From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oi1-x233.google.com (mail-oi1-x233.google.com [IPv6:2607:f8b0:4864:20::233]) by sourceware.org (Postfix) with ESMTPS id D8C0A3858D33 for ; Tue, 31 Jan 2023 22:29:12 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org D8C0A3858D33 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-oi1-x233.google.com with SMTP id p185so14174125oif.2 for ; Tue, 31 Jan 2023 14:29:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=xHRX7mTDCGi73jaUuqFST05R88UVVT5dgBDCHaRBuFw=; b=AKVfJZENGm6dLSUVKUsO3Pvrv9irXSDvnap2NAGOA+8T0qmYiq61OLnb92WH933aIy 7G/z41AhnrzmH3k0mbJ1Au0PhqKPFNUBgmF5PzSQkynJ0n7Fmg9BpXP9IdhkhBjmY/0+ 36MKX+3MeSxZm6BIiMjJcqXCSnG3I2C96EKsZYd2mYyKF8KSeoFsOkozPMQ4yRODpYCX 3kz16hCKttZ+zyzcVH+4MuZypoxqhjt6WtTDslUuUqz/DWRsbJ5Wc8+/m7n4Wd4D4MLs vP9aggFHSoFOvMeBx//6fD0lYsPyXJuV0HMV0p1Ut2gdKprlReWo86n4uYMRFRvgnc1Z 7rSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=xHRX7mTDCGi73jaUuqFST05R88UVVT5dgBDCHaRBuFw=; b=Qv6omQBnqCnZnRu0rnQlf9Ifym7nb9kRDAkv+LgGzXnIiJ4JFRLO+kCV/Lbcrtc4nl NFZjrbfPZAN4zjbsfxNFGIog0EX4uf7Pk7VRid5zvxB4VC2guVCuH3UxJ5uiFq0IV+Fh ECXgM5T47iw4fxz/S1D3y6HjlqAxueEmxyGvBDSShSRf0m3wisYtdq3CsR+lGFVLt20B xSoqMBH8LzLM9THxsQl+h9ZkULBEIxAs2QG9AIUMcNTrJCwZ+Tjc17PinSiFCd6ZeMa7 kb4QkplMdatdr7Hl4jNf5skeZwf30uOK9Liqkuo65fiuM6JcCO/XjCzuZskIBCQNduHh rYIQ== X-Gm-Message-State: AO0yUKUV1DyWZEC2WSaO315dUr52avIMZ+cr2Ay56Ar8YdZc1hkJ3twg mQYJTPfGq09Rc45aw/uuTe5Z7vXy3TeyEs0wCyVRgrVwkXk= X-Google-Smtp-Source: AK7set85MEx1BkZxkfdWzSVEt7oqtClrdzVd6AYEk7a5Txy+kYCyMJc9KROIF9JnUOiPpXNOmBqPQGrIINJHJVXLbnc= X-Received: by 2002:aca:d0a:0:b0:378:15e:c61d with SMTP id 10-20020aca0d0a000000b00378015ec61dmr26293oin.298.1675204152148; Tue, 31 Jan 2023 14:29:12 -0800 (PST) MIME-Version: 1.0 References: <20230131213655.4033602-1-goldstein.w.n@gmail.com> In-Reply-To: <20230131213655.4033602-1-goldstein.w.n@gmail.com> From: "H.J. Lu" Date: Tue, 31 Jan 2023 14:28:36 -0800 Message-ID: Subject: Re: [PATCH v1] x86: Fix strncat-avx2.S when `src` has no null-term [BZ #30065] To: Noah Goldstein Cc: libc-alpha@sourceware.org, carlos@systemhalted.org Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-3022.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On Tue, Jan 31, 2023 at 1:37 PM Noah Goldstein wrote: > > Two issue: > > 1) Zero-length check is doing: > ``` > test %rdx, %rdx > jl L(zero_len) > ``` > which doesn't actually check zero (was at some point `decq` and the > flag never got updated). > > The fix is just make the flag `jle` i.e: > ``` > test %rdx, %rdx > jle L(zero_len) > ``` > > 2) Length check in page-cross case checking if we should continue is > doing: > ``` > cmpq %r8, %rdx > jb L(page_cross_small) > ``` > which means we will continue searching for null-term if length ends at > the end of a page and there was no