x86: Avoid integer truncation with large cache sizes (bug 32470)

Some hypervisors report 1 TiB L3 cache size.  This results
in some variables incorrectly getting zeroed, causing crashes
in memcpy/memmove because invariants are violated.

(cherry picked from commit 61c3450db96dce96ad2b24b4f0b548e6a46d68e5)
This commit is contained in:
Florian Weimer 2024-12-17 18:12:03 +01:00
parent 7ea35e28b4
commit d626c31ce5
2 changed files with 3 additions and 2 deletions

1
NEWS
View File

@ -102,6 +102,7 @@ The following bugs are resolved with this release:
[31968] mremap implementation in C does not handle arguments correctly
[32052] Name space violation in fortify wrappers
[32137] libio: Attempt wide backup free only for non-legacy code
[32470] x86: Avoid integer truncation with large cache sizes
Security related changes:

View File

@ -901,12 +901,12 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
#if HAVE_TUNABLES
/* NB: The REP MOVSB threshold must be greater than VEC_SIZE * 8. */
unsigned int minimum_rep_movsb_threshold;
unsigned long int minimum_rep_movsb_threshold;
#endif
/* NB: The default REP MOVSB threshold is 4096 * (VEC_SIZE / 16) for
VEC_SIZE == 64 or 32. For VEC_SIZE == 16, the default REP MOVSB
threshold is 2048 * (VEC_SIZE / 16). */
unsigned int rep_movsb_threshold;
unsigned long int rep_movsb_threshold;
if (CPU_FEATURE_USABLE_P (cpu_features, AVX512F)
&& !CPU_FEATURE_PREFERRED_P (cpu_features, Prefer_No_AVX512))
{