[kirkstone] llvm: Fix CVE-2024-31852

From: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
---
 .../llvm/0008-llvm-Fix-CVE-2024-31852-1.patch |  85 +++++++++++++
 .../llvm/0009-llvm-Fix-CVE-2024-31852-2.patch | 117 ++++++++++++++++++
 meta/recipes-devtools/llvm/llvm_git.bb        |   2 +
 3 files changed, 204 insertions(+)
 create mode 100644 meta/recipes-devtools/llvm/llvm/0008-llvm-Fix-CVE-2024-31852-1.patch
 create mode 100644 meta/recipes-devtools/llvm/llvm/0009-llvm-Fix-CVE-2024-31852-2.patch

On Tue, Jul 30, 2024 at 5:15 AM Hemraj, Deepthi via
lists.openembedded.org
<Deepthi.Hemraj=windriver.com@lists.openembedded.org> wrote:
>
> From: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
>
> Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
> ---
>  .../llvm/0008-llvm-Fix-CVE-2024-31852-1.patch |  85 +++++++++++++
>  .../llvm/0009-llvm-Fix-CVE-2024-31852-2.patch | 117 ++++++++++++++++++
>  meta/recipes-devtools/llvm/llvm_git.bb        |   2 +
>  3 files changed, 204 insertions(+)
>  create mode 100644 meta/recipes-devtools/llvm/llvm/0008-llvm-Fix-CVE-2024-31852-1.patch
>  create mode 100644 meta/recipes-devtools/llvm/llvm/0009-llvm-Fix-CVE-2024-31852-2.patch

Preferred filenames would be just CVE-2024-31852-1.patch and
CVE-2024-31852-2.patch

No need to send a V2 as I've fixed this on my end.

Thanks!