null-term in `src`. It is not purely about null-term. strncat shouldn't read beyond the limit. In this case, src may point to PROT_NONE memory. > The fix is to make the flag: > ``` > cmpq %r8, %rdx > jbe L(page_cross_small) > ``` > --- > string/test-strncat.c | 25 ++++++++++++++++++++++++- > sysdeps/x86_64/multiarch/strncat-avx2.S | 4 ++-- > 2 files changed, 26 insertions(+), 3 deletions(-) > > diff --git a/string/test-strncat.c b/string/test-strncat.c > index e03d329e1c..c0cde206ee 100644 > --- a/string/test-strncat.c > +++ b/string/test-strncat.c > @@ -28,6 +28,7 @@ > # define CHAR char > # define UCHAR unsigned char > # define SIMPLE_STRNCAT simple_strncat > +# define STRNLEN strnlen > # define STRLEN strlen > # define MEMSET memset > # define MEMCPY memcpy > @@ -40,6 +41,7 @@ > # define CHAR wchar_t > # define UCHAR wchar_t > # define SIMPLE_STRNCAT simple_wcsncat > +# define STRNLEN wcsnlen > # define STRLEN wcslen > # define MEMSET wmemset > # define MEMCPY wmemcpy > @@ -78,7 +80,7 @@ do_one_test (impl_t *impl, CHAR *dst, const CHAR *src, size_t n) > return; > } > > - size_t len = STRLEN (src); > + size_t len = STRNLEN (src, n); > if (MEMCMP (dst + k, src, len + 1 > n ? n : len + 1) != 0) > { > error (0, 0, "Incorrect concatenation in function %s", > @@ -95,6 +97,26 @@ do_one_test (impl_t *impl, CHAR *dst, const CHAR *src, size_t n) > } > } > > +static void > +do_test_src_no_nullterm_bz30065 (void) > +{ > + /* NB: "src does not need to be null-terminated if it contains n or more > + * bytes." */ > + CHAR *s1, *s2; > + size_t bound = page_size / sizeof (CHAR); > + s1 = (CHAR *) (buf1 + BUF1PAGES * page_size); > + s2 = (CHAR *) buf2; > + MEMSET (s1 - bound, -1, bound); > + for (size_t n = 0; n < bound; ++n) > + { > + FOR_EACH_IMPL (impl, 0) > + { > + s2[0] = '\0'; > + do_one_test (impl, s2, s1 - n, n); > + } > + } > +} > + > static void > do_test (size_t align1, size_t align2, size_t len1, size_t len2, > size_t n, int max_char) > @@ -372,6 +394,7 @@ test_main (void) > > do_random_tests (); > do_overflow_tests (); > + do_test_src_no_nullterm_bz30065 (); > return ret; > } > > diff --git a/sysdeps/x86_64/multiarch/strncat-avx2.S b/sysdeps/x86_64/multiarch/strncat-avx2.S > index b380e8e11c..c2ff202238 100644 > --- a/sysdeps/x86_64/multiarch/strncat-avx2.S > +++ b/sysdeps/x86_64/multiarch/strncat-avx2.S > @@ -66,7 +66,7 @@ ENTRY(STRNCAT) > salq $2, %rdx > # else > test %rdx, %rdx > - jl L(zero_len) > + jle L(zero_len) > # endif > vpxor %VZERO_128, %VZERO_128, %VZERO_128 > > @@ -387,7 +387,7 @@ L(page_cross): > subl %esi, %r8d > andl $(VEC_SIZE - 1), %r8d > cmpq %r8, %rdx > - jb L(page_cross_small) > + jbe L(page_cross_small) > > /* Optimizing more aggressively for space as this is very cold > code. This saves 2x cache lines. */ > -- > 2.34.1 > -- H.J.