 +192.0.0.82	example.org
 +192.0.0.83	example.org
 +192.0.0.84	example.org
 +192.0.0.85	example.org
 +192.0.0.86	example.org
 +192.0.0.87	example.org
 +192.0.0.88	example.org
 +192.0.0.89	example.org
 +192.0.0.90	example.org
 +192.0.0.91	example.org
 +192.0.0.92	example.org
 +192.0.0.93	example.org
 +192.0.0.94	example.org
 +192.0.0.95	example.org
 +192.0.0.96	example.org
 +192.0.0.97	example.org
 +192.0.0.98	example.org
 +192.0.0.99	example.org
 +192.0.0.100	example.org
 +192.0.0.101	example.org
 +192.0.0.102	example.org
 +192.0.0.103	example.org
 +192.0.0.104	example.org
 +192.0.0.105	example.org
 +192.0.0.106	example.org
 +192.0.0.107	example.org
 +192.0.0.108	example.org
 +192.0.0.109	example.org
 +192.0.0.110	example.org
 +192.0.0.111	example.org
 +192.0.0.112	example.org
 +192.0.0.113	example.org
 +192.0.0.114	example.org
 +192.0.0.115	example.org
 +192.0.0.116	example.org
 +192.0.0.117	example.org
 +192.0.0.118	example.org
 +192.0.0.119	example.org
 +192.0.0.120	example.org
 +192.0.0.121	example.org
 +192.0.0.122	example.org
 +192.0.0.123	example.org
 +192.0.0.124	example.org
 +192.0.0.125	example.org
 +192.0.0.126	example.org
 +192.0.0.127	example.org
 +192.0.0.128	example.org
 +192.0.0.129	example.org
 +192.0.0.130	example.org
 +192.0.0.131	example.org
 +192.0.0.132	example.org
 +192.0.0.133	example.org
 +192.0.0.134	example.org
 +192.0.0.135	example.org
 +192.0.0.136	example.org
 +192.0.0.137	example.org
 +192.0.0.138	example.org
 +192.0.0.139	example.org
 +192.0.0.140	example.org
 +192.0.0.141	example.org
 +192.0.0.142	example.org
 +192.0.0.143	example.org
 +192.0.0.144	example.org
 +192.0.0.145	example.org
 +192.0.0.146	example.org
 +192.0.0.147	example.org
 +192.0.0.148	example.org
 +192.0.0.149	example.org
 +192.0.0.150	example.org
 +192.0.0.151	example.org
 +192.0.0.152	example.org
 +192.0.0.153	example.org
 +192.0.0.154	example.org
 +192.0.0.155	example.org
 +192.0.0.156	example.org
 +192.0.0.157	example.org
 +192.0.0.158	example.org
 +192.0.0.159	example.org
 +192.0.0.160	example.org
 +192.0.0.161	example.org
 +192.0.0.162	example.org
 +192.0.0.163	example.org
 +192.0.0.164	example.org
 +192.0.0.165	example.org
 +192.0.0.166	example.org
 +192.0.0.167	example.org
 +192.0.0.168	example.org
 +192.0.0.169	example.org
 +192.0.0.170	example.org
 +192.0.0.171	example.org
 +192.0.0.172	example.org
 +192.0.0.173	example.org
 +192.0.0.174	example.org
 +192.0.0.175	example.org
 +192.0.0.176	example.org
 +192.0.0.177	example.org
 +192.0.0.178	example.org
 +192.0.0.179	example.org
 +192.0.0.180	example.org
 +192.0.0.181	example.org
 +192.0.0.182	example.org
 +192.0.0.183	example.org
 +192.0.0.184	example.org
 +192.0.0.185	example.org
 +192.0.0.186	example.org
 +192.0.0.187	example.org
 +192.0.0.188	example.org
 +192.0.0.189	example.org
 +192.0.0.190	example.org
 +192.0.0.191	example.org
 +192.0.0.192	example.org
 +192.0.0.193	example.org
 +192.0.0.194	example.org
 +192.0.0.195	example.org
 +192.0.0.196	example.org
 +192.0.0.197	example.org
 +192.0.0.198	example.org
 +192.0.0.199	example.org
 +192.0.0.200	example.org
 +192.0.0.201	example.org
 +192.0.0.202	example.org
 +192.0.0.203	example.org
 +192.0.0.204	example.org
 +192.0.0.205	example.org
 +192.0.0.206	example.org
 +192.0.0.207	example.org
 +192.0.0.208	example.org
 +192.0.0.209	example.org
 +192.0.0.210	example.org
 +192.0.0.211	example.org
 +192.0.0.212	example.org
 +192.0.0.213	example.org
 +192.0.0.214	example.org
 +192.0.0.215	example.org
 +192.0.0.216	example.org
 +192.0.0.217	example.org
 +192.0.0.218	example.org
 +192.0.0.219	example.org
 +192.0.0.220	example.org
 +192.0.0.221	example.org
 +192.0.0.222	example.org
 +192.0.0.223	example.org
 +192.0.0.224	example.org
 +192.0.0.225	example.org
 +192.0.0.226	example.org
 +192.0.0.227	example.org
 +192.0.0.228	example.org
 +192.0.0.229	example.org
 +192.0.0.230	example.org
