Skip to content

Commit 5fe667b

Browse files
CBL-Mariner-Botkevin-b-lockwood
CBL-Mariner-Bot
and
kevin-b-lockwood
authored
[AUTO-CHERRYPICK] [Medium] patch clang16 for CVE-2023-29933 - branch main (#13150)
Co-authored-by: Kevin Lockwood <57274670+kevin-b-lockwood@users.noreply.github.com>
1 parent 7f9f293 commit 5fe667b

5 files changed

Lines changed: 581 additions & 1 deletion

File tree

‎SPECS/clang/CVE-2023-29933.patch‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
From cb9d4e3e749f51749927d7531f2807ffebb3a398 Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <v-klockwood@microsoft.com>
3+
Date: Mon, 17 Mar 2025 15:57:34 -0700
4+
Subject: [PATCH] [Medium] patch clang16 for CVE-2023-29933
5+
6+
Link: https://github.com/llvm/llvm-project/commit/ae8cb6437294ca99ba203607c0dd522db4dbf6b6.patch
7+
---
8+
.../SCF/Transforms/BufferizableOpInterfaceImpl.cpp | 12 ++++++++----
9+
.../one-shot-bufferize-memory-space-invalid.mlir | 14 ++++++++++++++
10+
2 files changed, 22 insertions(+), 4 deletions(-)
11+
12+
diff --git a/mlir/lib/Dialect/SCF/Transforms/BufferizableOpInterfaceImpl.cpp b/mlir/lib/Dialect/SCF/Transforms/BufferizableOpInterfaceImpl.cpp
13+
index 630edd300..ad621e50c 100644
14+
--- a/mlir/lib/Dialect/SCF/Transforms/BufferizableOpInterfaceImpl.cpp
15+
+++ b/mlir/lib/Dialect/SCF/Transforms/BufferizableOpInterfaceImpl.cpp
16+
@@ -954,10 +954,12 @@ struct WhileOpInterface
17+
18+
auto conditionOp = whileOp.getConditionOp();
19+
for (const auto &it : llvm::enumerate(conditionOp.getArgs())) {
20+
+ Block *block = conditionOp->getBlock();
21+
if (!it.value().getType().isa<TensorType>())
22+
continue;
23+
- if (!state.areEquivalentBufferizedValues(
24+
- it.value(), conditionOp->getBlock()->getArgument(it.index())))
25+
+ if (it.index() >= block->getNumArguments() ||
26+
+ !state.areEquivalentBufferizedValues(it.value(),
27+
+ block->getArgument(it.index())))
28+
return conditionOp->emitError()
29+
<< "Condition arg #" << it.index()
30+
<< " is not equivalent to the corresponding iter bbArg";
31+
@@ -965,10 +967,12 @@ struct WhileOpInterface
32+
33+
auto yieldOp = whileOp.getYieldOp();
34+
for (const auto &it : llvm::enumerate(yieldOp.getResults())) {
35+
+ Block *block = yieldOp->getBlock();
36+
if (!it.value().getType().isa<TensorType>())
37+
continue;
38+
- if (!state.areEquivalentBufferizedValues(
39+
- it.value(), yieldOp->getBlock()->getArgument(it.index())))
40+
+ if (it.index() >= block->getNumArguments() ||
41+
+ !state.areEquivalentBufferizedValues(it.value(),
42+
+ block->getArgument(it.index())))
43+
return yieldOp->emitError()
44+
<< "Yield operand #" << it.index()
45+
<< " is not equivalent to the corresponding iter bbArg";
46+
diff --git a/mlir/test/Dialect/Bufferization/Transforms/one-shot-bufferize-memory-space-invalid.mlir b/mlir/test/Dialect/Bufferization/Transforms/one-shot-bufferize-memory-space-invalid.mlir
47+
index 5feeab0bc..6cd4b8a06 100644
48+
--- a/mlir/test/Dialect/Bufferization/Transforms/one-shot-bufferize-memory-space-invalid.mlir
49+
+++ b/mlir/test/Dialect/Bufferization/Transforms/one-shot-bufferize-memory-space-invalid.mlir
50+
@@ -9,6 +9,20 @@ func.func @alloc_tensor_without_memory_space() -> tensor<10xf32> {
51+
52+
// -----
53+
54+
+func.func @regression_scf_while() {
55+
+ %false = arith.constant false
56+
+ %8 = bufferization.alloc_tensor() : tensor<10x10xf32>
57+
+ scf.while (%arg0 = %8) : (tensor<10x10xf32>) -> () {
58+
+ scf.condition(%false)
59+
+ } do {
60+
+ // expected-error @+1 {{Yield operand #0 is not equivalent to the corresponding iter bbArg}}
61+
+ scf.yield %8 : tensor<10x10xf32>
62+
+ }
63+
+ return
64+
+}
65+
+
66+
+// -----
67+
+
68+
func.func @memory_space_of_unknown_op() -> f32 {
69+
%c0 = arith.constant 0 : index
70+
// expected-error @+1 {{could not infer memory space}}
71+
--
72+
2.34.1
73+

