public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug string/29197] New: __strncpy_power9() uses uninitialised register vs18 value for filling after \0
@ 2022-05-29 19:39 zsojka at seznam dot cz
  2022-05-30  9:35 ` [Bug string/29197] " fweimer at redhat dot com
                   ` (11 more replies)
  0 siblings, 12 replies; 13+ messages in thread
From: zsojka at seznam dot cz @ 2022-05-29 19:39 UTC (permalink / raw)
  To: glibc-bugs

https://sourceware.org/bugzilla/show_bug.cgi?id=29197

            Bug ID: 29197
           Summary: __strncpy_power9() uses uninitialised register vs18
                    value for filling after \0
           Product: glibc
           Version: 2.35
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: string
          Assignee: unassigned at sourceware dot org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
            Target: powerpc64le-unknown-linux-gnu

Hello,

originally reported as a gcc bug at https://gcc.gnu.org/PR105744 , but it was
analysed by Kewen Lin to be an issue in the glibc implementation.

The following program:
$ cat test_strncpy.c
#include <string.h>
#include <stdlib.h>

#define N 3
char a[N];
char c[N];

int
main (void)
{
  __asm__ volatile ("xxspltib 18, 0xf":::"vs18");
  strncpy (c, a, N);
  for (unsigned i = 0; i < N; i++)
    if (c[i])
      abort ();
  return 0;
}
$ powerpc64le-unknown-linux-gnu-gcc test_strncpy.c -static
$ qemu-ppc64le -- ./a.out 
qemu: uncaught target signal 6 (Aborted) - core dumped
Aborted

fails, with the value of c[] being:
(gdb) p c
$1 = "\000\015\015"


Quoting Kewen Lin:
---------------------
In
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=sysdeps/powerpc/powerpc64/le/power9/strncpy.S

        lbz     r0,0(r4)
        stb     r0,0(r3)
        addi    r11,r3,1
        addi    r5,r5,-1
        vspltisb v18,0          /* Zeroes in v18  */

...

L(zero_padding_end):
        sldi    r10,r5,56       /* stxvl wants size in top 8 bits  */
        stxvl   v18,r11,r10     /* Partial store  */
        blr


The code at label "zero_padding_end" is supposed to use v18, but the stxvl will
take the 18 as vsx No. instead of vr No, so it ends up to use the wrong
register vs18 instead of v18 for the store.
---------------------

Disassembling the object code shows the registers used (v18 / vs18):

...
   0x0000000010022f10 <+16>:      lbz     r0,0(r4)
   0x0000000010022f14 <+20>:      stb     r0,0(r3)
   0x0000000010022f18 <+24>:      addi    r11,r3,1
   0x0000000010022f1c <+28>:      addi    r5,r5,-1
   0x0000000010022f20 <+32>:      vspltisb v18,0
...
   0x000000001002319c <+668>:     rldicr  r10,r5,56,7
   0x00000000100231a0 <+672>:     stxvl   vs18,r11,r10
   0x00000000100231a4 <+676>:     blr

-- 
You are receiving this mail because:
You are on the CC list for the bug.

^ permalink raw reply	[flat|nested] 13+ messages in thread
end of thread, other threads:[~2022-06-07 20:00 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-29 19:39 [Bug string/29197] New: __strncpy_power9() uses uninitialised register vs18 value for filling after \0 zsojka at seznam dot cz
2022-05-30  9:35 ` [Bug string/29197] " fweimer at redhat dot com
2022-05-30 10:07 ` fweimer at redhat dot com
2022-05-30 10:07 ` fweimer at redhat dot com
2022-05-30 11:56 ` tuliom at ascii dot art.br
2022-05-30 14:05 ` carlos at redhat dot com
2022-06-01  8:04 ` linkw at linux dot ibm.com
2022-06-06 18:57 ` msc at linux dot ibm.com
2022-06-07  3:04 ` linkw at gcc dot gnu.org
2022-06-07 14:32 ` msc at linux dot ibm.com
2022-06-07 14:32 ` msc at linux dot ibm.com
2022-06-07 19:03 ` msc at linux dot ibm.com
2022-06-07 20:00 ` msc at linux dot ibm.com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).