From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 7852) id 60E3B3856DF3; Thu, 5 May 2022 06:23:13 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 60E3B3856DF3 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Sunil Pandey To: glibc-cvs@sourceware.org Subject: [glibc/release/2.35/master] x86: Fix bug in strncmp-evex and strncmp-avx2 [BZ #28895] X-Act-Checkin: glibc X-Git-Author: Noah Goldstein X-Git-Refname: refs/heads/release/2.35/master X-Git-Oldrev: c394d7e11a2cc5d99dc1ba3833727c37536d4838 X-Git-Newrev: 676f7bcf11ad0bdae098a45fd7d48c1040cde4e1 Message-Id: <20220505062313.60E3B3856DF3@sourceware.org> Date: Thu, 5 May 2022 06:23:13 +0000 (GMT) X-BeenThere: glibc-cvs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Glibc-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 May 2022 06:23:13 -0000 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=676f7bcf11ad0bdae098a45fd7d48c1040cde4e1 commit 676f7bcf11ad0bdae098a45fd7d48c1040cde4e1 Author: Noah Goldstein Date: Tue Feb 15 20:27:21 2022 -0600 x86: Fix bug in strncmp-evex and strncmp-avx2 [BZ #28895] Logic can read before the start of `s1` / `s2` if both `s1` and `s2` are near the start of a page. To avoid having the result contimated by these comparisons the `strcmp` variants would mask off these comparisons. This was missing in the `strncmp` variants causing the bug. This commit adds the masking to `strncmp` so that out of range comparisons don't affect the result. test-strcmp, test-strncmp, test-wcscmp, and test-wcsncmp all pass as well a full xcheck on x86_64 linux. Reviewed-by: H.J. Lu (cherry picked from commit e108c02a5e23c8c88ce66d8705d4a24bb6b9a8bf) Diff: --- string/test-strncmp.c | 20 +++++++++++++++----- sysdeps/x86_64/multiarch/strcmp-avx2.S | 1 + sysdeps/x86_64/multiarch/strcmp-evex.S | 1 + 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/string/test-strncmp.c b/string/test-strncmp.c index 22b7dfa73b..358f40eb5f 100644 --- a/string/test-strncmp.c +++ b/string/test-strncmp.c @@ -437,13 +437,23 @@ check3 (void) static void check4 (void) { - const CHAR *s1 = L ("abc"); - CHAR *s2 = STRDUP (s1); + /* To trigger bug 28895; We need 1) both s1 and s2 to be within 32 bytes of + the end of the page. 2) For there to be no mismatch/null byte before the + first page cross. 3) For length (`n`) to be large enough for one string to + cross the page. And 4) for there to be either mismatch/null bytes before + the start of the strings. */ + + size_t size = 10; + size_t addr_mask = (getpagesize () - 1) ^ (sizeof (CHAR) - 1); + CHAR *s1 = (CHAR *)(buf1 + (addr_mask & 0xffa)); + CHAR *s2 = (CHAR *)(buf2 + (addr_mask & 0xfed)); + int exp_result; + STRCPY (s1, L ("tst-tlsmod%")); + STRCPY (s2, L ("tst-tls-manydynamic73mod")); + exp_result = SIMPLE_STRNCMP (s1, s2, size); FOR_EACH_IMPL (impl, 0) - check_result (impl, s1, s2, SIZE_MAX, 0); - - free (s2); + check_result (impl, s1, s2, size, exp_result); } int diff --git a/sysdeps/x86_64/multiarch/strcmp-avx2.S b/sysdeps/x86_64/multiarch/strcmp-avx2.S index 99e5349be8..07a5a2c889 100644 --- a/sysdeps/x86_64/multiarch/strcmp-avx2.S +++ b/sysdeps/x86_64/multiarch/strcmp-avx2.S @@ -661,6 +661,7 @@ L(ret8): # ifdef USE_AS_STRNCMP .p2align 4,, 10 L(return_page_cross_end_check): + andl %r10d, %ecx tzcntl %ecx, %ecx leal -VEC_SIZE(%rax, %rcx), %ecx cmpl %ecx, %edx diff --git a/sysdeps/x86_64/multiarch/strcmp-evex.S b/sysdeps/x86_64/multiarch/strcmp-evex.S index 6f42e3155a..56d8c118e4 100644 --- a/sysdeps/x86_64/multiarch/strcmp-evex.S +++ b/sysdeps/x86_64/multiarch/strcmp-evex.S @@ -689,6 +689,7 @@ L(ret8): # ifdef USE_AS_STRNCMP .p2align 4,, 10 L(return_page_cross_end_check): + andl %r10d, %ecx tzcntl %ecx, %ecx leal -VEC_SIZE(%rax, %rcx, SIZE_OF_CHAR), %ecx # ifdef USE_AS_WCSCMP