‎SPECS/clang/CVE-2023-29935.patch‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
From 012fcbff096e259de26aba5f9e88b05a56444faf Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <v-klockwood@microsoft.com>
3+
Date: Tue, 18 Mar 2025 14:07:29 -0700
4+
Subject: [PATCH] [Medium] patch clang16 for CVE-2023-29935
5+
6+
Link: https://github.com/llvm/llvm-project/commit/e7833c20d835d0f358acf7708a72bc23b1d87973.patch
7+
---
8+
.../Conversion/MemRefToLLVM/MemRefToLLVM.cpp | 31 ++----------
9+
.../MemRefToLLVM/memref-to-llvm.mlir | 48 +++++++++++++++----
10+
2 files changed, 45 insertions(+), 34 deletions(-)
11+
12+
diff --git a/mlir/lib/Conversion/MemRefToLLVM/MemRefToLLVM.cpp b/mlir/lib/Conversion/MemRefToLLVM/MemRefToLLVM.cpp
13+
index 7132560ad..a225553f5 100644
14+
--- a/mlir/lib/Conversion/MemRefToLLVM/MemRefToLLVM.cpp
15+
+++ b/mlir/lib/Conversion/MemRefToLLVM/MemRefToLLVM.cpp
16+
@@ -534,15 +534,12 @@ struct GenericAtomicRMWOpLowering
17+
18+
// Split the block into initial, loop, and ending parts.
19+
auto *initBlock = rewriter.getInsertionBlock();
20+
- auto *loopBlock = rewriter.createBlock(
21+
- initBlock->getParent(), std::next(Region::iterator(initBlock)),
22+
- valueType, loc);
23+
- auto *endBlock = rewriter.createBlock(
24+
- loopBlock->getParent(), std::next(Region::iterator(loopBlock)));
25+
+ auto *loopBlock = rewriter.splitBlock(initBlock, Block::iterator(atomicOp));
26+
+ loopBlock->addArgument(valueType, loc);
27+
28+
- // Operations range to be moved to `endBlock`.
29+
- auto opsToMoveStart = atomicOp->getIterator();
30+
- auto opsToMoveEnd = initBlock->back().getIterator();
31+
+
32+
+ auto *endBlock =
33+
+ rewriter.splitBlock(loopBlock, Block::iterator(atomicOp)++);
34+
35+
// Compute the loaded value and branch to the loop block.
36+
rewriter.setInsertionPointToEnd(initBlock);
37+
@@ -585,30 +582,12 @@ struct GenericAtomicRMWOpLowering
38+
loopBlock, newLoaded);
39+
40+
rewriter.setInsertionPointToEnd(endBlock);
41+
- moveOpsRange(atomicOp.getResult(), newLoaded, std::next(opsToMoveStart),
42+
- std::next(opsToMoveEnd), rewriter);
43+
44+
// The 'result' of the atomic_rmw op is the newly loaded value.
45+
rewriter.replaceOp(atomicOp, {newLoaded});
46+
47+
return success();
48+
}
49+
-
50+
-private:
51+
- // Clones a segment of ops [start, end) and erases the original.
52+
- void moveOpsRange(ValueRange oldResult, ValueRange newResult,
53+
- Block::iterator start, Block::iterator end,
54+
- ConversionPatternRewriter &rewriter) const {
55+
- IRMapping mapping;
56+
- mapping.map(oldResult, newResult);
57+
- SmallVector<Operation *, 2> opsToErase;
58+
- for (auto it = start; it != end; ++it) {
59+
- rewriter.clone(*it, mapping);
60+
- opsToErase.push_back(&*it);
61+
- }
62+
- for (auto *it : opsToErase)
63+
- rewriter.eraseOp(it);
64+
- }
65+
};
66+
67+
/// Returns the LLVM type of the global variable given the memref type `type`.
68+
diff --git a/mlir/test/Conversion/MemRefToLLVM/memref-to-llvm.mlir b/mlir/test/Conversion/MemRefToLLVM/memref-to-llvm.mlir
69+
index 1a8a75d1e..ba2d75fc6 100644
70+
--- a/mlir/test/Conversion/MemRefToLLVM/memref-to-llvm.mlir
71+
+++ b/mlir/test/Conversion/MemRefToLLVM/memref-to-llvm.mlir
72+
@@ -366,16 +366,48 @@ func.func @generic_atomic_rmw(%I : memref<10xi32>, %i : index) {
73+
^bb0(%old_value : i32):
74+
memref.atomic_yield %old_value : i32
75+
}
76+
- // CHECK: [[init:%.*]] = llvm.load %{{.*}} : !llvm.ptr<i32>
77+
- // CHECK-NEXT: llvm.br ^bb1([[init]] : i32)
78+
- // CHECK-NEXT: ^bb1([[loaded:%.*]]: i32):
79+
- // CHECK-NEXT: [[pair:%.*]] = llvm.cmpxchg %{{.*}}, [[loaded]], [[loaded]]
80+
- // CHECK-SAME: acq_rel monotonic : i32
81+
- // CHECK-NEXT: [[new:%.*]] = llvm.extractvalue [[pair]][0]
82+
- // CHECK-NEXT: [[ok:%.*]] = llvm.extractvalue [[pair]][1]
83+
- // CHECK-NEXT: llvm.cond_br [[ok]], ^bb2, ^bb1([[new]] : i32)
84+
llvm.return
85+
}
86+
+// CHECK: %[[INIT:.*]] = llvm.load %{{.*}} : !llvm.ptr -> i32
87+
+// CHECK-NEXT: llvm.br ^bb1(%[[INIT]] : i32)
88+
+// CHECK-NEXT: ^bb1(%[[LOADED:.*]]: i32):
89+
+// CHECK-NEXT: %[[PAIR:.*]] = llvm.cmpxchg %{{.*}}, %[[LOADED]], %[[LOADED]]
90+
+// CHECK-SAME: acq_rel monotonic : !llvm.ptr, i32
91+
+// CHECK-NEXT: %[[NEW:.*]] = llvm.extractvalue %[[PAIR]][0]
92+
+// CHECK-NEXT: %[[OK:.*]] = llvm.extractvalue %[[PAIR]][1]
93+
+// CHECK-NEXT: llvm.cond_br %[[OK]], ^bb2, ^bb1(%[[NEW]] : i32)
94+
+
95+
+// -----
96+
+
97+
+// CHECK-LABEL: func @generic_atomic_rmw_in_alloca_scope
98+
+func.func @generic_atomic_rmw_in_alloca_scope(){
99+
+ %c1 = arith.constant 1 : index
100+
+ %alloc = memref.alloc() : memref<2x3xi32>
101+
+ memref.alloca_scope {
102+
+ %0 = memref.generic_atomic_rmw %alloc[%c1, %c1] : memref<2x3xi32> {
103+
+ ^bb0(%arg0: i32):
104+
+ memref.atomic_yield %arg0 : i32
105+
+ }
106+
+ }
107+
+ return
108+
+}
109+
+// CHECK: %[[STACK_SAVE:.*]] = llvm.intr.stacksave : !llvm.ptr
110+
+// CHECK-NEXT: llvm.br ^bb1
111+
+// CHECK: ^bb1:
112+
+// CHECK: %[[INIT:.*]] = llvm.load %[[BUF:.*]] : !llvm.ptr -> i32
113+
+// CHECK-NEXT: llvm.br ^bb2(%[[INIT]] : i32)
114+
+// CHECK-NEXT: ^bb2(%[[LOADED:.*]]: i32):
115+
+// CHECK-NEXT: %[[PAIR:.*]] = llvm.cmpxchg %[[BUF]], %[[LOADED]], %[[LOADED]]
116+
+// CHECK-SAME: acq_rel monotonic : !llvm.ptr, i32
117+
+// CHECK-NEXT: %[[NEW:.*]] = llvm.extractvalue %[[PAIR]][0]
118+
+// CHECK-NEXT: %[[OK:.*]] = llvm.extractvalue %[[PAIR]][1]
119+
+// CHECK-NEXT: llvm.cond_br %[[OK]], ^bb3, ^bb2(%[[NEW]] : i32)
120+
+// CHECK-NEXT: ^bb3:
121+
+// CHECK-NEXT: llvm.intr.stackrestore %[[STACK_SAVE]] : !llvm.ptr
122+
+// CHECK-NEXT: llvm.br ^bb4
123+
+// CHECK-NEXT: ^bb4:
124+
+// CHECK-NEXT: return
125+
+
126+
127+
// -----
128+
129+
--
130+
2.34.1
131+

