[Bug libc/10162] New: stratcliff test segfaults on ia64

[Bug libc/10162] New: stratcliff test segfaults on ia64

[aurelien at aurel32 dot net]

glibc 2.10 has added a new test for memchr() in stratcliff. This new test fails 
on ia64, which has its own assembly version in sysdeps/ia64/memchr.S.

It looks like this assembly version does some prefetch, and crosses the page 
boundary, causing the segfault. It should be possible to do prefetching while 
not triggering page faults on ia64, but I don't know enough ia64 assembly to be 
able to modify this code myself.

-- 
           Summary: stratcliff test segfaults on ia64
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: aurelien at aurel32 dot net
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: ia64-unknown-linux-gnu
  GCC host triplet: ia64-unknown-linux-gnu
GCC target triplet: ia64-unknown-linux-gnu


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[drepper at redhat dot com]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|drepper at redhat dot com   |hjl dot tools at gmail dot
                   |                            |com
             Status|NEW                         |ASSIGNED


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[hjl dot tools at gmail dot com]

------- Additional Comments From hjl dot tools at gmail dot com  2009-05-20 21:22 -------
stratcliff.c has

  int size = sysconf (_SC_PAGESIZE);
  int nchars = size / sizeof (CHAR);
...
  adr = (CHAR *) mmap (NULL, 3 * size, PROT_READ | PROT_WRITE,
                       MAP_PRIVATE | MAP_ANON, -1, 0); 
...
      mprotect (adr, size, PROT_NONE);
      mprotect (adr + 2 * nchars, size, PROT_NONE);
      adr += nchars;
...
   CHAR *cp = MEMCHR (&adr[outer], L('V'), 3 * size);

memchr is called with size which contains unreadable pages. How
does it work on any arch?

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |WAITING


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[hjl dot tools at gmail dot com]

------- Additional Comments From hjl dot tools at gmail dot com  2009-05-20 22:28 -------
The problem is software pipeline doesn't take page boundary into
account.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[aurelien at aurel32 dot net]

------- Additional Comments From aurelien at aurel32 dot net  2009-05-20 22:34 -------
(In reply to comment #1)
> stratcliff.c has
> 
>   int size = sysconf (_SC_PAGESIZE);
>   int nchars = size / sizeof (CHAR);
> ...
>   adr = (CHAR *) mmap (NULL, 3 * size, PROT_READ | PROT_WRITE,
>                        MAP_PRIVATE | MAP_ANON, -1, 0); 
> ...
>       mprotect (adr, size, PROT_NONE);
>       mprotect (adr + 2 * nchars, size, PROT_NONE);
>       adr += nchars;
> ...
>    CHAR *cp = MEMCHR (&adr[outer], L('V'), 3 * size);
> 
> memchr is called with size which contains unreadable pages. How
> does it work on any arch?

The looked up char is now to be before the page boundary, that is before the 
unreadable pages. This test actually checks that in such condition theses pages 
are not accessed.

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[hjl dot tools at gmail dot com]

------- Additional Comments From hjl dot tools at gmail dot com  2009-05-21 19:45 -------
A patch is posted at

http://sourceware.org/ml/libc-alpha/2009-05/msg00110.html

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[hjl dot tools at gmail dot com]

------- Additional Comments From hjl dot tools at gmail dot com  2009-05-21 19:46 -------
(In reply to comment #4)
> A patch is posted at
> 
> http://sourceware.org/ml/libc-alpha/2009-05/msg00110.html

Oops. Wrong patch. I will upload the patch here.

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[hjl dot tools at gmail dot com]

------- Additional Comments From hjl dot tools at gmail dot com  2009-05-21 19:47 -------
Created an attachment (id=3955)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=3955&action=view)
A patch


-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[aurelien at aurel32 dot net]

------- Additional Comments From aurelien at aurel32 dot net  2009-05-21 20:57 -------
I confirm it works well, thanks a lot! Could someone apply this patch?

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2009-05-22 01:50 -------
Fixed in current git version.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[pasky at suse dot cz]

------- Additional Comments From pasky at suse dot cz  2009-11-09 17:59 -------
Unfortunately, this seems to break when calling memchr() on a shared mmap()ed
buffer - this crashes now:

#include<sys/mman.h>
#include<string.h>
#include<unistd.h>
#include<fcntl.h>
int main() {
  void *m = mmap(NULL, 53, PROT_READ, MAP_SHARED, open("/etc/passwd", O_RDONLY
), 0);
  volatile void *q = memchr(m, ':', 53);
}

since memchr() tries to access m-8. I have only very little idea IA64, I think
it is because the kernel cannot fill p[] in time, causing the speculative load
to fail, and the assumption that speculative load fails only if the mapping is
inaccessible is invalid?

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[hjl dot tools at gmail dot com]

------- Additional Comments From hjl dot tools at gmail dot com  2009-11-09 21:01 -------
A patch is posted at

http://sourceware.org/ml/libc-alpha/2009-11/msg00032.html

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2009-11-15 03:20 -------
Fixed in git.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[hjl dot tools at gmail dot com]

------- Additional Comments From hjl dot tools at gmail dot com  2009-11-15 16:18 -------
(In reply to comment #10)
> A patch is posted at
> 
> http://sourceware.org/ml/libc-alpha/2009-11/msg00032.html

Please use the patch above. It handles reading beyond memory
properly, regardless memory size.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2009-11-20 16:31 -------
Applied.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=10162

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10162] stratcliff test segfaults on ia64

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=10162

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.