 +192.0.0.231	example.org
 +192.0.0.232	example.org
 +192.0.0.233	example.org
 +192.0.0.234	example.org
 +192.0.0.235	example.org
 +192.0.0.236	example.org
 +192.0.0.237	example.org
 +192.0.0.238	example.org
 +192.0.0.239	example.org
 +192.0.0.240	example.org
 +192.0.0.241	example.org
 +192.0.0.242	example.org
 +192.0.0.243	example.org
 +192.0.0.244	example.org
 +192.0.0.245	example.org
 +192.0.0.246	example.org
 +192.0.0.247	example.org
 +192.0.0.248	example.org
 +192.0.0.249	example.org
 +192.0.0.250	example.org
 +192.0.0.251	example.org
 +192.0.0.252	example.org
 +192.0.0.253	example.org
 +192.0.0.254	example.org
 +192.0.1.1	example.org
 +192.0.1.2	example.org
 +192.0.1.3	example.org
 +192.0.1.4	example.org
 +192.0.1.5	example.org
 +192.0.1.6	example.org
 +192.0.1.7	example.org
 +192.0.1.8	example.org
 +192.0.1.9	example.org
 +192.0.1.10	example.org
 +192.0.1.11	example.org
 +192.0.1.12	example.org
 +192.0.1.13	example.org
 +192.0.1.14	example.org
 +192.0.1.15	example.org
 +192.0.1.16	example.org
 +192.0.1.17	example.org
 +192.0.1.18	example.org
 +192.0.1.19	example.org
 +192.0.1.20	example.org
 +192.0.1.21	example.org
 +192.0.1.22	example.org
 +192.0.1.23	example.org
 +192.0.1.24	example.org
 +192.0.1.25	example.org
 +192.0.1.26	example.org
 +192.0.1.27	example.org
 +192.0.1.28	example.org
 +192.0.1.29	example.org
 +192.0.1.30	example.org
 +192.0.1.31	example.org
 +192.0.1.32	example.org
 +192.0.1.33	example.org
 +192.0.1.34	example.org
 +192.0.1.35	example.org
 +192.0.1.36	example.org
 +192.0.1.37	example.org
 +192.0.1.38	example.org
 +192.0.1.39	example.org
 +192.0.1.40	example.org
 +192.0.1.41	example.org
 +192.0.1.42	example.org
 +192.0.1.43	example.org
 +192.0.1.44	example.org
 +192.0.1.45	example.org
 +192.0.1.46	example.org
 +192.0.1.47	example.org
 +192.0.1.48	example.org
 +192.0.1.49	example.org
 +192.0.1.50	example.org
 +192.0.1.51	example.org
 +192.0.1.52	example.org
 +192.0.1.53	example.org
 +192.0.1.54	example.org
 +192.0.1.55	example.org
 +192.0.1.56	example.org
 +192.0.1.57	example.org
 +192.0.1.58	example.org
 +192.0.1.59	example.org
 +192.0.1.60	example.org
 +192.0.1.61	example.org
 +192.0.1.62	example.org
 +192.0.1.63	example.org
 +192.0.1.64	example.org
 +192.0.1.65	example.org
 +192.0.1.66	example.org
 +192.0.1.67	example.org
 +192.0.1.68	example.org
 +192.0.1.69	example.org
 +192.0.1.70	example.org
 +192.0.1.71	example.org
 +192.0.1.72	example.org
 +192.0.1.73	example.org
 +192.0.1.74	example.org
 +192.0.1.75	example.org
 +192.0.1.76	example.org
 +192.0.1.77	example.org
 +192.0.1.78	example.org
 +192.0.1.79	example.org
 +192.0.1.80	example.org
 +192.0.1.81	example.org
 +192.0.1.82	example.org
 +192.0.1.83	example.org
 +192.0.1.84	example.org
 +192.0.1.85	example.org
 +192.0.1.86	example.org
 +192.0.1.87	example.org
 +192.0.1.88	example.org
 +192.0.1.89	example.org
 +192.0.1.90	example.org
 +192.0.1.91	example.org
 +192.0.1.92	example.org
 +192.0.1.93	example.org
 +192.0.1.94	example.org
 +192.0.1.95	example.org
 +192.0.1.96	example.org
 +192.0.1.97	example.org
 +192.0.1.98	example.org
 +192.0.1.99	example.org
 +192.0.1.100	example.org
 +192.0.1.101	example.org
 +192.0.1.102	example.org
 +192.0.1.103	example.org
 +192.0.1.104	example.org
 +192.0.1.105	example.org
 +192.0.1.106	example.org
 +192.0.1.107	example.org
 +192.0.1.108	example.org
 +192.0.1.109	example.org
 +192.0.1.110	example.org
 +192.0.1.111	example.org
 +192.0.1.112	example.org
 +192.0.1.113	example.org
 +192.0.1.114	example.org
 +192.0.1.115	example.org
 +192.0.1.116	example.org
 +192.0.1.117	example.org
 +192.0.1.118	example.org
 +192.0.1.119	example.org
 +192.0.1.120	example.org
 +192.0.1.121	example.org
 +192.0.1.122	example.org
 +192.0.1.123	example.org
 +192.0.1.124	example.org
 +192.0.1.125	example.org
 +192.0.1.126	example.org
 +192.0.1.127	example.org
 +192.0.1.128	example.org
