File s390-strstr-page-boundary.patch of Package glibc.14271

Overview Repositories Revisions Requests Users Attributes Meta

File s390-strstr-page-boundary.patch of Package glibc.14271

From bfdb731438206b0f70fe7afa890681155c30b419 Mon Sep 17 00:00:00 2001
From: Stefan Liebler <stli@linux.ibm.com>
Date: Wed, 27 Nov 2019 12:35:40 +0100
Subject: [PATCH] S390: Fix handling of needles crossing a page in strstr z15
 ifunc-variant. [BZ #25226]

If the specified needle crosses a page-boundary, the s390-z15 ifunc variant of
strstr truncates the needle which results in invalid results.

This is fixed by loading the needle beyond the page boundary to v18 instead of v16.
The bug is sometimes observable in test-strstr.c in check1 and check2 as the
haystack and needle is stored on stack. Thus the needle can be on a page boundary.

check2 is now extended to test haystack / needles located on stack, at end of page
and on two pages.

This bug was introduced with commit 6f47401bd5fc71209219779a0426170a9a7395b0
("S390: Add arch13 strstr ifunc variant.") and is already released in glibc 2.30.
---
 string/test-strstr.c         | 41 ++++++++++++++++++++++++++++++------
 sysdeps/s390/strstr-arch13.S |  2 +-
 2 files changed, 36 insertions(+), 7 deletions(-)

Index: glibc-2.26/string/test-strstr.c
===================================================================
--- glibc-2.26.orig/string/test-strstr.c
+++ glibc-2.26/string/test-strstr.c
@@ -137,16 +137,45 @@ check1 (void)
 static void
 check2 (void)
 {
-  const char s1[] = ", enable_static, \0, enable_shared, ";
+  const char s1_stack[] = ", enable_static, \0, enable_shared, ";
+  const size_t s1_byte_count = 18;
+  const char *s2_stack = &(s1_stack[s1_byte_count]);
+  const size_t s2_byte_count = 18;
   char *exp_result;
-  char *s2 = (void *) buf1 + page_size - 18;
+  const size_t page_size_real = getpagesize ();
 
-  strcpy (s2, s1);
-  exp_result = stupid_strstr (s1, s1 + 18);
+  /* Haystack at end of page.  The following page is protected.  */
+  char *s1_page_end = (void *) buf1 + page_size - s1_byte_count;
+  strcpy (s1_page_end, s1_stack);
+
+  /* Haystack which crosses a page boundary.
+     Note: page_size is at least 2 * getpagesize.  See test_init.  */
+  char *s1_page_cross = (void *) buf1 + page_size_real - 8;
+  strcpy (s1_page_cross, s1_stack);
+
+  /* Needle at end of page.  The following page is protected.  */
+  char *s2_page_end = (void *) buf2 + page_size - s2_byte_count;
+  strcpy (s2_page_end, s2_stack);
+
+  /* Needle which crosses a page boundary.
+     Note: page_size is at least 2 * getpagesize.  See test_init.  */
+  char *s2_page_cross = (void *) buf2 + page_size_real - 8;
+  strcpy (s2_page_cross, s2_stack);
+
+  exp_result = stupid_strstr (s1_stack, s2_stack);
   FOR_EACH_IMPL (impl, 0)
     {
-      check_result (impl, s1, s1 + 18, exp_result);
-      check_result (impl, s2, s1 + 18, exp_result);
+      check_result (impl, s1_stack, s2_stack, exp_result);
+      check_result (impl, s1_stack, s2_page_end, exp_result);
+      check_result (impl, s1_stack, s2_page_cross, exp_result);
+
+      check_result (impl, s1_page_end, s2_stack, exp_result);
+      check_result (impl, s1_page_end, s2_page_end, exp_result);
+      check_result (impl, s1_page_end, s2_page_cross, exp_result);
+
+      check_result (impl, s1_page_cross, s2_stack, exp_result);
+      check_result (impl, s1_page_cross, s2_page_end, exp_result);
+      check_result (impl, s1_page_cross, s2_page_cross, exp_result);
     }
 }
 
Index: glibc-2.26/sysdeps/s390/strstr-arch13.S
===================================================================
--- glibc-2.26.orig/sysdeps/s390/strstr-arch13.S
+++ glibc-2.26/sysdeps/s390/strstr-arch13.S
@@ -164,7 +164,7 @@ ENTRY(STRSTR_ARCH13)
 	vfenezb	%v19,%v18,%v18	/* Search zero in loaded needle bytes.  */
 	veclb	%v19,%v21	/* Zero index <= max loaded byte index?  */
 	jle	.Lneedle_loaded	/* -> v18 contains full needle.  */
-	vl	%v16,0(%r3)	/* Load needle beyond page boundary.  */
+	vl	%v18,0(%r3)	/* Load needle beyond page boundary.  */
 	vfenezb	%v19,%v18,%v18
 	j	.Lneedle_loaded
 END(STRSTR_ARCH13)

Places

File s390-strstr-page-boundary.patch of Package glibc.14271

Places