Bug 2183081

Summary: glibc: Incorrect x86 inline feraiseexcept
Product: Red Hat Enterprise Linux 8 Reporter: Jakub Jelinek <jakub>
Component: glibcAssignee: Florian Weimer <fweimer>
Status: CLOSED ERRATA QA Contact: Martin Coufal <mcoufal>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.5CC: ashankar, codonell, dj, fweimer, mcermak, pfrankli, sipoyare
Target Milestone: rcKeywords: Bugfix, Patch, Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: glibc-2.28-226.el8 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-11-14 15:49:05 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jakub Jelinek 2023-03-30 11:15:49 UTC
As mentioned in https://gcc.gnu.org/PR109344, the RHEL 8 (likely older RHEL too, RHEL 9 seems to be fine) glibc /usr/include/bits/fenv.h header contains an incorrect
inline version of feraiseexcept:
      /* One example of an invalid operation is 0.0 / 0.0.  */
      float __f = 0.0;

# ifdef __SSE_MATH__
      __asm__ __volatile__ ("divss %0, %0 " : : "x" (__f));
# else
      __asm__ __volatile__ ("fdiv %%st, %%st(0); fwait"
                            : "=t" (__f) : "0" (__f));
# endif
and
      float __f = 1.0;
      float __g = 0.0;

# ifdef __SSE_MATH__
      __asm__ __volatile__ ("divss %1, %0" : : "x" (__f), "x" (__g));
# else
      __asm__ __volatile__ ("fdivp %%st, %%st(1); fwait"
                            : "=t" (__f) : "0" (__f), "u" (__g) : "st(1)");
# endif
is incorrect for defined(__SSE_MATH__), because it modifies whatever register holds __f without telling the compiler about it.
It should be
      __asm__ __volatile__ ("divss %0, %0 " : "+x" (__f));
and
      __asm__ __volatile__ ("divss %1, %0" : "+x" (__f) : "x" (__g));
Without that, GCC can assume after pxor %xmm0, %xmm0 that %xmm0 contains 0.0
even after divss %xmm0, %xmm0, which is not the case, it is then qNaN, and so doesn't raise division by zero exception when trying to divide 1.0 by that.

Comment 1 Florian Weimer 2023-04-21 13:17:55 UTC
The out-of-line copy was fixed upstream via:

commit 5d1ccdda7b0c625751661d50977f3dfbc73f8eae
Author: Florian Weimer <fweimer>
Date:   Mon Apr 3 17:23:11 2023 +0200

    x86_64: Fix asm constraints in feraiseexcept (bug 30305)
    
    The divss instruction clobbers its first argument, and the constraints
    need to reflect that.  Fortunately, with GCC 12, generated code does
    not actually change, so there is no externally visible bug.
    
    Suggested-by: Jakub Jelinek <jakub>
    Reviewed-by: Noah Goldstein <goldstein.w.n>

A similar fix needs to be applied to the installed headers, as Jakub kindly explained.

Comment 2 Florian Weimer 2023-04-21 13:19:08 UTC
There's no intermediate fix for the installed headers because the inline functions were removed with the bug still present. (Upstream relies on GCC doing these optimizations.)

Comment 8 errata-xmlrpc 2023-11-14 15:49:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (glibc bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:7107