[PATCH v1] x86: memcmp-avx2-movbe.S and memcmp-evex-movbe.S fix overflow bug.
Noah Goldstein
goldstein.w.n@gmail.com
Mon Jun 7 08:30:11 GMT 2021
Fix bugs introducted in commits:
author Noah Goldstein <goldstein.w.n@gmail.com>
Mon, 17 May 2021 17:57:24 +0000 (13:57 -0400)
commit 4ad473e97acdc5f6d811755b67c09f2128a644ce
And
author Noah Goldstein <goldstein.w.n@gmail.com>
Mon, 17 May 2021 17:56:52 +0000 (13:56 -0400)
commit 16d12015c57701b08d7bbed6ec536641bcafb428
Which added a bug which would cause pointer + length overflow to lead
to an early return as opposed to a Segmentation Fault.
Signed-off-by: Noah Goldstein <goldstein.w.n@gmail.com>
---
sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S | 13 ++++++++-----
sysdeps/x86_64/multiarch/memcmp-evex-movbe.S | 15 ++++++++-------
2 files changed, 16 insertions(+), 12 deletions(-)
diff --git a/sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S b/sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S
index 2621ec907a..4a9414ff61 100644
--- a/sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S
+++ b/sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S
@@ -60,6 +60,7 @@
# endif
# define VEC_SIZE 32
+# define LOG_VEC_SIZE 7
# define PAGE_SIZE 4096
/* Warning!
@@ -200,8 +201,7 @@ L(return_vec_2):
# endif
VZEROUPPER_RETURN
- /* NB: p2align 5 here to ensure 4x loop is 32 byte aligned. */
- .p2align 5
+ .p2align 4
L(8x_return_vec_0_1_2_3):
/* Returning from L(more_8x_vec) requires restoring rsi. */
addq %rdi, %rsi
@@ -232,7 +232,7 @@ L(return_vec_3):
# endif
VZEROUPPER_RETURN
- .p2align 4
+ .p2align 5
L(more_8x_vec):
/* Set end of s1 in rdx. */
leaq -(VEC_SIZE * 4)(%rdi, %rdx), %rdx
@@ -241,8 +241,11 @@ L(more_8x_vec):
subq %rdi, %rsi
/* Align s1 pointer. */
andq $-VEC_SIZE, %rdi
+ leaq -1(%rdx), %rax
+ subq %rdi, %rax
/* Adjust because first 4x vec where check already. */
subq $-(VEC_SIZE * 4), %rdi
+ sarq $LOG_VEC_SIZE, %rax
.p2align 4
L(loop_4x_vec):
/* rsi has s2 - s1 so get correct address by adding s1 (in rdi).
@@ -267,8 +270,8 @@ L(loop_4x_vec):
jnz L(8x_return_vec_0_1_2_3)
subq $-(VEC_SIZE * 4), %rdi
/* Check if s1 pointer at end. */
- cmpq %rdx, %rdi
- jb L(loop_4x_vec)
+ decq %rax
+ jne L(loop_4x_vec)
subq %rdx, %rdi
/* rdi has 4 * VEC_SIZE - remaining length. */
diff --git a/sysdeps/x86_64/multiarch/memcmp-evex-movbe.S b/sysdeps/x86_64/multiarch/memcmp-evex-movbe.S
index 654dc7ac8c..60be3f43e7 100644
--- a/sysdeps/x86_64/multiarch/memcmp-evex-movbe.S
+++ b/sysdeps/x86_64/multiarch/memcmp-evex-movbe.S
@@ -53,6 +53,7 @@
# endif
# define VEC_SIZE 32
+# define LOG_VEC_SIZE 7
# define PAGE_SIZE 4096
# define CHAR_PER_VEC (VEC_SIZE / CHAR_SIZE)
@@ -163,10 +164,7 @@ ENTRY (MEMCMP)
/* NB: eax must be zero to reach here. */
ret
- /* NB: aligning 32 here allows for the rest of the jump targets
- to be tuned for 32 byte alignment. Most important this ensures
- the L(more_8x_vec) loop is 32 byte aligned. */
- .p2align 5
+ .p2align 4
L(less_vec):
/* Check if one or less CHAR. This is necessary for size = 0 but
is also faster for size = CHAR_SIZE. */
@@ -277,7 +275,7 @@ L(return_vec_3):
# endif
ret
- .p2align 4
+ .p2align 5
L(more_8x_vec):
/* Set end of s1 in rdx. */
leaq -(VEC_SIZE * 4)(%rdi, %rdx, CHAR_SIZE), %rdx
@@ -286,8 +284,11 @@ L(more_8x_vec):
subq %rdi, %rsi
/* Align s1 pointer. */
andq $-VEC_SIZE, %rdi
+ leaq -1(%rdx), %rax
+ subq %rdi, %rax
/* Adjust because first 4x vec where check already. */
subq $-(VEC_SIZE * 4), %rdi
+ sarq $LOG_VEC_SIZE, %rax
.p2align 4
L(loop_4x_vec):
VMOVU (%rsi, %rdi), %YMM1
@@ -307,8 +308,8 @@ L(loop_4x_vec):
testl %ecx, %ecx
jnz L(8x_return_vec_0_1_2_3)
subq $-(VEC_SIZE * 4), %rdi
- cmpq %rdx, %rdi
- jb L(loop_4x_vec)
+ decq %rax
+ jnz L(loop_4x_vec)
subq %rdx, %rdi
/* rdi has 4 * VEC_SIZE - remaining length. */
--
2.25.1
More information about the Libc-alpha
mailing list