 +192.0.1.129	example.org
 +192.0.1.130	example.org
 +192.0.1.131	example.org
 +192.0.1.132	example.org
 +192.0.1.133	example.org
 +192.0.1.134	example.org
 +192.0.1.135	example.org
 +192.0.1.136	example.org
 +192.0.1.137	example.org
 +192.0.1.138	example.org
 +192.0.1.139	example.org
 +192.0.1.140	example.org
 +192.0.1.141	example.org
 +192.0.1.142	example.org
 +192.0.1.143	example.org
 +192.0.1.144	example.org
 +192.0.1.145	example.org
 +192.0.1.146	example.org
 +192.0.1.147	example.org
 +192.0.1.148	example.org
 +192.0.1.149	example.org
 +192.0.1.150	example.org
 +192.0.1.151	example.org
 +192.0.1.152	example.org
 +192.0.1.153	example.org
 +192.0.1.154	example.org
 +192.0.1.155	example.org
 +192.0.1.156	example.org
 +192.0.1.157	example.org
 +192.0.1.158	example.org
 +192.0.1.159	example.org
 +192.0.1.160	example.org
 +192.0.1.161	example.org
 +192.0.1.162	example.org
 +192.0.1.163	example.org
 +192.0.1.164	example.org
 +192.0.1.165	example.org
 +192.0.1.166	example.org
 +192.0.1.167	example.org
 +192.0.1.168	example.org
 +192.0.1.169	example.org
 +192.0.1.170	example.org
 +192.0.1.171	example.org
 +192.0.1.172	example.org
 +192.0.1.173	example.org
 +192.0.1.174	example.org
 +192.0.1.175	example.org
 +192.0.1.176	example.org
 +192.0.1.177	example.org
 +192.0.1.178	example.org
 +192.0.1.179	example.org
 +192.0.1.180	example.org
 +192.0.1.181	example.org
 +192.0.1.182	example.org
 +192.0.1.183	example.org
 +192.0.1.184	example.org
 +192.0.1.185	example.org
 +192.0.1.186	example.org
 +192.0.1.187	example.org
 +192.0.1.188	example.org
 +192.0.1.189	example.org
 +192.0.1.190	example.org
 +192.0.1.191	example.org
 +192.0.1.192	example.org
 +192.0.1.193	example.org
 +192.0.1.194	example.org
 +192.0.1.195	example.org
 +192.0.1.196	example.org
 +192.0.1.197	example.org
 +192.0.1.198	example.org
 +192.0.1.199	example.org
 +192.0.1.200	example.org
 +192.0.1.201	example.org
 +192.0.1.202	example.org
 +192.0.1.203	example.org
 +192.0.1.204	example.org
 +192.0.1.205	example.org
 +192.0.1.206	example.org
 +192.0.1.207	example.org
 +192.0.1.208	example.org
 +192.0.1.209	example.org
 +192.0.1.210	example.org
 +192.0.1.211	example.org
 +192.0.1.212	example.org
 +192.0.1.213	example.org
 +192.0.1.214	example.org
 +192.0.1.215	example.org
 +192.0.1.216	example.org
 +192.0.1.217	example.org
 +192.0.1.218	example.org
 +192.0.1.219	example.org
 +192.0.1.220	example.org
 +192.0.1.221	example.org
 +192.0.1.222	example.org
 +192.0.1.223	example.org
 +192.0.1.224	example.org
 +192.0.1.225	example.org
 +192.0.1.226	example.org
 +192.0.1.227	example.org
 +192.0.1.228	example.org
 +192.0.1.229	example.org
 +192.0.1.230	example.org
 +192.0.1.231	example.org
 +192.0.1.232	example.org
 +192.0.1.233	example.org
 +192.0.1.234	example.org
 +192.0.1.235	example.org
 +192.0.1.236	example.org
 +192.0.1.237	example.org
 +192.0.1.238	example.org
 +192.0.1.239	example.org
 +192.0.1.240	example.org
 +192.0.1.241	example.org
 +192.0.1.242	example.org
 +192.0.1.243	example.org
 +192.0.1.244	example.org
 +192.0.1.245	example.org
 +192.0.1.246	example.org
 +192.0.1.247	example.org
 +192.0.1.248	example.org
 +192.0.1.249	example.org
 +192.0.1.250	example.org
 +192.0.1.251	example.org
 +192.0.1.252	example.org
 +192.0.1.253	example.org
 +192.0.1.254	example.org
 diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
 index 43dfc6739e350a58..f391dc0a59849aab 100644
 --- a/sysdeps/posix/getaddrinfo.c
 +++ b/sysdeps/posix/getaddrinfo.c
@@ -458,11 +458,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
   if (name != NULL)
     {
 -      at = alloca_account (sizeof (struct gaih_addrtuple), alloca_used);
 -      at->family = AF_UNSPEC;
 -      at->scopeid = 0;
 -      at->next = NULL;
 -
       if (req->ai_flags & AI_IDN)
 	{
 	  char *out;
@@ -473,13 +468,21 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	  malloc_name = true;
