[PATCH v1] x86: memcmp-avx2-movbe.S and memcmp-evex-movbe.S fix overflow bug.

[Noah Goldstein <goldstein.w.n@gmail.com>]

Fix bugs introducted in commits:

author	Noah Goldstein <goldstein.w.n@gmail.com>
Mon, 17 May 2021 17:57:24 +0000 (13:57 -0400)
commit	4ad473e97acdc5f6d811755b67c09f2128a644ce

And

author	Noah Goldstein <goldstein.w.n@gmail.com>
Mon, 17 May 2021 17:56:52 +0000 (13:56 -0400)
commit	16d12015c57701b08d7bbed6ec536641bcafb428

Which added a bug which would cause pointer + length overflow to lead
to an early return as opposed to a Segmentation Fault.

Signed-off-by: Noah Goldstein <goldstein.w.n@gmail.com>
---
 sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S | 13 ++++++++-----
 sysdeps/x86_64/multiarch/memcmp-evex-movbe.S | 15 ++++++++-------
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S b/sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S
index 2621ec907a..4a9414ff61 100644
--- a/sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S
+++ b/sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S
@@ -60,6 +60,7 @@
 # endif
 
 # define VEC_SIZE 32
+# define LOG_VEC_SIZE	7
 # define PAGE_SIZE	4096
 
 /* Warning!
@@ -200,8 +201,7 @@ L(return_vec_2):
 # endif
 	VZEROUPPER_RETURN
 
-	/* NB: p2align 5 here to ensure 4x loop is 32 byte aligned.  */
-	.p2align 5
+	.p2align 4
 L(8x_return_vec_0_1_2_3):
 	/* Returning from L(more_8x_vec) requires restoring rsi.  */
 	addq	%rdi, %rsi
@@ -232,7 +232,7 @@ L(return_vec_3):
 # endif
 	VZEROUPPER_RETURN
 
-	.p2align 4
+	.p2align 5
 L(more_8x_vec):
 	/* Set end of s1 in rdx.  */
 	leaq	-(VEC_SIZE * 4)(%rdi, %rdx), %rdx
@@ -241,8 +241,11 @@ L(more_8x_vec):
 	subq	%rdi, %rsi
 	/* Align s1 pointer.  */
 	andq	$-VEC_SIZE, %rdi
+	leaq	-1(%rdx), %rax
+	subq	%rdi, %rax
 	/* Adjust because first 4x vec where check already.  */
 	subq	$-(VEC_SIZE * 4), %rdi
+	sarq	$LOG_VEC_SIZE, %rax
 	.p2align 4
 L(loop_4x_vec):
 	/* rsi has s2 - s1 so get correct address by adding s1 (in rdi).
@@ -267,8 +270,8 @@ L(loop_4x_vec):
 	jnz	L(8x_return_vec_0_1_2_3)
 	subq	$-(VEC_SIZE * 4), %rdi
 	/* Check if s1 pointer at end.  */
-	cmpq	%rdx, %rdi
-	jb	L(loop_4x_vec)
+	decq	%rax
+	jne	L(loop_4x_vec)
 
 	subq	%rdx, %rdi
 	/* rdi has 4 * VEC_SIZE - remaining length.  */
diff --git a/sysdeps/x86_64/multiarch/memcmp-evex-movbe.S b/sysdeps/x86_64/multiarch/memcmp-evex-movbe.S
index 654dc7ac8c..60be3f43e7 100644
--- a/sysdeps/x86_64/multiarch/memcmp-evex-movbe.S
+++ b/sysdeps/x86_64/multiarch/memcmp-evex-movbe.S
@@ -53,6 +53,7 @@
 # endif
 
 # define VEC_SIZE	32
+# define LOG_VEC_SIZE	7
 # define PAGE_SIZE	4096
 # define CHAR_PER_VEC	(VEC_SIZE / CHAR_SIZE)
 
@@ -163,10 +164,7 @@ ENTRY (MEMCMP)
 	/* NB: eax must be zero to reach here.  */
 	ret
 
-	/* NB: aligning 32 here allows for the rest of the jump targets
-	   to be tuned for 32 byte alignment. Most important this ensures
-	   the L(more_8x_vec) loop is 32 byte aligned.  */
-	.p2align 5
+	.p2align 4
 L(less_vec):
 	/* Check if one or less CHAR. This is necessary for size = 0 but
 	   is also faster for size = CHAR_SIZE.  */
@@ -277,7 +275,7 @@ L(return_vec_3):
 # endif
 	ret
 
-	.p2align 4
+	.p2align 5
 L(more_8x_vec):
 	/* Set end of s1 in rdx.  */
 	leaq	-(VEC_SIZE * 4)(%rdi, %rdx, CHAR_SIZE), %rdx
@@ -286,8 +284,11 @@ L(more_8x_vec):
 	subq	%rdi, %rsi
 	/* Align s1 pointer.  */
 	andq	$-VEC_SIZE, %rdi
+	leaq	-1(%rdx), %rax
+	subq	%rdi, %rax
 	/* Adjust because first 4x vec where check already.  */
 	subq	$-(VEC_SIZE * 4), %rdi
+	sarq	$LOG_VEC_SIZE, %rax
 	.p2align 4
 L(loop_4x_vec):
 	VMOVU	(%rsi, %rdi), %YMM1
@@ -307,8 +308,8 @@ L(loop_4x_vec):
 	testl	%ecx, %ecx
 	jnz	L(8x_return_vec_0_1_2_3)
 	subq	$-(VEC_SIZE * 4), %rdi
-	cmpq	%rdx, %rdi
-	jb	L(loop_4x_vec)
+	decq	%rax
+	jnz	L(loop_4x_vec)
 
 	subq	%rdx, %rdi
 	/* rdi has 4 * VEC_SIZE - remaining length.  */
-- 
2.25.1