commit 4bbd0f866ad0ff197f72346f776ebee9b7e1a706
Author: Noah Goldstein <goldstein.w.n@gmail.com>
Date:   Fri Dec 3 15:29:25 2021 -0800

    x86-64: Use notl in EVEX strcmp [BZ #28646]
    
    Must use notl %edi here as lower bits are for CHAR comparisons
    potentially out of range thus can be 0 without indicating mismatch.
    This fixes BZ #28646.
    
    Co-Authored-By: H.J. Lu <hjl.tools@gmail.com>
    (cherry picked from commit 4df1fa6ddc8925a75f3da644d5da3bb16eb33f02)

diff --git a/string/test-strcmp.c b/string/test-strcmp.c
index 7feababf4ddc5603..a0255b9625fbcedd 100644
--- a/string/test-strcmp.c
+++ b/string/test-strcmp.c
@@ -25,6 +25,7 @@
 # define TEST_NAME "strcmp"
 #endif
 #include "test-string.h"
+#include <support/test-driver.h>
 
 #ifdef WIDE
 # include <wchar.h>
@@ -392,6 +393,32 @@ check2 (void)
 	}
 }
 
+static void
+check3 (void)
+{
+  size_t size = 0xd000 + 0x4000;
+  CHAR *s1, *s2;
+  CHAR *buffer1 = mmap (NULL, size, PROT_READ | PROT_WRITE,
+			MAP_PRIVATE | MAP_ANON, -1, 0);
+  CHAR *buffer2 = mmap (NULL, size, PROT_READ | PROT_WRITE,
+			MAP_PRIVATE | MAP_ANON, -1, 0);
+  if (buffer1 == MAP_FAILED || buffer1 == MAP_FAILED)
+    error (EXIT_UNSUPPORTED, errno, "mmap failed");
+
+  s1 = (CHAR *) (buffer1 + 0x8f8 / sizeof (CHAR));
+  s2 = (CHAR *) (buffer2 + 0xcff3 / sizeof (CHAR));
+
+  STRCPY(s1, L("/export/redhat/rpms/BUILD/java-1.8.0-openjdk-1.8.0.312.b07-2.fc35.x86_64/openjdk/langtools/src/share/classes/com/sun/tools/doclets/internal/toolkit/util/PathDocFileFactory.java"));
+  STRCPY(s2, L("/export/redhat/rpms/BUILD/java-1.8.0-openjdk-1.8.0.312.b07-2.fc35.x86_64/openjdk/langtools/src/share/classes/com/sun/tools/doclets/internal/toolkit/taglets/ThrowsTaglet.java"));
+
+  int exp_result = SIMPLE_STRCMP (s1, s2);
+  FOR_EACH_IMPL (impl, 0)
+    check_result (impl, s1, s2, exp_result);
+
+  munmap ((void *) buffer1, size);
+  munmap ((void *) buffer2, size);
+}
+
 int
 test_main (void)
 {
@@ -400,6 +427,7 @@ test_main (void)
   test_init ();
   check();
   check2 ();
+  check3 ();
 
   printf ("%23s", "");
   FOR_EACH_IMPL (impl, 0)
diff --git a/sysdeps/x86_64/multiarch/strcmp-evex.S b/sysdeps/x86_64/multiarch/strcmp-evex.S
index 82f12ac89bcae20b..6f5c4bf984da2b80 100644
--- a/sysdeps/x86_64/multiarch/strcmp-evex.S
+++ b/sysdeps/x86_64/multiarch/strcmp-evex.S
@@ -656,12 +656,13 @@ L(loop_cross_page):
 	   in YMM3 and 32 bytes at VEC_SIZE(%rdx, %r10).  */
 	VPCMP	$0, VEC_SIZE(%rdx, %r10), %YMM3, %k3{%k4}
 	kmovd	%k3, %edi
+    /* Must use notl %edi here as lower bits are for CHAR
+	   comparisons potentially out of range thus can be 0 without
+	   indicating mismatch.  */
+	notl	%edi
 # ifdef USE_AS_WCSCMP
 	/* Don't use subl since it is the upper 8 bits of EDI below.  */
-	notl	%edi
 	andl	$0xff, %edi
-# else
-	incl	%edi
 # endif
 
 # ifdef USE_AS_WCSCMP
@@ -743,12 +744,13 @@ L(loop_cross_page_2_vec):
 	   in YMM1 and 32 bytes at (VEC_SIZE * 3)(%rdx, %r10).  */
 	VPCMP	$0, (VEC_SIZE * 3)(%rdx, %r10), %YMM1, %k3{%k4}
 	kmovd	%k3, %edi
+	/* Must use notl %edi here as lower bits are for CHAR
+	   comparisons potentially out of range thus can be 0 without
+	   indicating mismatch.  */
+	notl	%edi
 # ifdef USE_AS_WCSCMP
 	/* Don't use subl since it is the upper 8 bits of EDI below.  */
-	notl	%edi
 	andl	$0xff, %edi
-# else
-	incl	%edi
 # endif
 
 # ifdef USE_AS_WCSCMP