 	}
 -      if (__inet_aton_exact (name, (struct in_addr *) at->addr) != 0)
 +      uint32_t addr[4];
 +      if (__inet_aton_exact (name, (struct in_addr *) addr) != 0)
 	{
 +	  at = alloca_account (sizeof (struct gaih_addrtuple), alloca_used);
 +	  at->scopeid = 0;
 +	  at->next = NULL;
 +
 	  if (req->ai_family == AF_UNSPEC || req->ai_family == AF_INET)
 -	    at->family = AF_INET;
 +	    {
 +	      memcpy (at->addr, addr, sizeof (at->addr));
 +	      at->family = AF_INET;
 +	    }
 	  else if (req->ai_family == AF_INET6 && (req->ai_flags & AI_V4MAPPED))
 	    {
 -	      at->addr[3] = at->addr[0];
 +	      at->addr[3] = addr[0];
 	      at->addr[2] = htonl (0xffff);
 	      at->addr[1] = 0;
 	      at->addr[0] = 0;
@@ -493,49 +496,62 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	  if (req->ai_flags & AI_CANONNAME)
 	    canon = name;
 +
 +	  goto process_list;
 	}
 -      else if (at->family == AF_UNSPEC)
 +
 +      char *scope_delim = strchr (name, SCOPE_DELIMITER);
 +      int e;
 +
 +      if (scope_delim == NULL)
 +	e = inet_pton (AF_INET6, name, addr);
 +      else
 +	e = __inet_pton_length (AF_INET6, name, scope_delim - name, addr);
 +
 +      if (e > 0)
 	{
 -	  char *scope_delim = strchr (name, SCOPE_DELIMITER);
 -	  int e;
 -	  if (scope_delim == NULL)
 -	    e = inet_pton (AF_INET6, name, at->addr);
 +	  at = alloca_account (sizeof (struct gaih_addrtuple),
 +			       alloca_used);
 +	  at->scopeid = 0;
 +	  at->next = NULL;
 +
 +	  if (req->ai_family == AF_UNSPEC || req->ai_family == AF_INET6)
 +	    {
 +	      memcpy (at->addr, addr, sizeof (at->addr));
 +	      at->family = AF_INET6;
 +	    }
 +	  else if (req->ai_family == AF_INET
 +		   && IN6_IS_ADDR_V4MAPPED (addr))
 +	    {
 +	      at->addr[0] = addr[3];
 +	      at->addr[1] = addr[1];
 +	      at->addr[2] = addr[2];
 +	      at->addr[3] = addr[3];
 +	      at->family = AF_INET;
 +	    }
 	  else
 -	    e = __inet_pton_length (AF_INET6, name, scope_delim - name,
 -				    at->addr);
 -	  if (e > 0)
 	    {
 -	      if (req->ai_family == AF_UNSPEC || req->ai_family == AF_INET6)
 -		at->family = AF_INET6;
 -	      else if (req->ai_family == AF_INET
 -		       && IN6_IS_ADDR_V4MAPPED (at->addr))
 -		{
 -		  at->addr[0] = at->addr[3];
 -		  at->family = AF_INET;
 -		}
 -	      else
 -		{
 -		  result = -EAI_ADDRFAMILY;
 -		  goto free_and_return;
 -		}
 -
 -	      if (scope_delim != NULL
 -		  && __inet6_scopeid_pton ((struct in6_addr *) at->addr,
 -					   scope_delim + 1,
 -					   &at->scopeid) != 0)
 -		{
 -		  result = -EAI_NONAME;
 -		  goto free_and_return;
 -		}
 +	      result = -EAI_ADDRFAMILY;
 +	      goto free_and_return;
 +	    }
 -	      if (req->ai_flags & AI_CANONNAME)
 -		canon = name;
 +	  if (scope_delim != NULL
 +	      && __inet6_scopeid_pton ((struct in6_addr *) at->addr,
 +				       scope_delim + 1,
 +				       &at->scopeid) != 0)
 +	    {
 +	      result = -EAI_NONAME;
 +	      goto free_and_return;
 	    }
 +
 +	  if (req->ai_flags & AI_CANONNAME)
 +	    canon = name;
 +
 +	  goto process_list;
 	}
 -      if (at->family == AF_UNSPEC && (req->ai_flags & AI_NUMERICHOST) == 0)
 +      if ((req->ai_flags & AI_NUMERICHOST) == 0)
 	{
 -	  struct gaih_addrtuple **pat = &at;
 	  int no_data = 0;
 	  int no_inet6_data = 0;
 	  nss_action_list nip;
@@ -543,6 +559,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	  enum nss_status status = NSS_STATUS_UNAVAIL;
 	  int no_more;
 	  struct resolv_context *res_ctx = NULL;
 +	  bool do_merge = false;
 	  /* If we do not have to look for IPv6 addresses or the canonical
 	     name, use the simple, old functions, which do not support
@@ -579,7 +596,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 			  result = -EAI_MEMORY;
 			  goto free_and_return;
 			}
 -		      *pat = addrmem;
 +		      at = addrmem;
 		    }
