mirror/glibc
2
0
Fork 0
mirror of git://sourceware.org/git/glibc.git synced 2024-11-27 03:41:23 +08:00
Code Issues Packages Projects Releases Wiki Activity
c1c0dea388
glibc/sysdeps/x86_64
History
Noah Goldstein b712be5264 x86: Prevent SIGSEGV in memcmp-sse2 when data is concurrently modified [BZ #29863] 
In the case of INCORRECT usage of `memcmp(a, b, N)` where `a` and `b`
are concurrently modified as `memcmp` runs, there can be a SIGSEGV
in `L(ret_nonzero_vec_end_0)` because the sequential logic
assumes that `(rdx - 32 + rax)` is a positive 32-bit integer.

To be clear, this change does not mean the usage of `memcmp` is
supported.  The program behaviour is undefined (UB) in the
presence of data races, and `memcmp` is incorrect when the values
of `a` and/or `b` are modified concurrently (data race). This UB
may manifest itself as a SIGSEGV. That being said, if we can
allow the idiomatic use cases, like those in yottadb with
opportunistic concurrency control (OCC), to execute without a
SIGSEGV, at no cost to regular use cases, then we can aim to
minimize harm to those existing users.

The fix replaces a 32-bit `addl %edx, %eax` with the 64-bit variant
`addq %rdx, %rax`. The 1-extra byte of code size from using the
64-bit instruction doesn't contribute to overall code size as the
next target is aligned and has multiple bytes of `nop` padding
before it. As well all the logic between the add and `ret` still
fits in the same fetch block, so the cost of this change is
basically zero.

The relevant sequential logic can be seen in the following
pseudo-code:
```
    /*
     * rsi = a
     * rdi = b
     * rdx = len - 32
     */
    /* cmp a[0:15] and b[0:15]. Since length is known to be [17, 32]
    in this case, this check is also assumed to cover a[0:(31 - len)]
    and b[0:(31 - len)].  */
    movups  (%rsi), %xmm0
    movups  (%rdi), %xmm1
    PCMPEQ  %xmm0, %xmm1
    pmovmskb %xmm1, %eax
    subl    %ecx, %eax
    jnz L(END_NEQ)

    /* cmp a[len-16:len-1] and b[len-16:len-1].  */
    movups  16(%rsi, %rdx), %xmm0
    movups  16(%rdi, %rdx), %xmm1
    PCMPEQ  %xmm0, %xmm1
    pmovmskb %xmm1, %eax
    subl    %ecx, %eax
    jnz L(END_NEQ2)
    ret

L(END2):
    /* Position first mismatch.  */
    bsfl    %eax, %eax

    /* The sequential version is able to assume this value is a
    positive 32-bit value because the first check included bytes in
    range a[0:(31 - len)] and b[0:(31 - len)] so `eax` must be
    greater than `31 - len` so the minimum value of `edx` + `eax` is
    `(len - 32) + (32 - len) >= 0`. In the concurrent case, however,
    `a` or `b` could have been changed so a mismatch in `eax` less or
    equal than `(31 - len)` is possible (the new low bound is `(16 -
    len)`. This can result in a negative 32-bit signed integer, which
    when zero extended to 64-bits is a random large value this out
    out of bounds. */
    addl %edx, %eax

    /* Crash here because 32-bit negative number in `eax` zero
    extends to out of bounds 64-bit offset.  */
    movzbl  16(%rdi, %rax), %ecx
    movzbl  16(%rsi, %rax), %eax
```

This fix is quite simple, just make the `addl %edx, %eax` 64 bit (i.e
`addq %rdx, %rax`). This prevents the 32-bit zero extension
and since `eax` is still a low bound of `16 - len` the `rdx + rax`
is bound by `(len - 32) - (16 - len) >= -16`. Since we have a
fixed offset of `16` in the memory access this must be in bounds.
2022-12-15 09:09:35 -08:00
..
