Skip to content

Commit 087cfc7

Browse files
CBL-Mariner-Botkevin-b-lockwood
CBL-Mariner-Bot
and
kevin-b-lockwood
authored
[AUTO-CHERRYPICK] [Medium] llvm16: patch CVE-2023-29941 - branch main (#12958)
Co-authored-by: Kevin Lockwood <57274670+kevin-b-lockwood@users.noreply.github.com>
1 parent fafee57 commit 087cfc7

3 files changed

Lines changed: 106 additions & 2 deletions

File tree

‎SPECS/llvm/CVE-2023-29933.patch‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
From 38e3c0f2a9d289afd1cf83f7def2e42823084c58 Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <v-klockwood@microsoft.com>
3+
Date: Wed, 26 Feb 2025 14:12:06 -0800
4+
Subject: [PATCH] Patch llvm16 for CVE-2023-29933 [Medium]
5+
6+
Link: https://github.com/llvm/llvm-project/commit/ae8cb6437294ca99ba203607c0dd522db4dbf6b6.patch
7+
---
8+
.../SCF/Transforms/BufferizableOpInterfaceImpl.cpp | 12 ++++++++----
9+
.../one-shot-module-bufferize-invalid.mlir | 14 ++++++++++++++
10+
2 files changed, 22 insertions(+), 4 deletions(-)
11+
12+
diff --git a/mlir/lib/Dialect/SCF/Transforms/BufferizableOpInterfaceImpl.cpp b/mlir/lib/Dialect/SCF/Transforms/BufferizableOpInterfaceImpl.cpp
13+
index 630edd300..ad621e50c 100644
14+
--- a/mlir/lib/Dialect/SCF/Transforms/BufferizableOpInterfaceImpl.cpp
15+
+++ b/mlir/lib/Dialect/SCF/Transforms/BufferizableOpInterfaceImpl.cpp
16+
@@ -954,10 +954,12 @@ struct WhileOpInterface
17+
18+
auto conditionOp = whileOp.getConditionOp();
19+
for (const auto &it : llvm::enumerate(conditionOp.getArgs())) {
20+
+ Block *block = conditionOp->getBlock();
21+
if (!it.value().getType().isa<TensorType>())
22+
continue;
23+
- if (!state.areEquivalentBufferizedValues(
24+
- it.value(), conditionOp->getBlock()->getArgument(it.index())))
25+
+ if (it.index() >= block->getNumArguments() ||
26+
+ !state.areEquivalentBufferizedValues(it.value(),
27+
+ block->getArgument(it.index())))
28+
return conditionOp->emitError()
29+
<< "Condition arg #" << it.index()
30+
<< " is not equivalent to the corresponding iter bbArg";
31+
@@ -965,10 +967,12 @@ struct WhileOpInterface
32+
33+
auto yieldOp = whileOp.getYieldOp();
34+
for (const auto &it : llvm::enumerate(yieldOp.getResults())) {
35+
+ Block *block = yieldOp->getBlock();
36+
if (!it.value().getType().isa<TensorType>())
37+
continue;
38+
- if (!state.areEquivalentBufferizedValues(
39+
- it.value(), yieldOp->getBlock()->getArgument(it.index())))
40+
+ if (it.index() >= block->getNumArguments() ||
41+
+ !state.areEquivalentBufferizedValues(it.value(),
42+
+ block->getArgument(it.index())))
43+
return yieldOp->emitError()
44+
<< "Yield operand #" << it.index()
45+
<< " is not equivalent to the corresponding iter bbArg";
46+
diff --git a/mlir/test/Dialect/Bufferization/Transforms/one-shot-module-bufferize-invalid.mlir b/mlir/test/Dialect/Bufferization/Transforms/one-shot-module-bufferize-invalid.mlir
47+
index da0fe74db..10075fc8a 100644
48+
--- a/mlir/test/Dialect/Bufferization/Transforms/one-shot-module-bufferize-invalid.mlir
49+
+++ b/mlir/test/Dialect/Bufferization/Transforms/one-shot-module-bufferize-invalid.mlir
50+
@@ -315,3 +315,17 @@ func.func @yield_alloc_dominance_test_2(%cst : f32, %idx : index,
51+
%r = tensor.extract %2[%idx2] : tensor<?xf32>
52+
return %r : f32
53+
}
54+
+
55+
+// -----
56+
+
57+
+func.func @regression_scf_while() {
58+
+ %false = arith.constant false
59+
+ %8 = bufferization.alloc_tensor() : tensor<10x10xf32>
60+
+ scf.while (%arg0 = %8) : (tensor<10x10xf32>) -> () {
61+
+ scf.condition(%false)
62+
+ } do {
63+
+ // expected-error @+1 {{Yield operand #0 is not equivalent to the corresponding iter bbArg}}
64+
+ scf.yield %8 : tensor<10x10xf32>
65+
+ }
66+
+ return
67+
+}
68+
--
69+
2.34.1
70+

