Event posted on 03-01-2010 06:52am CST by linux26port

Description of problem:

During a port of our product to a 2.6.27 kernel we found that the kernel implementation of strncmp on powerpc is buggy. The following is the implementation of strncmp in RHEL6 alpha3. The implementation has changed recently in the generic Linux kernel to use this assembler version in preference to the old 'C' version (which was used in, for example, RHEL5):

_GLOBAL(strncmp)
        PPC_LCMPI r5,0
        beqlr
        mtctr   r5
        addi    r5,r3,-1
        addi    r4,r4,-1
1:      lbzu    r3,1(r5)
        cmpwi   1,r3,0
        lbzu    r0,1(r4)
        subf.   r3,r0,r3
        beqlr   1
        bdnzt   eq,1b
        blr

The length argument is passed in r5, and the return value from strncmp is in passed back in r3. If length (r5) is zero, strncmp will return without explicitly setting r3 and the return value will be incorrect. Note that we have not confirmed/reproduced this bug on a RHEL6 release. We are raising this bug because it exists in other kernels and appears by code inspection to exist in RHEL6.

How reproducible:
Should be easy to reproduce using this simple kernel module:

----------------------------- 8< ---------------------------
#include <linux/init.h>
#include <linux/module.h>

char string1[1];
char string2[1];

size_t count_global = 0;

static int __init
strncmp_init(void)
{
        string1[0] = string2[0] = 0;

        if (strncmp(string1, string2, count_global)) printk("Strncmp Bug!\n");

        return 0;
}

module_init(strncmp_init);

static void __exit
strncmp_exit(void)
{
}

module_exit(strncmp_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Strncmp Bug");
----------------------------- 8< ---------------------------

Steps to Reproduce:
insmod the above module
Actual results:
Not provided
Expected results:
Additional info:
This event sent from IssueTracker by streeter  [Support Engineering Group]
 issue 581353

Event posted on 03-04-2010 03:05am CST by linux26port

Hi Robin

A few bits of extra information if it will be any help. The problem is
that in the current implementation of strncmp, if r5 (length) is zero,
this code at the top of the routine:

       PPC_LCMPI r5,0
       beqlr

will simply return straight back to the caller without setting r3. So r3
is whatever it was when strncmp was called in the calling code. If you
look in the same source file, arch/powerpc/lib/string.S, at the function
memcmp, which is semantically similar to strncmp, you can see how zero
length is handled:

_GLOBAL(memcmp)
        cmpwi   0,r5,0
        ble-    2f
        mtctr   r5
        addi    r6,r3,-1
        addi    r4,r4,-1
1:      lbzu    r3,1(r6)
        lbzu    r0,1(r4)
        subf.   r3,r0,r3
        bdnzt   2,1b
        blr
2:      li      r3,0
        blr




This event sent from IssueTracker by streeter  [Support Engineering Group]
 issue 581353

This was written by Steven Rostedt:

    commit 0119536cd314ef95553604208c25bc35581f7f0a
    Author: Steven Rostedt <rostedt>
    Date:   Sat Mar 1 03:04:57 2008 +1100

    [POWERPC] Add hand-coded assembly strcmp
    
    We have an assembly version of strncmp for the bootwrapper, but not
    for the kernel, so we end up using the C version in the kernel.  This
    takes the strncmp code from the bootup and copies it to the kernel
    proper, adding two instructions so it copes correctly with len==0.
    
    Signed-off-by: Steven Rostedt <srostedt>
    Signed-off-by: Paul Mackerras <paulus>

so I'm adding him to the cc list.

Created attachment 415368 [details]
Fix for strncmp()

Untested fix for strncmp() on powerpc.  I've posted it to the public powerpc development list.

adding Robin to cc. been exchanging email on this one with Robin

I've talked to David and we have agreed to go with a different patch here. I've posted the new patch to rh-kernel mailing list
http://post-office.corp.redhat.com/archives/rhkernel-list/2010-May/msg02561.html

Patch(es) available on kernel-2.6.32-31.el6

Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.