 		  else
 		    {
@@ -632,6 +649,8 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		    }
 		  struct gaih_addrtuple *addrfree = addrmem;
 +		  struct gaih_addrtuple **pat = &at;
 +
 		  for (int i = 0; i < air->naddrs; ++i)
 		    {
 		      socklen_t size = (air->family[i] == AF_INET
@@ -695,12 +714,6 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		  free (air);
 -		  if (at->family == AF_UNSPEC)
 -		    {
 -		      result = -EAI_NONAME;
 -		      goto free_and_return;
 -		    }
 -
 		  goto process_list;
 		}
 	      else if (err == 0)
@@ -732,6 +745,22 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	  while (!no_more)
 	    {
 +	      /* Always start afresh; continue should discard previous results
 +		 and the hosts database does not support merge.  */
 +	      at = NULL;
 +	      free (canonbuf);
 +	      free (addrmem);
 +	      canon = canonbuf = NULL;
 +	      addrmem = NULL;
 +	      got_ipv6 = false;
 +
 +	      if (do_merge)
 +		{
 +		  __set_h_errno (NETDB_INTERNAL);
 +		  __set_errno (EBUSY);
 +		  break;
 +		}
 +
 	      no_data = 0;
 	      nss_gethostbyname4_r *fct4 = NULL;
@@ -744,12 +773,14 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		{
 		  while (1)
 		    {
 -		      status = DL_CALL_FCT (fct4, (name, pat,
 +		      status = DL_CALL_FCT (fct4, (name, &at,
 						   tmpbuf->data, tmpbuf->length,
 						   &errno, &h_errno,
 						   NULL));
 		      if (status == NSS_STATUS_SUCCESS)
 			break;
 +		      /* gethostbyname4_r may write into AT, so reset it.  */
 +		      at = NULL;
 		      if (status != NSS_STATUS_TRYAGAIN
 			  || errno != ERANGE || h_errno != NETDB_INTERNAL)
 			{
@@ -774,7 +805,9 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		      no_data = 1;
 		      if ((req->ai_flags & AI_CANONNAME) != 0 && canon == NULL)
 -			canon = (*pat)->name;
 +			canon = at->name;
 +
 +		      struct gaih_addrtuple **pat = &at;
 		      while (*pat != NULL)
 			{
@@ -826,6 +859,8 @@ gaih_inet (const char *name, const struct gaih_service *service,
 		  if (fct != NULL)
 		    {
 +		      struct gaih_addrtuple **pat = &at;
 +
 		      if (req->ai_family == AF_INET6
 			  || req->ai_family == AF_UNSPEC)
 			{
@@ -899,6 +934,10 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	      if (nss_next_action (nip, status) == NSS_ACTION_RETURN)
 		break;
 +	      /* The hosts database does not support MERGE.  */
 +	      if (nss_next_action (nip, status) == NSS_ACTION_MERGE)
 +		do_merge = true;
 +
 	      nip++;
 	      if (nip->module == NULL)
 		no_more = -1;
@@ -930,7 +969,7 @@ gaih_inet (const char *name, const struct gaih_service *service,
 	}
     process_list:
 -      if (at->family == AF_UNSPEC)
 +      if (at == NULL)
 	{
 	  result = -EAI_NONAME;
 	  goto free_and_return;
--- a/SOURCES/glibc-RHEL-2999.patch
+++ b/SOURCES/glibc-RHEL-2999.patch
@ -0,0 +1,164 @@
 This patch was developed under embargo and cannot reference an upstream
 commit. To find the associated commit please review the upstream git
 log for CVE-2023-4911 to identify the relevant commits.
 Author: Siddhesh Poyarekar <siddhesh@redhat.com>
 Date:   Tue Sep 19 11:52:44 2023 -0400
    tunables: Terminate if end of input is reached (CVE-2023-4911)
    The string parsing routine may end up writing beyond bounds of tunestr
    if the input tunable string is malformed, of the form name=name=val.
    This gets processed twice, first as name=name=val and next as name=val,
    resulting in tunestr being name=name=val:name=val, thus overflowing
    tunestr.
    Terminate the parsing loop at the first instance itself so that tunestr
    does not overflow.
    This also fixes up tst-env-setuid-tunables to actually handle failures
    correct and add new tests to validate the fix for this CVE.
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
 ---
 Tested on x86_64.
