Bug 593129 - Powerpc strncmp does not handle zero length comparisons correctly
Powerpc strncmp does not handle zero length comparisons correctly
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: kernel (Show other bugs)
6.0
powerpc Linux
high Severity high
: rc
: ---
Assigned To: David Howells
Red Hat Kernel QE team
: Regression
Depends On:
Blocks: 1020786
  Show dependency treegraph
 
Reported: 2010-05-17 17:32 EDT by Issue Tracker
Modified: 2013-10-18 05:28 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1020786 (view as bug list)
Environment:
Last Closed: 2010-11-11 10:46:49 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Fix for strncmp() (1.53 KB, patch)
2010-05-20 05:51 EDT, David Howells
no flags Details | Diff

  None (edit)
Description Issue Tracker 2010-05-17 17:32:50 EDT
Escalated to Bugzilla from IssueTracker
Comment 1 Issue Tracker 2010-05-17 17:32:52 EDT
Event posted on 03-01-2010 06:52am CST by linux26port

Description of problem:

During a port of our product to a 2.6.27 kernel we found that the kernel implementation of strncmp on powerpc is buggy. The following is the implementation of strncmp in RHEL6 alpha3. The implementation has changed recently in the generic Linux kernel to use this assembler version in preference to the old 'C' version (which was used in, for example, RHEL5):

_GLOBAL(strncmp)
        PPC_LCMPI r5,0
        beqlr
        mtctr   r5
        addi    r5,r3,-1
        addi    r4,r4,-1
1:      lbzu    r3,1(r5)
        cmpwi   1,r3,0
        lbzu    r0,1(r4)
        subf.   r3,r0,r3
        beqlr   1
        bdnzt   eq,1b
        blr

The length argument is passed in r5, and the return value from strncmp is in passed back in r3. If length (r5) is zero, strncmp will return without explicitly setting r3 and the return value will be incorrect. Note that we have not confirmed/reproduced this bug on a RHEL6 release. We are raising this bug because it exists in other kernels and appears by code inspection to exist in RHEL6.

How reproducible:
Should be easy to reproduce using this simple kernel module:

----------------------------- 8< ---------------------------
#include <linux/init.h>
#include <linux/module.h>

char string1[1];
char string2[1];

size_t count_global = 0;

static int __init
strncmp_init(void)
{
        string1[0] = string2[0] = 0;

        if (strncmp(string1, string2, count_global)) printk("Strncmp Bug!\n");

        return 0;
}

module_init(strncmp_init);

static void __exit
strncmp_exit(void)
{
}

module_exit(strncmp_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Strncmp Bug");
----------------------------- 8< ---------------------------

Steps to Reproduce:
insmod the above module
Actual results:
Not provided
Expected results:
Additional info:
This event sent from IssueTracker by streeter  [Support Engineering Group]
 issue 581353
Comment 2 Issue Tracker 2010-05-17 17:32:53 EDT
Event posted on 03-04-2010 03:05am CST by linux26port

Hi Robin

A few bits of extra information if it will be any help. The problem is
that in the current implementation of strncmp, if r5 (length) is zero,
this code at the top of the routine:

       PPC_LCMPI r5,0
       beqlr

will simply return straight back to the caller without setting r3. So r3
is whatever it was when strncmp was called in the calling code. If you
look in the same source file, arch/powerpc/lib/string.S, at the function
memcmp, which is semantically similar to strncmp, you can see how zero
length is handled:

_GLOBAL(memcmp)
        cmpwi   0,r5,0
        ble-    2f
        mtctr   r5
        addi    r6,r3,-1
        addi    r4,r4,-1
1:      lbzu    r3,1(r6)
        lbzu    r0,1(r4)
        subf.   r3,r0,r3
        bdnzt   2,1b
        blr
2:      li      r3,0
        blr




This event sent from IssueTracker by streeter  [Support Engineering Group]
 issue 581353
Comment 3 David Howells 2010-05-20 04:57:41 EDT
This was written by Steven Rostedt:

    commit 0119536cd314ef95553604208c25bc35581f7f0a
    Author: Steven Rostedt <rostedt@goodmis.org>
    Date:   Sat Mar 1 03:04:57 2008 +1100

    [POWERPC] Add hand-coded assembly strcmp
    
    We have an assembly version of strncmp for the bootwrapper, but not
    for the kernel, so we end up using the C version in the kernel.  This
    takes the strncmp code from the bootup and copies it to the kernel
    proper, adding two instructions so it copes correctly with len==0.
    
    Signed-off-by: Steven Rostedt <srostedt@redhat.com>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

so I'm adding him to the cc list.
Comment 4 David Howells 2010-05-20 05:51:45 EDT
Created attachment 415368 [details]
Fix for strncmp()

Untested fix for strncmp() on powerpc.  I've posted it to the public powerpc development list.
Comment 5 Steve Best 2010-05-20 06:33:07 EDT
adding Robin to cc. been exchanging email on this one with Robin
Comment 8 Steve Best 2010-05-23 09:30:23 EDT
I've talked to David and we have agreed to go with a different patch here. I've posted the new patch to rh-kernel mailing list
http://post-office.corp.redhat.com/archives/rhkernel-list/2010-May/msg02561.html
Comment 9 Aristeu Rozanski 2010-05-28 16:38:31 EDT
Patch(es) available on kernel-2.6.32-31.el6
Comment 13 releng-rhel@redhat.com 2010-11-11 10:46:49 EST
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.