[Bug string/29197] New: __strncpy_power9() uses uninitialised register vs18 value for filling after \0

["zsojka at seznam dot cz" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=29197

            Bug ID: 29197
           Summary: __strncpy_power9() uses uninitialised register vs18
                    value for filling after \0
           Product: glibc
           Version: 2.35
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: string
          Assignee: unassigned at sourceware dot org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
            Target: powerpc64le-unknown-linux-gnu

Hello,

originally reported as a gcc bug at https://gcc.gnu.org/PR105744 , but it was
analysed by Kewen Lin to be an issue in the glibc implementation.

The following program:
$ cat test_strncpy.c
#include <string.h>
#include <stdlib.h>

#define N 3
char a[N];
char c[N];

int
main (void)
{
  __asm__ volatile ("xxspltib 18, 0xf":::"vs18");
  strncpy (c, a, N);
  for (unsigned i = 0; i < N; i++)
    if (c[i])
      abort ();
  return 0;
}
$ powerpc64le-unknown-linux-gnu-gcc test_strncpy.c -static
$ qemu-ppc64le -- ./a.out 
qemu: uncaught target signal 6 (Aborted) - core dumped
Aborted

fails, with the value of c[] being:
(gdb) p c
$1 = "\000\015\015"


Quoting Kewen Lin:
---------------------
In
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=sysdeps/powerpc/powerpc64/le/power9/strncpy.S

        lbz     r0,0(r4)
        stb     r0,0(r3)
        addi    r11,r3,1
        addi    r5,r5,-1
        vspltisb v18,0          /* Zeroes in v18  */

...

L(zero_padding_end):
        sldi    r10,r5,56       /* stxvl wants size in top 8 bits  */
        stxvl   v18,r11,r10     /* Partial store  */
        blr


The code at label "zero_padding_end" is supposed to use v18, but the stxvl will
take the 18 as vsx No. instead of vr No, so it ends up to use the wrong
register vs18 instead of v18 for the store.
---------------------

Disassembling the object code shows the registers used (v18 / vs18):

...
   0x0000000010022f10 <+16>:      lbz     r0,0(r4)
   0x0000000010022f14 <+20>:      stb     r0,0(r3)
   0x0000000010022f18 <+24>:      addi    r11,r3,1
   0x0000000010022f1c <+28>:      addi    r5,r5,-1
   0x0000000010022f20 <+32>:      vspltisb v18,0
...
   0x000000001002319c <+668>:     rldicr  r10,r5,56,7
   0x00000000100231a0 <+672>:     stxvl   vs18,r11,r10
   0x00000000100231a4 <+676>:     blr

-- 
You are receiving this mail because:
You are on the CC list for the bug.