RE: [Linux-ia64] IA64 strncpy in 2.2.4-30 - bug and patch

["Chen, Kenneth W" <kenneth.w.chen@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 1531 bytes --]

Here is a patch that fixes bugs in strncpy function included in glibc-2.2.4.  We found there are more bugs during the investigation.  Please pound on this patch and let us know any issues.

- Ken Chen


-----Original Message-----
From: Chen, Kenneth W 
Sent: Tuesday, November 05, 2002 4:44 PM
To: Reese Faucette; bug-glibc@gnu.org; linux-ia64@linuxia64.org
Cc: Akyil, Levent; susan@myri.com
Subject: RE: [Linux-ia64] IA64 strncpy in 2.2.4-30 - bug and patch


I'm not able to reproduce the bug with your test case ...

-----Original Message-----
From: Reese Faucette [mailto:reese@myri.com]
Sent: Tuesday, November 05, 2002 4:39 PM
To: bug-glibc@gnu.org; linux-ia64@linuxia64.org
Cc: Akyil, Levent; susan@myri.com
Subject: [Linux-ia64] IA64 strncpy in 2.2.4-30 - bug and patch


Hi,
I opened a bug with RedHat about a problem with strncpy() in glibc-2.2.4-30 on IA64, see https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=76952, but I've been told you folks are really the ones to talk to.
 
The bug report contains a testcase illustrating the problem, and also a patch.  In short, the recovery code is busted, even after the patch from David Mosberger.  Attached is a copy of the patch from the bug report.
 
I have a testcase which exercizes both the recovery3 and recovery4 paths if you're interested.  
Regards,
-reese faucette
 
 


_______________________________________________
Linux-IA64 mailing list
Linux-IA64@linuxia64.org
http://lists.linuxia64.org/lists/listinfo/linux-ia64

[-- Attachment #2: strncpy.fix.patch --]
[-- Type: application/octet-stream, Size: 1122 bytes --]

--- strncpy.S.orig	Wed Nov  6 17:16:31 2002
+++ strncpy.S	Wed Nov  6 18:47:25 2002
@@ -48,6 +48,7 @@
 #define	sh1		r29
 #define loopcnt		r30
 #define	value		r31
+#define tmp2		r14
 
 ENTRY(strncpy)
 	.prologue
@@ -62,6 +63,7 @@
 	mov	saved_pr = pr           // save the predicate registers
 	.save ar.lc, saved_lc
 	mov 	saved_lc = ar.lc	// save the loop counter
+	mov	ar.ec = 0
 	.body
 	cmp.geu p6, p5 = 24, in2
 (p6)	br.cond.spnt .short_len
@@ -209,15 +211,21 @@
 	mov	pr = saved_pr, -1	// restore the predicate registers
 	br.ret.sptk.many b0
 .recovery2:
+	sub	tmp2=len,thresh
+	;;
+	cmp.eq	p8,p9=-8, tmp2
 	add	tmp = -8, asrc ;;
-	ld8	r[0] = [tmp]
+(p8)	mov	r[0] = r0
+(p9)	ld8	r[0] = [tmp]
 	br.cond.sptk .back2
 .recovery3:
-	add	tmp = -MEMLAT * 8, src ;;
+	add	tmp = -(MEMLAT+1) * 8, src ;;
 	ld8	r[MEMLAT] = [tmp]
 	br.cond.sptk .back3
 .recovery4:
-	add	tmp = -(MEMLAT - 1) * 8, src ;;
-	ld8	r[MEMLAT - 1] = [tmp]
+	cmp.eq	p8,p9=0, len
+	add	tmp = -(MEMLAT) * 8, src ;;
+(p8)	mov	r[MEMLAT - 1] = r0
+(p9)	ld8	r[MEMLAT - 1] = [tmp]
 	br.cond.sptk .back4
 END(strncpy)