64
fpu x86/fpu: Factor out shared avx2/avx512 code in svml_{s|d}_wrapper_impl.h 2022-11-27 20:22:49 -08:00
multiarch x86: Prevent SIGSEGV in memcmp-sse2 when data is concurrently modified [BZ #29863] 2022-12-15 09:09:35 -08:00
nptl elf: Introduce <dl-call_tls_init_tp.h> and call_tls_init_tp (bug 29249) 2022-11-03 17:28:03 +01:00
x32 x86-64 strncat: Properly handle the length parameter [BZ# 24097] 2022-12-02 08:18:10 -08:00
____longjmp_chk.S
__longjmp.S Introduce <pointer_guard.h>, extracted from <sysdep.h> 2022-10-18 17:03:55 +02:00
_mcount.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
abort-instr.h
add_n.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
addmul_1.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
bsd-_setjmp.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
bsd-setjmp.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
configure x86/configure.ac: Define PI_STATIC_AND_HIDDEN/SUPPORT_STATIC_PIE 2022-02-14 07:34:54 -08:00
configure.ac x86/configure.ac: Define PI_STATIC_AND_HIDDEN/SUPPORT_STATIC_PIE 2022-02-14 07:34:54 -08:00
crti.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
crtn.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
dl-hwcaps-subdirs.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
dl-irel.h Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
dl-machine.h x86-64: Only define used SSE/AVX/AVX512 run-time resolvers 2022-06-27 14:17:52 -07:00
dl-procinfo.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
dl-runtime.h Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
dl-tls.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
dl-tls.h Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
dl-tlsdesc.h Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
dl-tlsdesc.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
dl-trampoline.h x86-64: Small improvements to dl-trampoline.S 2022-06-29 19:47:52 -07:00
dl-trampoline.S x86-64: Small improvements to dl-trampoline.S 2022-06-29 19:47:52 -07:00
ffs.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
ffsll.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
ifuncmain8.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
ifuncmod8.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
Implies Remove dbl-64/wordsize-64 (part 2) 2021-01-07 15:26:26 +00:00
isa-default-impl.h x86: Remove faulty sanity tests for RTLD build with no multiarch 2022-06-23 11:14:08 -07:00
isa.h Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
jmpbuf-offsets.h Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
jmpbuf-unwind.h Use PTR_MANGLE and PTR_DEMANGLE unconditionally in C sources 2022-10-18 17:04:10 +02:00
l10nflist.c
link-defines.sym elf: Remove Intel MPX support (lazy PLT, ld.so profile, and LD_AUDIT) 2021-10-11 11:14:02 -07:00
locale-defines.sym
localplt.data elf: Rework exception handling in the dynamic loader [BZ #25486] 2022-11-03 09:39:31 +01:00
lshift.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
machine-gmon.h Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
Makefile x86: Add evex optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
memchr.S x86: Add support for compiling {raw|w}memchr with high ISA level 2022-06-22 19:41:35 -07:00
memcmp-isa-default-impl.h x86: Add support for building {w}memcmp{eq} with explicit ISA level 2022-07-05 16:42:42 -07:00
memcmp.S x86: Add support for building {w}memcmp{eq} with explicit ISA level 2022-07-05 16:42:42 -07:00
memcmpeq.S x86: Add support for building {w}memcmp{eq} with explicit ISA level 2022-07-05 16:42:42 -07:00
memcpy_chk.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
memcpy.S
memmove_chk.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
memmove.S x86: Add support for building {w}memmove{_chk} with explicit ISA level 2022-07-05 16:42:42 -07:00
mempcpy_chk.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
mempcpy.S
memrchr.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
memset_chk.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
memset.S x86: Add support for building {w}memset{_chk} with explicit ISA level 2022-07-05 16:42:42 -07:00
mp_clz_tab.c
mul_1.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
preconfigure
preconfigure.ac
rawmemchr.S x86: Add support for compiling {raw|w}memchr with high ISA level 2022-06-22 19:41:35 -07:00
rshift.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
rtld-offsets.sym
setjmp.S Introduce <pointer_guard.h>, extracted from <sysdep.h> 2022-10-18 17:03:55 +02:00
stackguard-macros.h
stackinfo.h nptl: x86_64: Use same code for CURRENT_STACK_FRAME and stackinfo_get_sp 2022-08-31 09:04:27 -03:00
start.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
stpcpy.S x86: Add support to build st{p|r}{n}{cpy|cat} with explicit ISA level 2022-07-16 03:07:59 -07:00
stpncpy.S x86: Add support to build st{p|r}{n}{cpy|cat} with explicit ISA level 2022-07-16 03:07:59 -07:00
strcasecmp_l-nonascii.c
strcasecmp_l.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strcasecmp.S
strcat.S x86: Add support to build st{p|r}{n}{cpy|cat} with explicit ISA level 2022-07-16 03:07:59 -07:00
strchr-isa-default-impl.h x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strchr.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strchrnul.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strcmp.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strcpy.S x86: Add support to build st{p|r}{n}{cpy|cat} with explicit ISA level 2022-07-16 03:07:59 -07:00