 NEWS                          |  5 +++++
 elf/dl-tunables.c             | 17 ++++++++++-------
 elf/tst-env-setuid-tunables.c | 36 +++++++++++++++++++++++++++--------
 3 files changed, 43 insertions(+), 15 deletions(-)
 Conflicts:
 	NEWS
 	 (Dropped)
 	elf/tst-env-setuid-tunables.c
 	 (Trivial HAVE_TUNABLES conflict)
 diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c
 index 8009e54ee5db32be..837474b5044cb5d7 100644
 --- a/elf/dl-tunables.c
 +++ b/elf/dl-tunables.c
@@ -188,11 +188,7 @@ parse_tunables (char *tunestr, char *valstring)
       /* If we reach the end of the string before getting a valid name-value
 	 pair, bail out.  */
       if (p[len] == '\0')
 -	{
 -	  if (__libc_enable_secure)
 -	    tunestr[off] = '\0';
 -	  return;
 -	}
 +	break;
       /* We did not find a valid name-value pair before encountering the
 	 colon.  */
@@ -252,9 +248,16 @@ parse_tunables (char *tunestr, char *valstring)
 	    }
 	}
 -      if (p[len] != '\0')
 -	p += len + 1;
 +      /* We reached the end while processing the tunable string.  */
 +      if (p[len] == '\0')
 +	break;
 +
 +      p += len + 1;
     }
 +
 +  /* Terminate tunestr before we leave.  */
 +  if (__libc_enable_secure)
 +    tunestr[off] = '\0';
 }
 #endif
 diff --git a/elf/tst-env-setuid-tunables.c b/elf/tst-env-setuid-tunables.c
 index 05619c9adc8b2698..cd4e84364074c613 100644
 --- a/elf/tst-env-setuid-tunables.c
 +++ b/elf/tst-env-setuid-tunables.c
@@ -52,6 +52,8 @@ const char *teststrings[] =
   "glibc.malloc.perturb=0x800:not_valid.malloc.check=2:glibc.malloc.mmap_threshold=4096",
   "glibc.not_valid.check=2:glibc.malloc.mmap_threshold=4096",
   "not_valid.malloc.check=2:glibc.malloc.mmap_threshold=4096",
 +  "glibc.malloc.mmap_threshold=glibc.malloc.mmap_threshold=4096",
 +  "glibc.malloc.check=2",
   "glibc.malloc.garbage=2:glibc.maoc.mmap_threshold=4096:glibc.malloc.check=2",
   "glibc.malloc.check=4:glibc.malloc.garbage=2:glibc.maoc.mmap_threshold=4096",
   ":glibc.malloc.garbage=2:glibc.malloc.check=1",
@@ -70,6 +72,8 @@ const char *resultstrings[] =
   "glibc.malloc.perturb=0x800:glibc.malloc.mmap_threshold=4096",
   "glibc.malloc.mmap_threshold=4096",
   "glibc.malloc.mmap_threshold=4096",
 +  "glibc.malloc.mmap_threshold=glibc.malloc.mmap_threshold=4096",
 +  "",
   "",
   "",
   "",
@@ -84,11 +88,18 @@ test_child (int off)
   const char *val = getenv ("GLIBC_TUNABLES");
 #if HAVE_TUNABLES
 +  printf ("    [%d] GLIBC_TUNABLES is %s\n", off, val);
 +  fflush (stdout);
   if (val != NULL && strcmp (val, resultstrings[off]) == 0)
     return 0;
   if (val != NULL)
 -    printf ("[%d] Unexpected GLIBC_TUNABLES VALUE %s\n", off, val);
 +    printf ("    [%d] Unexpected GLIBC_TUNABLES VALUE %s, expected %s\n",
 +	    off, val, resultstrings[off]);
 +  else
 +    printf ("    [%d] GLIBC_TUNABLES environment variable absent\n", off);
 +
 +  fflush (stdout);
   return 1;
 #else
@@ -117,21 +128,26 @@ do_test (int argc, char **argv)
       if (ret != 0)
 	exit (1);
 -      exit (EXIT_SUCCESS);
 +      /* Special return code to make sure that the child executed all the way
 +	 through.  */
 +      exit (42);
     }
   else
     {
 -      int ret = 0;
 -
       /* Spawn tests.  */
       for (int i = 0; i < array_length (teststrings); i++)
 	{
 	  char buf[INT_BUFSIZE_BOUND (int)];
 -	  printf ("Spawned test for %s (%d)\n", teststrings[i], i);
 +	  printf ("[%d] Spawned test for %s\n", i, teststrings[i]);
 	  snprintf (buf, sizeof (buf), "%d\n", i);
 +	  fflush (stdout);
 	  if (setenv ("GLIBC_TUNABLES", teststrings[i], 1) != 0)
 -	    exit (1);
 +	    {
 +	      printf ("    [%d] Failed to set GLIBC_TUNABLES: %m", i);
 +	      support_record_failure ();
 +	      continue;
 +	    }
 	  int status = support_capture_subprogram_self_sgid (buf);
@@ -139,9 +155,14 @@ do_test (int argc, char **argv)
 	  if (WEXITSTATUS (status) == EXIT_UNSUPPORTED)
 	    return EXIT_UNSUPPORTED;
 -	  ret |= status;
 +	  if (WEXITSTATUS (status) != 42)
 +	    {
 +	      printf ("    [%d] child failed with status %d\n", i,
 +		      WEXITSTATUS (status));
 +	      support_record_failure ();
 +	    }
 	}
 -      return ret;
 +      return 0;
     }
 }
--- a/SOURCES/glibc-rh2234715.patch
+++ b/SOURCES/glibc-rh2234715.patch
@ -0,0 +1,187 @@
 commit bd77dd7e73e3530203be1c52c8a29d08270cb25d
 Author: Florian Weimer <fweimer@redhat.com>
 Date:   Wed Sep 13 14:10:56 2023 +0200
    CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
    Without passing alt_dns_packet_buffer, __res_context_search can only
    store 2048 bytes (what fits into dns_packet_buffer).  However,
    the function returns the total packet size, and the subsequent
    DNS parsing code in _nss_dns_gethostbyname4_r reads beyond the end
    of the stack-allocated buffer.
    Fixes commit f282cdbe7f436c75864e5640a4 ("resolv: Implement no-aaaa
    stub resolver option") and bug 30842.