‎SPECS/clang/CVE-2023-29941.patch‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From e6fa2c1c12edb30568f15af3891ec7607964968f Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <v-klockwood@microsoft.com>
3+
Date: Wed, 26 Feb 2025 14:03:35 -0800
4+
Subject: [PATCH] Patch llvm16 for CVE-2023-29941 [Medium]
5+
6+
Link: https://github.com/llvm/llvm-project/commit/9a29d87538842a29b430c6956a4f914896643691.patch
7+
---
8+
.../Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp | 3 +++
9+
1 file changed, 3 insertions(+)
10+
11+
diff --git a/mlir/lib/Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp b/mlir/lib/Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp
12+
index fc9476cd2..2db37a1e4 100644
13+
--- a/mlir/lib/Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp
14+
+++ b/mlir/lib/Dialect/SparseTensor/Transforms/SparseBufferRewriting.cpp
15+
@@ -728,6 +728,9 @@ LogicalResult matchAndRewriteSortOp(OpTy op, ValueRange xys, uint64_t nx,
16+
operands.push_back(v);
17+
}
18+
auto insertPoint = op->template getParentOfType<func::FuncOp>();
19+
+ if (!insertPoint)
20+
+ return failure();
21+
+
22+
SmallString<32> funcName(op.getStable() ? kSortStableFuncNamePrefix
23+
: kSortNonstableFuncNamePrefix);
24+
FuncGeneratorType funcGenerator =
25+
--
26+
2.34.1
27+

0 commit comments

Comments
 (0)