Commit | Line | Data |
---|---|---|
c86b5f1b EF |
1 | https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e |
2 | with the ChangeLog removed | |
3 | ||
4 | From 9aaaab7c6e4176e61c59b0a63c6ba906d875dc0e Mon Sep 17 00:00:00 2001 | |
5 | From: Andreas Schwab <schwab@suse.de> | |
6 | Date: Tue, 22 May 2018 10:37:59 +0200 | |
7 | Subject: [PATCH] Don't write beyond destination in | |
8 | __mempcpy_avx512_no_vzeroupper (bug 23196) | |
9 | ||
10 | When compiled as mempcpy, the return value is the end of the destination | |
11 | buffer, thus it cannot be used to refer to the start of it. | |
12 | --- | |
13 | ChangeLog | 9 +++++++++ | |
14 | string/test-mempcpy.c | 1 + | |
15 | sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S | 5 +++-- | |
16 | 3 files changed, 13 insertions(+), 2 deletions(-) | |
17 | ||
18 | diff --git a/string/test-mempcpy.c b/string/test-mempcpy.c | |
19 | index c08fba8..d98ecdd 100644 | |
20 | --- a/string/test-mempcpy.c | |
21 | +++ b/string/test-mempcpy.c | |
22 | @@ -18,6 +18,7 @@ | |
23 | <http://www.gnu.org/licenses/>. */ | |
24 | ||
25 | #define MEMCPY_RESULT(dst, len) (dst) + (len) | |
26 | +#define MIN_PAGE_SIZE 131072 | |
27 | #define TEST_MAIN | |
28 | #define TEST_NAME "mempcpy" | |
29 | #include "test-string.h" | |
30 | diff --git a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S | |
31 | index 23c0f7a..effc3ac 100644 | |
32 | --- a/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S | |
33 | +++ b/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S | |
34 | @@ -336,6 +336,7 @@ L(preloop_large): | |
35 | vmovups (%rsi), %zmm4 | |
36 | vmovups 0x40(%rsi), %zmm5 | |
37 | ||
38 | + mov %rdi, %r11 | |
39 | /* Align destination for access with non-temporal stores in the loop. */ | |
40 | mov %rdi, %r8 | |
41 | and $-0x80, %rdi | |
42 | @@ -366,8 +367,8 @@ L(gobble_256bytes_nt_loop): | |
43 | cmp $256, %rdx | |
44 | ja L(gobble_256bytes_nt_loop) | |
45 | sfence | |
46 | - vmovups %zmm4, (%rax) | |
47 | - vmovups %zmm5, 0x40(%rax) | |
48 | + vmovups %zmm4, (%r11) | |
49 | + vmovups %zmm5, 0x40(%r11) | |
50 | jmp L(check) | |
51 | ||
52 | L(preloop_large_bkw): | |
53 | -- | |
54 | 2.9.3 | |
55 |