 Conflits:
 	resolv/Makefile
 	 (missing tests)
 diff --git a/resolv/Makefile b/resolv/Makefile
 index ea1518ec2da860c1..2c43d52122ef4343 100644
 --- a/resolv/Makefile
 +++ b/resolv/Makefile
@@ -102,6 +102,7 @@ tests += \
   tst-resolv-invalid-cname \
   tst-resolv-network \
   tst-resolv-noaaaa \
 +  tst-resolv-noaaaa-vc \
   tst-resolv-nondecimal \
   tst-resolv-res_init-multi \
   tst-resolv-search \
@@ -280,6 +281,7 @@ $(objpfx)tst-resolv-res_init-multi: $(objpfx)libresolv.so \
 $(objpfx)tst-resolv-res_init-thread: $(objpfx)libresolv.so \
   $(shared-thread-library)
 $(objpfx)tst-resolv-noaaaa: $(objpfx)libresolv.so $(shared-thread-library)
 +$(objpfx)tst-resolv-noaaaa-vc: $(objpfx)libresolv.so $(shared-thread-library)
 $(objpfx)tst-resolv-invalid-cname: $(objpfx)libresolv.so \
   $(shared-thread-library)
 $(objpfx)tst-resolv-nondecimal: $(objpfx)libresolv.so $(shared-thread-library)
 diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
 index 36789965c06757d0..3d261b6810bba5c9 100644
 --- a/resolv/nss_dns/dns-host.c
 +++ b/resolv/nss_dns/dns-host.c
@@ -428,7 +428,7 @@ _nss_dns_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat,
     {
       n = __res_context_search (ctx, name, C_IN, T_A,
 				dns_packet_buffer, sizeof (dns_packet_buffer),
 -				NULL, NULL, NULL, NULL, NULL);
 +				&alt_dns_packet_buffer, NULL, NULL, NULL, NULL);
       if (n >= 0)
 	status = gaih_getanswer_noaaaa (alt_dns_packet_buffer, n,
 					&abuf, pat, errnop, herrnop, ttlp);
 diff --git a/resolv/tst-resolv-noaaaa-vc.c b/resolv/tst-resolv-noaaaa-vc.c
 new file mode 100644
 index 0000000000000000..9f5aebd99f2d74a2
 --- /dev/null
 +++ b/resolv/tst-resolv-noaaaa-vc.c
@@ -0,0 +1,129 @@
 +/* Test the RES_NOAAAA resolver option with a large response.
 +   Copyright (C) 2022-2023 Free Software Foundation, Inc.
 +   This file is part of the GNU C Library.
 +
 +   The GNU C Library is free software; you can redistribute it and/or
 +   modify it under the terms of the GNU Lesser General Public
 +   License as published by the Free Software Foundation; either
 +   version 2.1 of the License, or (at your option) any later version.
 +
 +   The GNU C Library is distributed in the hope that it will be useful,
 +   but WITHOUT ANY WARRANTY; without even the implied warranty of
 +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +   Lesser General Public License for more details.
 +
 +   You should have received a copy of the GNU Lesser General Public
 +   License along with the GNU C Library; if not, see
 +   <https://www.gnu.org/licenses/>.  */
 +
 +#include <errno.h>
 +#include <netdb.h>
 +#include <resolv.h>
 +#include <stdbool.h>
 +#include <stdlib.h>
 +#include <support/check.h>
 +#include <support/check_nss.h>
 +#include <support/resolv_test.h>
 +#include <support/support.h>
 +#include <support/xmemstream.h>
 +
 +/* Used to keep track of the number of queries.  */
 +static volatile unsigned int queries;
 +
 +/* If true, add a large TXT record at the start of the answer section.  */
 +static volatile bool stuff_txt;
 +
 +static void
 +response (const struct resolv_response_context *ctx,
 +          struct resolv_response_builder *b,
 +          const char *qname, uint16_t qclass, uint16_t qtype)
 +{
 +  /* If not using TCP, just force its use.  */
 +  if (!ctx->tcp)
 +    {
 +      struct resolv_response_flags flags = {.tc = true};
 +      resolv_response_init (b, flags);
 +      resolv_response_add_question (b, qname, qclass, qtype);
 +      return;
 +    }
 +
 +  /* The test needs to send four queries, the first three are used to
 +     grow the NSS buffer via the ERANGE handshake.  */
 +  ++queries;
 +  TEST_VERIFY (queries <= 4);
 +
 +  /* AAAA queries are supposed to be disabled.  */
 +  TEST_COMPARE (qtype, T_A);
 +  TEST_COMPARE (qclass, C_IN);
 +  TEST_COMPARE_STRING (qname, "example.com");
 +
 +  struct resolv_response_flags flags = {};
 +  resolv_response_init (b, flags);
 +  resolv_response_add_question (b, qname, qclass, qtype);
 +
 +  resolv_response_section (b, ns_s_an);
 +
 +  if (stuff_txt)
 +    {
 +      resolv_response_open_record (b, qname, qclass, T_TXT, 60);
 +      int zero = 0;
 +      for (int i = 0; i <= 15000; ++i)
 +        resolv_response_add_data (b, &zero, sizeof (zero));
 +      resolv_response_close_record (b);
 +    }
 +
 +  for (int i = 0; i < 200; ++i)
 +    {