‎SPECS/llvm/CVE-2023-29941.patch‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From e6fa2c1c12edb30568f15af3891ec7607964968f Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <v-klockwood@microsoft.com>
3+
Date: Wed, 26 Feb 2025 14:03:35 -0800
4+
Subject: [PATCH] Patch llvm16 for CVE-2023-29941 [Medium]
5+
6+
Link: https://github.com/llvm/llvm-project/commit/9a29d87538842a29b430c6956a4f914896643691.patch
7+
---
8+
.../Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp | 3 +++
9+
1 file changed, 3 insertions(+)
10+
11+
diff --git a/mlir/lib/Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp b/mlir/lib/Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp
12+
index fc9476cd2..2db37a1e4 100644
13+
--- a/mlir/lib/Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp
14+
+++ b/mlir/lib/Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp
15+
@@ -728,6 +728,9 @@ LogicalResult matchAndRewriteSortOp(OpTy op, ValueRange xys, uint64_t nx,
16+
operands.push_back(v);
17+
}
18+
auto insertPoint = op->template getParentOfType<func::FuncOp>();
19+
+ if (!insertPoint)
20+
+ return failure();
21+
+
22+
SmallString<32> funcName(op.getStable() ? kSortStableFuncNamePrefix
23+
: kSortNonstableFuncNamePrefix);
24+
FuncGeneratorType funcGenerator =
25+
--
26+
2.34.1
27+

‎SPECS/llvm/llvm16.spec‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,21 @@
11
Summary: A collection of modular and reusable compiler and toolchain technologies.
22
Name: llvm16
33
Version: 16.0.0
4-
Release: 3%{?dist}
4+
Release: 4%{?dist}
55
License: NCSA
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: Development/Tools
99
URL: https://llvm.org/
1010
Source0: https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-%{version}.tar.gz
11+
Patch0: CVE-2023-29941.patch
12+
Patch1: CVE-2023-29933.patch
1113
BuildRequires: cmake
1214
BuildRequires: libffi-devel
1315
BuildRequires: libxml2-devel
1416
BuildRequires: ninja-build
1517
BuildRequires: python3-devel
18+
BuildRequires: python3-psutil
1619
Requires: libxml2
1720
Provides: %{name} = %{version}
1821
Provides: %{name} = %{version}-%{release}
@@ -29,7 +32,7 @@ The llvm-devel package contains libraries, header files and documentation
2932
for developing applications that use llvm.
3033

3134
%prep
32-
%setup -q -n llvm-project-llvmorg-%{version}
35+
%autosetup -p1 -n llvm-project-llvmorg-%{version}
3336

3437
%build
3538
# Disable symbol generation
@@ -89,6 +92,10 @@ ninja check-all
8992
%{_includedir}/*
9093

9194
%changelog
95+
* Mon Feb 24 2025 Kevin Lockwood <v-klockwood@microsoft.com> - 16.0.0-4
96+
- Add patch for CVE-2023-29941
97+
- Add patch for CVE-2023-29933
98+
9299
* Thu Jun 29 2023 Andrew Phelps <anphel@microsoft.com> - 16.0.0-3
93100
- Modify parallel compile jobs limit to _smp_ncpus_max if set, or _smp_build_ncpus
94101

0 commit comments

Comments
 (0)