Steve

>
> diff --git a/meta/recipes-devtools/llvm/llvm/0008-llvm-Fix-CVE-2024-31852-1.patch b/meta/recipes-devtools/llvm/llvm/0008-llvm-Fix-CVE-2024-31852-1.patch
> new file mode 100644
> index 0000000000..7cf4a52715
> --- /dev/null
> +++ b/meta/recipes-devtools/llvm/llvm/0008-llvm-Fix-CVE-2024-31852-1.patch
> @@ -0,0 +1,85 @@
> +commit b1a5ee1febd8a903cec3dfdad61d57900dc3823e
> +Author: Florian Hahn <flo@fhahn.com>
> +Date:   Wed Dec 20 16:56:15 2023 +0100
> +
> +    [ARM] Check all terms in emitPopInst when clearing Restored for LR. (#75527)
> +
> +    emitPopInst checks a single function exit MBB. If other paths also exit
> +    the function and any of there terminators uses LR implicitly, it is not
> +    save to clear the Restored bit.
> +
> +    Check all terminators for the function before clearing Restored.
> +
> +    This fixes a mis-compile in outlined-fn-may-clobber-lr-in-caller.ll
> +    where the machine-outliner previously introduced BLs that clobbered LR
> +    which in turn is used by the tail call return.
> +
> +    Alternative to #73553
> +
> +Upstream-Status: Backport [https://github.com/llvm/llvm-project/commit/b1a5ee1febd8a903cec3dfdad61d57900dc3823e]
> +CVE: CVE-2024-31852
> +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
> +---
> +diff --git a/llvm/lib/Target/ARM/ARMFrameLowering.cpp b/llvm/lib/Target/ARM/ARMFrameLowering.cpp
> +index 025e43444f9c..a9acf338ebf5 100644
> +--- a/llvm/lib/Target/ARM/ARMFrameLowering.cpp
> ++++ b/llvm/lib/Target/ARM/ARMFrameLowering.cpp
> +@@ -1236,9 +1236,6 @@ void ARMFrameLowering::emitPopInst(MachineBasicBlock &MBB,
> +         // Fold the return instruction into the LDM.
> +         DeleteRet = true;
> +         LdmOpc = AFI->isThumbFunction() ? ARM::t2LDMIA_RET : ARM::LDMIA_RET;
> +-        // We 'restore' LR into PC so it is not live out of the return block:
> +-        // Clear Restored bit.
> +-        Info.setRestored(false);
> +       }
> +
> +       // If NoGap is true, pop consecutive registers and then leave the rest
> +@@ -2292,6 +2289,33 @@ void ARMFrameLowering::determineCalleeSaves(MachineFunction &MF,
> +   AFI->setLRIsSpilled(SavedRegs.test(ARM::LR));
> + }
> +
> ++void ARMFrameLowering::processFunctionBeforeFrameFinalized(
> ++    MachineFunction &MF, RegScavenger *RS) const {
> ++  TargetFrameLowering::processFunctionBeforeFrameFinalized(MF, RS);
> ++
> ++  MachineFrameInfo &MFI = MF.getFrameInfo();
> ++  if (!MFI.isCalleeSavedInfoValid())
> ++    return;
> ++
> ++  // Check if all terminators do not implicitly use LR. Then we can 'restore' LR
> ++  // into PC so it is not live out of the return block: Clear the Restored bit
> ++  // in that case.
> ++  for (CalleeSavedInfo &Info : MFI.getCalleeSavedInfo()) {
> ++    if (Info.getReg() != ARM::LR)
> ++      continue;
> ++    if (all_of(MF, [](const MachineBasicBlock &MBB) {
> ++          return all_of(MBB.terminators(), [](const MachineInstr &Term) {
> ++            return !Term.isReturn() || Term.getOpcode() == ARM::LDMIA_RET ||
> ++                   Term.getOpcode() == ARM::t2LDMIA_RET ||
> ++                   Term.getOpcode() == ARM::tPOP_RET;
> ++          });
> ++        })) {
> ++      Info.setRestored(false);
> ++      break;
> ++    }
> ++  }
> ++}
> ++
> + void ARMFrameLowering::getCalleeSaves(const MachineFunction &MF,
> +                                       BitVector &SavedRegs) const {
> +   TargetFrameLowering::getCalleeSaves(MF, SavedRegs);
> +diff --git a/llvm/lib/Target/ARM/ARMFrameLowering.h b/llvm/lib/Target/ARM/ARMFrameLowering.h
> +index 9822e2321bb4..266d642bb97b 100644
> +--- a/llvm/lib/Target/ARM/ARMFrameLowering.h
> ++++ b/llvm/lib/Target/ARM/ARMFrameLowering.h
> +@@ -58,6 +58,9 @@ public:
> +   void determineCalleeSaves(MachineFunction &MF, BitVector &SavedRegs,
> +                             RegScavenger *RS) const override;
> +
> ++  void processFunctionBeforeFrameFinalized(
> ++                 MachineFunction &MF, RegScavenger *RS = nullptr) const override;
> ++
> +   void adjustForSegmentedStacks(MachineFunction &MF,
> +                                 MachineBasicBlock &MBB) const override;
> +
> +
> diff --git a/meta/recipes-devtools/llvm/llvm/0009-llvm-Fix-CVE-2024-31852-2.patch b/meta/recipes-devtools/llvm/llvm/0009-llvm-Fix-CVE-2024-31852-2.patch
> new file mode 100644
> index 0000000000..b6082b0ef3
> --- /dev/null
> +++ b/meta/recipes-devtools/llvm/llvm/0009-llvm-Fix-CVE-2024-31852-2.patch
> @@ -0,0 +1,117 @@
> +commit 0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2
> +Author: ostannard <oliver.stannard@arm.com>
> +Date:   Mon Feb 26 12:23:25 2024 +0000
> +
> +    [ARM] Update IsRestored for LR based on all returns (#82745)
> +
> +    PR #75527 fixed ARMFrameLowering to set the IsRestored flag for LR based
> +    on all of the return instructions in the function, not just one.
> +    However, there is also code in ARMLoadStoreOptimizer which changes
> +    return instructions, but it set IsRestored based on the one instruction
> +    it changed, not the whole function.
> +
> +    The fix is to factor out the code added in #75527, and also call it from
> +    ARMLoadStoreOptimizer if it made a change to return instructions.
> +
> +    Fixes #80287.
> +
> +    (cherry picked from commit 749384c08e042739342c88b521c8ba5dac1b9276)
> +
> +Upstream-Status: Backport [https://github.com/llvm/llvm-project/commit/0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2]