 +      resolv_response_open_record (b, qname, qclass, qtype, 60);
 +      char ipv4[4] = {192, 0, 2, i + 1};
 +      resolv_response_add_data (b, &ipv4, sizeof (ipv4));
 +      resolv_response_close_record (b);
 +    }
 +}
 +
 +static int
 +do_test (void)
 +{
 +  struct resolv_test *obj = resolv_test_start
 +    ((struct resolv_redirect_config)
 +     {
 +       .response_callback = response
 +     });
 +
 +  _res.options |= RES_NOAAAA;
 +
 +  for (int do_stuff_txt = 0; do_stuff_txt < 2; ++do_stuff_txt)
 +    {
 +      queries = 0;
 +      stuff_txt = do_stuff_txt;
 +
 +      struct addrinfo *ai = NULL;
 +      int ret;
 +      ret = getaddrinfo ("example.com", "80",
 +                         &(struct addrinfo)
 +                         {
 +                           .ai_family = AF_UNSPEC,
 +                           .ai_socktype = SOCK_STREAM,
 +                         }, &ai);
 +
 +      char *expected_result;
 +      {
 +        struct xmemstream mem;
 +        xopen_memstream (&mem);
 +        for (int i = 0; i < 200; ++i)
 +          fprintf (mem.out, "address: STREAM/TCP 192.0.2.%d 80\n", i + 1);
 +        xfclose_memstream (&mem);
 +        expected_result = mem.buffer;
 +      }
 +
 +      check_addrinfo ("example.com", ai, ret, expected_result);
 +
 +      free (expected_result);
 +      freeaddrinfo (ai);
 +    }
 +
 +  resolv_test_end (obj);
 +  return 0;
 +}
 +
 +#include <support/test-driver.c>
--- a/SOURCES/glibc-upstream-2.34-373.patch
+++ b/SOURCES/glibc-upstream-2.34-373.patch
--- a/SPECS/glibc.spec
+++ b/SPECS/glibc.spec
@ -155,7 +155,7 @@ end \
 Summary: The GNU libc libraries
 Name: glibc
 Version: %{glibcversion}
-Release: 60%{?dist}
+Release: 60%{?dist}.7
 # In general, GPLv2+ is used by programs, LGPLv2+ is used for
 # libraries.
@ -700,6 +700,26 @@ Patch468: glibc-upstream-2.34-386.patch
 # glibc-upstream-2.34-387.patch is a NEWS-only update.  Skipped downstream.
 Patch469: glibc-upstream-2.34-388.patch
 Patch470: glibc-upstream-2.34-389.patch
 # (Reverted fixes for RHEL-3385 were here.)
 Patch476: glibc-rh2234715.patch
 Patch477: glibc-RHEL-2437.patch
 Patch478: glibc-RHEL-2425-1.patch
 Patch479: glibc-RHEL-2425-2.patch
 Patch480: glibc-RHEL-2425-3.patch
 Patch481: glibc-RHEL-2425-4.patch
 Patch482: glibc-RHEL-2425-5.patch
 Patch483: glibc-RHEL-2425-6.patch
 Patch484: glibc-RHEL-2425-7.patch
 Patch485: glibc-RHEL-2425-8.patch
 Patch486: glibc-RHEL-2425-9.patch
 Patch487: glibc-RHEL-2425-10.patch
 Patch488: glibc-RHEL-2425-11.patch
 Patch489: glibc-RHEL-2425-12.patch
 Patch490: glibc-RHEL-2425-13.patch
 Patch491: glibc-RHEL-2425-14.patch
 Patch492: glibc-RHEL-2999.patch
 Patch493: glibc-RHEL-2425-15.patch
 Patch494: glibc-RHEL-2425-16.patch
 ##############################################################################
 # Continued list of core "glibc" package information:
@ -2859,6 +2879,27 @@ fi
 %endif
 %changelog
 * Mon Sep 25 2023 Florian Weimer <fweimer@redhat.com> - 2.34-60.7
 - Fix memory leak regression in getaddrinfo (RHEL-2425)
 * Tue Sep 19 2023 Carlos O'Donell <carlos@redhat.com> - 2.34-60.6
 - CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation (RHEL-2999)
 * Tue Sep 19 2023 Carlos O'Donell <carlos@redhat.com> - 2.34-60.5
 - Revert: Always call destructors in reverse constructor order (RHEL-3385)
 * Mon Sep 18 2023 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.34-60.4
 - CVE-2023-4806 glibc: potential use-after-free in getaddrinfo (RHEL-2425)
 * Fri Sep 15 2023 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.34-60.3
 - CVE-2023-4813: potential use-after-free in gaih_inet (RHEL-2437)
 * Fri Sep 15 2023 Carlos O'Donell <carlos@redhat.com> - 2.34-60.2
 - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaaa mode (#2234715)
 * Wed Sep 13 2023 Florian Weimer <fweimer@redhat.com> - 2.34-60.1
 - Always call destructors in reverse constructor order (RHEL-3385)
 * Wed Feb  8 2023 Florian Weimer <fweimer@redhat.com> - 2.34-60
 - Upstream test for ldconfig -p (#2167811)
`@ -1 +1,2 @@`
	`SOURCES/glibc-2.34.tar.xz`	`SOURCES/glibc-2.34.tar.xz`
		`SOURCES/glibc-upstream-2.34-373.patch`
`@ -1 +1,2 @@`
	`7c3b8890a6346793b6334cc5f2fea5d437d307b8 SOURCES/glibc-2.34.tar.xz`	`7c3b8890a6346793b6334cc5f2fea5d437d307b8 SOURCES/glibc-2.34.tar.xz`
		`6022f103e5596ad229f22bc966327d71208f7016 SOURCES/glibc-upstream-2.34-373.patch`