RE: [Linux-ia64] IA64 strncpy in 2.2.4-30 - bug and patch

Chen, Kenneth W
2002-11-07T02:56:52Z

[-- Attachment #1: Type: text/plain, Size: 1531 bytes --]

Here is a patch that fixes bugs in strncpy function included in glibc-2.2.4. We found there are more bugs during the investigation. Please pound on this patch and let us know any issues.

- Ken Chen

-----Original Message-----
From: Chen, Kenneth W
Sent: Tuesday, November 05, 2002 4:44 PM
To: Reese Faucette; bug-glibc@gnu.org; linux-ia64@linuxia64.org
Cc: Akyil, Levent; susan@myri.com
Subject: RE: [Linux-ia64] IA64 strncpy in 2.2.4-30 - bug and patch

I'm not able to reproduce the bug with your test case ...

-----Original Message-----
From: Reese Faucette [mailto:reese@myri.com]
Sent: Tuesday, November 05, 2002 4:39 PM
To: bug-glibc@gnu.org; linux-ia64@linuxia64.org
Cc: Akyil, Levent; susan@myri.com
Subject: [Linux-ia64] IA64 strncpy in 2.2.4-30 - bug and patch

Hi,
I opened a bug with RedHat about a problem with strncpy() in glibc-2.2.4-30 on IA64, see https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=76952, but I've been told you folks are really the ones to talk to.

The bug report contains a testcase illustrating the problem, and also a patch. In short, the recovery code is busted, even after the patch from David Mosberger. Attached is a copy of the patch from the bug report.

I have a testcase which exercizes both the recovery3 and recovery4 paths if you're interested.
Regards,
-reese faucette

_______________________________________________
Linux-IA64 mailing list
Linux-IA64@linuxia64.org
http://lists.linuxia64.org/lists/listinfo/linux-ia64

[-- Attachment #2: strncpy.fix.patch --]
[-- Type: application/octet-stream, Size: 1122 bytes --]

--- strncpy.S.orig Wed Nov 6 17:16:31 2002
+++ strncpy.S Wed Nov 6 18:47:25 2002
@@ -48,6 +48,7 @@
#define sh1 r29
#define loopcnt r30
#define value r31
+#define tmp2 r14

ENTRY(strncpy)
.prologue
@@ -62,6 +63,7 @@
mov saved_pr = pr // save the predicate registers
.save ar.lc, saved_lc
mov saved_lc = ar.lc // save the loop counter
+ mov ar.ec = 0
.body
cmp.geu p6, p5 = 24, in2
(p6) br.cond.spnt .short_len
@@ -209,15 +211,21 @@
mov pr = saved_pr, -1 // restore the predicate registers
br.ret.sptk.many b0
.recovery2:
+ sub tmp2=len,thresh
+ ;;
+ cmp.eq p8,p9=-8, tmp2
add tmp = -8, asrc ;;
- ld8 r[0] = [tmp]
+(p8) mov r[0] = r0
+(p9) ld8 r[0] = [tmp]
br.cond.sptk .back2
.recovery3:
- add tmp = -MEMLAT * 8, src ;;
+ add tmp = -(MEMLAT+1) * 8, src ;;
ld8 r[MEMLAT] = [tmp]
br.cond.sptk .back3
.recovery4:
- add tmp = -(MEMLAT - 1) * 8, src ;;
- ld8 r[MEMLAT - 1] = [tmp]
+ cmp.eq p8,p9=0, len
+ add tmp = -(MEMLAT) * 8, src ;;
+(p8) mov r[MEMLAT - 1] = r0
+(p9) ld8 r[MEMLAT - 1] = [tmp]