> +CVE: CVE-2024-31852
> +Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
> +---
> +diff --git a/llvm/lib/Target/ARM/ARMFrameLowering.cpp b/llvm/lib/Target/ARM/ARMFrameLowering.cpp
> +index a9acf338ebf5..13d3cbf650ed 100644
> +--- a/llvm/lib/Target/ARM/ARMFrameLowering.cpp
> ++++ b/llvm/lib/Target/ARM/ARMFrameLowering.cpp
> +@@ -2289,10 +2289,7 @@ void ARMFrameLowering::determineCalleeSaves(MachineFunction &MF,
> +   AFI->setLRIsSpilled(SavedRegs.test(ARM::LR));
> + }
> +
> +-void ARMFrameLowering::processFunctionBeforeFrameFinalized(
> +-    MachineFunction &MF, RegScavenger *RS) const {
> +-  TargetFrameLowering::processFunctionBeforeFrameFinalized(MF, RS);
> +-
> ++void ARMFrameLowering::updateLRRestored(MachineFunction &MF) {
> +   MachineFrameInfo &MFI = MF.getFrameInfo();
> +   if (!MFI.isCalleeSavedInfoValid())
> +     return;
> +@@ -2316,6 +2313,12 @@ void ARMFrameLowering::processFunctionBeforeFrameFinalized(
> +   }
> + }
> +
> ++void ARMFrameLowering::processFunctionBeforeFrameFinalized(
> ++    MachineFunction &MF, RegScavenger *RS) const {
> ++  TargetFrameLowering::processFunctionBeforeFrameFinalized(MF, RS);
> ++  updateLRRestored(MF);
> ++}
> ++
> + void ARMFrameLowering::getCalleeSaves(const MachineFunction &MF,
> +                                       BitVector &SavedRegs) const {
> +   TargetFrameLowering::getCalleeSaves(MF, SavedRegs);
> +diff --git a/llvm/lib/Target/ARM/ARMFrameLowering.h b/llvm/lib/Target/ARM/ARMFrameLowering.h
> +index 67505b61a5e1..b13b76d7086c 100644
> +--- a/llvm/lib/Target/ARM/ARMFrameLowering.h
> ++++ b/llvm/lib/Target/ARM/ARMFrameLowering.h
> +@@ -58,6 +58,10 @@ public:
> +   void determineCalleeSaves(MachineFunction &MF, BitVector &SavedRegs,
> +                             RegScavenger *RS) const override;
> +
> ++  /// Update the IsRestored flag on LR if it is spilled, based on the return
> ++  /// instructions.
> ++  static void updateLRRestored(MachineFunction &MF);
> ++
> +   void processFunctionBeforeFrameFinalized(
> +                  MachineFunction &MF, RegScavenger *RS = nullptr) const override;
> +
> +diff --git a/llvm/lib/Target/ARM/ARMLoadStoreOptimizer.cpp b/llvm/lib/Target/ARM/ARMLoadStoreOptimizer.cpp
> +index fd06bfdf352c..561c1396190d 100644
> +--- a/llvm/lib/Target/ARM/ARMLoadStoreOptimizer.cpp
> ++++ b/llvm/lib/Target/ARM/ARMLoadStoreOptimizer.cpp
> +@@ -2060,17 +2060,6 @@ bool ARMLoadStoreOpt::MergeReturnIntoLDM(MachineBasicBlock &MBB) {
> +       MO.setReg(ARM::PC);
> +       PrevMI.copyImplicitOps(*MBB.getParent(), *MBBI);
> +       MBB.erase(MBBI);
> +-      // We now restore LR into PC so it is not live-out of the return block
> +-      // anymore: Clear the CSI Restored bit.
> +-      MachineFrameInfo &MFI = MBB.getParent()->getFrameInfo();
> +-      // CSI should be fixed after PrologEpilog Insertion
> +-      assert(MFI.isCalleeSavedInfoValid() && "CSI should be valid");
> +-      for (CalleeSavedInfo &Info : MFI.getCalleeSavedInfo()) {
> +-        if (Info.getReg() == ARM::LR) {
> +-          Info.setRestored(false);
> +-          break;
> +-        }
> +-      }
> +       return true;
> +     }
> +   }
> +@@ -2118,16 +2107,24 @@ bool ARMLoadStoreOpt::runOnMachineFunction(MachineFunction &Fn) {
> +   isThumb2 = AFI->isThumb2Function();
> +   isThumb1 = AFI->isThumbFunction() && !isThumb2;
> +
> +-  bool Modified = false;
> ++  bool Modified = false, ModifiedLDMReturn = false;
> +   for (MachineFunction::iterator MFI = Fn.begin(), E = Fn.end(); MFI != E;
> +        ++MFI) {
> +     MachineBasicBlock &MBB = *MFI;
> +     Modified |= LoadStoreMultipleOpti(MBB);
> +     if (STI->hasV5TOps())
> +-      Modified |= MergeReturnIntoLDM(MBB);
> ++      ModifiedLDMReturn |= MergeReturnIntoLDM(MBB);
> +     if (isThumb1)
> +       Modified |= CombineMovBx(MBB);
> +   }
> ++  Modified |= ModifiedLDMReturn;
> ++
> ++  // If we merged a BX instruction into an LDM, we need to re-calculate whether
> ++  // LR is restored. This check needs to consider the whole function, not just
> ++  // the instruction(s) we changed, because there may be other BX returns which
> ++  // still need LR to be restored.
> ++  if (ModifiedLDMReturn)
> ++    ARMFrameLowering::updateLRRestored(Fn);
> +
> +   Allocator.DestroyAll();
> +   return Modified;
> +
> diff --git a/meta/recipes-devtools/llvm/llvm_git.bb b/meta/recipes-devtools/llvm/llvm_git.bb
> index cedbfb138e..d342da649a 100644
> --- a/meta/recipes-devtools/llvm/llvm_git.bb
> +++ b/meta/recipes-devtools/llvm/llvm_git.bb
> @@ -33,6 +33,8 @@ SRC_URI = "git://github.com/llvm/llvm-project.git;branch=${BRANCH};protocol=http
>             file://0007-llvm-allow-env-override-of-exe-path.patch;striplevel=2 \
>             file://0001-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch;striplevel=2 \
>             file://0001-Support-Add-missing-cstdint-header-to-Signals.h.patch;striplevel=2 \
> +           file://0008-llvm-Fix-CVE-2024-31852-1.patch;striplevel=2 \
> +           file://0009-llvm-Fix-CVE-2024-31852-2.patch;striplevel=2 \
>             "
>
>  UPSTREAM_CHECK_GITTAGREGEX = "llvmorg-(?P<pver>\d+(\.\d+)+)"
> --
> 2.43.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#202674): https://lists.openembedded.org/g/openembedded-core/message/202674
> Mute This Topic: https://lists.openembedded.org/mt/107626200/3620601
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [steve@sakoman.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>