This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH] Don't write beyond destination in __mempcpy_avx512_no_vzeroupper (bug 23196)
- From: "H.J. Lu" <hjl dot tools at gmail dot com>
- To: Andreas Schwab <schwab at suse dot de>, Andrew Senkevich <andrew dot n dot senkevich at gmail dot com>
- Cc: GNU C Library <libc-alpha at sourceware dot org>
- Date: Tue, 22 May 2018 04:58:48 -0700
- Subject: Re: [PATCH] Don't write beyond destination in __mempcpy_avx512_no_vzeroupper (bug 23196)
- References: <mvm1se4romh.fsf@suse.de>
On Tue, May 22, 2018 at 3:06 AM, Andreas Schwab <schwab@suse.de> wrote:
> [BZ #23196]
> CVE-2018-11237
> * sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
> (L(preloop_large)): Save initial destination pointer in %r11 and
> use it instead of %rax after the loop.
> * string/test-mempcpy.c (MIN_PAGE_SIZE): Define.
Please include your analysis in commit message.
> string/test-mempcpy.c | 1 +
> sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S | 5 +++--
> 2 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/string/test-mempcpy.c b/string/test-mempcpy.c
> index c08fba895e..d98ecdd2d9 100644
> --- a/string/test-mempcpy.c
> +++ b/string/test-mempcpy.c
> @@ -18,6 +18,7 @@
> <http://www.gnu.org/licenses/>. */
>
> #define MEMCPY_RESULT(dst, len) (dst) + (len)
> +#define MIN_PAGE_SIZE 131072
> #define TEST_MAIN
> #define TEST_NAME "mempcpy"
> #include "test-string.h"
The modified test does't fail on Skylake server with unchanged
memmove-avx512-no-vzeroupper.S. Can you modify the test
so that it fails with the original memmove-avx512-no-vzeroupper.S
on Skylake server?
> diff --git a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
> index 23c0f7a9ed..effc3ac2de 100644
> --- a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
> +++ b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
> @@ -336,6 +336,7 @@ L(preloop_large):
> vmovups (%rsi), %zmm4
> vmovups 0x40(%rsi), %zmm5
>
> + mov %rdi, %r11
> /* Align destination for access with non-temporal stores in the loop. */
> mov %rdi, %r8
> and $-0x80, %rdi
> @@ -366,8 +367,8 @@ L(gobble_256bytes_nt_loop):
> cmp $256, %rdx
> ja L(gobble_256bytes_nt_loop)
> sfence
> - vmovups %zmm4, (%rax)
> - vmovups %zmm5, 0x40(%rax)
> + vmovups %zmm4, (%r11)
> + vmovups %zmm5, 0x40(%r11)
> jmp L(check)
>
> L(preloop_large_bkw):
memmove-vec-unaligned-erms.S supports no vzeroupper:
#ifndef VZEROUPPER
# if VEC_SIZE > 16
# define VZEROUPPER vzeroupper
# else
# define VZEROUPPER
# endif
#endif
Should it be used instead?
--
H.J.