strcspn-generic.c x86: Add support for building str{c|p}{brk|spn} with explicit ISA level 2022-07-05 16:42:42 -07:00
strcspn.c x86: Add support for building str{c|p}{brk|spn} with explicit ISA level 2022-07-05 16:42:42 -07:00
strlen.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strncase_l-nonascii.c
strncase_l.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strncase.S
strncat.S x86: Add support to build st{p|r}{n}{cpy|cat} with explicit ISA level 2022-07-16 03:07:59 -07:00
strncmp.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strncpy.S x86: Add support to build st{p|r}{n}{cpy|cat} with explicit ISA level 2022-07-16 03:07:59 -07:00
strnlen.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strpbrk-generic.c x86: Add support for building str{c|p}{brk|spn} with explicit ISA level 2022-07-05 16:42:42 -07:00
strpbrk.c x86: Add support for building str{c|p}{brk|spn} with explicit ISA level 2022-07-05 16:42:42 -07:00
strrchr.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
strspn-generic.c x86: Add support for building str{c|p}{brk|spn} with explicit ISA level 2022-07-05 16:42:42 -07:00
strspn.c x86: Add support for building str{c|p}{brk|spn} with explicit ISA level 2022-07-05 16:42:42 -07:00
sub_n.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
submul_1.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
sysdep.h x86-64: Move LP_SIZE definition to its own header 2022-10-18 17:02:08 +02:00
tls_get_addr.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tlsdesc.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tlsdesc.sym
tst-audit3.c
tst-audit4-aux.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-audit4.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-audit5.c
tst-audit6.c
tst-audit7.c
tst-audit10-aux.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-audit10.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-audit.h Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-auditmod3a.c
tst-auditmod3b.c
tst-auditmod4a.c
tst-auditmod4b.c
tst-auditmod5a.c
tst-auditmod5b.c
tst-auditmod6a.c
tst-auditmod6b.c
tst-auditmod6c.c
tst-auditmod7a.c
tst-auditmod7b.c
tst-auditmod10a.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-auditmod10b.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-avx512-aux.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-avx512.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-avx512mod.c
tst-avx-aux.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-avx.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-avxmod.c
tst-glibc-hwcaps.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-platform-1.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-platformmod-1.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-platformmod-2.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-quad1.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-quad1pie.c
tst-quad2.c
tst-quad2pie.c
tst-quadmod1.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-quadmod1pie.S
tst-quadmod2.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-quadmod2pie.S
tst-rsi-strlen.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-rsi-wcslen.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-split-dynreloc.c
tst-split-dynreloc.lds
tst-sse.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
tst-ssemod.c
tst-x86-64-tls-1.c Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
varshift.c x86: Add support for building str{c|p}{brk|spn} with explicit ISA level 2022-07-05 16:42:42 -07:00
Versions
wcpcpy-generic.c x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcpcpy.S x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcpncpy-generic.c x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcpncpy.S x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcscat-generic.c x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcscat.S x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcschr.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
wcscmp.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
wcscpy-generic.c x86: Add support to build wcscpy with explicit ISA level 2022-07-16 03:07:59 -07:00
wcscpy.S x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcslen.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
wcsncat-generic.c x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcsncat.S x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcsncmp-generic.c x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
wcsncmp.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
wcsncpy-generic.c x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcsncpy.S x86: Add avx2 optimized functions for the wchar_t strcpy family 2022-11-08 19:22:33 -08:00
wcsnlen-generic.c x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
wcsnlen.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
wcsrchr.S x86: Add support to build strcmp/strlen/strchr with explicit ISA level 2022-07-16 03:07:59 -07:00
wmemchr.S x86: Add support for compiling {raw|w}memchr with high ISA level 2022-06-22 19:41:35 -07:00
wmemcmp.S x86: Add support for building {w}memcmp{eq} with explicit ISA level 2022-07-05 16:42:42 -07:00
wmemset_chk.S Update copyright dates with scripts/update-copyrights 2022-01-01 11:40:24 -08:00
wmemset.S
wordcopy.c
x86-lp_size.h x86-64: Move LP_SIZE definition to its own header 2022-10-18 17:02:08 +02:00