Bug 20327 - POWER8 strcasecmp returns incorrect result
Summary: POWER8 strcasecmp returns incorrect result
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: string (show other bugs)
Version: 2.24
: P2 normal
Target Milestone: 2.24
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-04 14:12 UTC by Florian Weimer
Modified: 2016-07-06 12:22 UTC (History)
2 users (show)

See Also:
Host:
Target: ppc64le. ppc64
Build:
Last reconfirmed:
fweimer: security-


Attachments
Proposed patch (672 bytes, patch)
2016-07-05 08:52 UTC, Rajalakshmi
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Weimer 2016-07-04 14:12:33 UTC
We have received a report of a build failure of krb5

  https://bugzilla.redhat.com/show_bug.cgi?id=1351737

induced by this commit:

commit c8376f3e07602aaef9cb843bb73cb5f2b860634a
Author: raji <raji@oc4354787705.ibm.com>
Date:   Tue Jun 14 14:51:16 2016 +0530

    powerpc: strcasecmp/strncasecmp optmization for power8
    
    This implementation utilizes vectors to improve performance
    compared to current byte by byte implementation for POWER7.
    The performance improvement is upto 4x.  This patch is tested
    on powerpc64 and powerpc64le.

I tried to reproduce this outside the krb5 build.  It does not seem to be a simple alignment issue.

At the start of strcasecmp, the arguments are:

(gdb) print (char *)$r3
$73 = 0x3fffb7e11fd8 "des3-cbc-sha1-kd"
(gdb) print (char *)$r4
$74 = 0x4e1b02f4 "des3-cbc-sha1-kd"

The surrounding memory looks like this:

0x3fffb7e11fc8: 100 'd' 101 'e' 115 's' 51 '3'  45 '-'  104 'h' 109 'm' 97 'a'
0x3fffb7e11fd0: 99 'c'  45 '-'  115 's' 104 'h' 97 'a'  49 '1'  0 '\000'        0 '\000'
0x3fffb7e11fd8: 100 'd' 101 'e' 115 's' 51 '3'  45 '-'  99 'c'  98 'b'  99 'c'
0x3fffb7e11fe0: 45 '-'  115 's' 104 'h' 97 'a'  49 '1'  45 '-'  107 'k' 100 'd'
0x3fffb7e11fe8: 0 '\000'        0 '\000'        0 '\000'        0 '\000'        0 '\000'        0 '
\000'   0 '\000'        0 '\000'
0x3fffb7e11ff0: 84 'T'  114 'r' 105 'i' 112 'p' 108 'l' 101 'e' 32 ' '  68 'D'

0x4e1b02e4:     105 'i' 110 'n' 115 's' 0 '\000'        33 '!'  0 '\000'        0 '\000'        0 '
\000'
0x4e1b02ec:     0 '\000'        0 '\000'        0 '\000'        0 '\000'        97 'a'  101 'e' 115
 's'    0 '\000'
0x4e1b02f4:     100 'd' 101 'e' 115 's' 51 '3'  45 '-'  99 'c'  98 'b'  99 'c'
0x4e1b02fc:     45 '-'  115 's' 104 'h' 97 'a'  49 '1'  45 '-'  107 'k' 100 'd'
0x4e1b0304:     0 '\000'        57 '9'  54 '6'  0 '\000'        49 '1'  0 '\000'        0 '\000'
     0 '\000'
0x4e1b030c:     0 '\000'        0 '\000'        0 '\000'        0 '\000'        18 '\022'       96
'`'     -54 '\312'      -86 '\252'
Comment 1 Rajalakshmi 2016-07-04 15:44:06 UTC
Checking.
Comment 2 Rajalakshmi 2016-07-04 16:30:47 UTC
Can you share the test that failed outside the krb5 build?
Comment 3 Florian Weimer 2016-07-04 17:51:20 UTC
Sorry, I couldn't reproduce it outside the krb5 build.  If you have access to a ppc64 Fedora system, you can reproduce it with

$ wget https://kojipkgs.fedoraproject.org//packages/krb5/1.14.1/8.fc25/src/krb5-1.14.1-8.fc25.src.rpm
$ mock -r fedora-rawhide-ppc64 krb5-1.14.1-8.fc25.src.rpm
Comment 4 Rajalakshmi 2016-07-05 07:26:07 UTC
Able to recreate it outside krb5 build. Found the cause and fixing it.
Comment 5 Rajalakshmi 2016-07-05 08:52:01 UTC
Created attachment 9378 [details]
Proposed patch
Comment 6 Rajalakshmi 2016-07-05 08:52:28 UTC
Is it possible to run mock build with this patch?
Comment 7 Florian Weimer 2016-07-05 12:05:21 UTC
(In reply to Rajalakshmi from comment #6)
> Is it possible to run mock build with this patch?

Thanks, I can confirm that this patch addresses the issue.  Please post it to libc-alpha (and include “[BZ #20327]” at the end of the subject/first line of the commit message).

I also have a regression test which covers this bug and will post it to the list shortly.
Comment 8 Rajalakshmi 2016-07-05 12:10:07 UTC
Thanks for testing.I have posted it in libc-alpha.
Comment 9 Florian Weimer 2016-07-05 16:33:55 UTC
Fixed in 2.24 with commit 30e4cc5413f72c2c728a544389da0c48500d9904.