[Bug 1978130] Re: Ubuntu22.04: glibc: __strncpy_power9() uses uninitialised register vs18 value for filling after \0

[Frank Heimes]

Meanwhile glibc 2.36-0ubuntu2 has landed in kinetic (release), hence the
affects kinetic entry can be marked as 'Fix Released' and with that the
entire entry is 'Fix Released'.

** Changed in: glibc (Ubuntu)
       Status: New => Fix Released

** Changed in: ubuntu-power-systems
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to glibc in Ubuntu.
https://bugs.launchpad.net/bugs/1978130

Title:
  Ubuntu22.04: glibc: __strncpy_power9() uses uninitialised register
  vs18 value for filling after \0

Status in The Ubuntu-power-systems project:
  Fix Released
Status in glibc package in Ubuntu:
  Fix Released
Status in glibc source package in Jammy:
  Fix Released

Bug description:
  SRU Justification:
  ==================

  [Impact]

   * glibc '__strncpy_power9()' uses uninitialized register vs18 value
     for filling after \0.

   * This can result in a crash / core dump.

   * This is fixed in the little endian Power 9 implementation
     of strncpy.S by using the proper VSX number for VR 18
     in stxv and stxvl.

  [Test Plan]

   * Have an Ubuntu Server 22.04 LTS running on Power 9
     (or compatible) hardware.

   * Take the C test program and reproducer from gere:
     https://sourceware.org/bugzilla/show_bug.cgi?id=29197
     compile it for power9 (ppc64le).

   * Execute it on ppc64el hardware and it will core dump
     on an unpatched libc6, e.g. using qemu, like:
     "qemu: uncaught target signal 6 (Aborted) - core dumped
      Aborted"

   * gdb will report the following value of c[]:
     (gdb) p c
     $1 = "\000\015\015"

  [Where problems could occur]

   * Severe problems can occur if wrong registers are used
     or the (zero-)padding is done in a wrong way
     or if the fix for stxv and stxvl were mixed up.

   * Relatively foreseen effects can happen and highly
     likely even more crashes.

   * But the code was thoroughly analysed, first as gcc bug
     then a glibc bug.

   * The changes are limited to:
     sysdeps/powerpc/powerpc64/le/power9
     and with that Power 9 specific,
     well explained, documented traceable and tested
     (not only on ppc64le - which is mostly relevant for Ubuntu - but
      also on ppc and ppc64.)

  [Other Info]
   
   * The fix is needed for Power 9 targets (22.04 is compiled for P9),
     has already been applied upstream for glibc 2.36
     and has been backported to glibc >= 2.33.

  __________

  == Comment: #0 - Tulio Magno Quites Machado Filho <tulioqm at br.ibm.com> - 2022-06-08 08:35:44 ==
  ---Problem Description---
  __strncpy_power9() uses uninitialised register vs18 value for filling after \0

  The fix has already been applied upstream for glibc 2.36 and has been
  backported to glibc >= 2.33.

  Commit for glibc 2.36:
  https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=0218463dd8265ed937622f88ac68c7d984fe0cfc

  Commit for glibc 2.35:
  https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=0a1572b8bb880a63d50a63b2afe4bb67704ac23e

  Contact Information = Tulio Magno Quites Machado
  Filho/tulioqm at br.ibm.com

  ---Additional Hardware Info---
  Requires Power9 or Power10 to reproduce

  ---uname output---
  N/A

  Machine Type = N/A

  ---Debugger---
  A debugger is not configured

  ---Steps to Reproduce---
   See the description from the bug reported upstream at: https://sourceware.org/bugzilla/show_bug.cgi?id=29197

  Userspace tool common name: glibc

  The userspace tool has the following bit modes: glibc

  Userspace rpm: libc6

  Userspace tool obtained from project website:  na

  *Additional Instructions for Tulio Magno Quites Machado Filho/tulioqm at br.ibm.com:
  -Attach ltrace and strace of userspace application.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-power-systems/+bug/1978130/+subscriptions