CVE-2021-47428

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powerpc/64s: fix program check interrupt emergency stack path<br /> <br /> Emergency stack path was jumping into a 3: label inside the<br /> __GEN_COMMON_BODY macro for the normal path after it had finished,<br /> rather than jumping over it. By a small miracle this is the correct<br /> place to build up a new interrupt frame with the existing stack<br /> pointer, so things basically worked okay with an added weird looking<br /> 700 trap frame on top (which had the wrong -&gt;nip so it didn&amp;#39;t decode<br /> bug messages either).<br /> <br /> Fix this by avoiding using numeric labels when jumping over non-trivial<br /> macros.<br /> <br /> Before:<br /> <br /> LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV<br /> Modules linked in:<br /> CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637<br /> NIP: 7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0<br /> REGS: c0000000fffb3a50 TRAP: 0700 Not tainted<br /> MSR: 9000000000021031 CR: 00000700 XER: 20040000<br /> CFAR: c0000000000098b0 IRQMASK: 0<br /> GPR00: c00000000006c964 c0000000fffb3cf0 c000000001513800 0000000000000000<br /> GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299<br /> GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8<br /> GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001<br /> GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8<br /> GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158<br /> GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300<br /> GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80<br /> NIP [7265677368657265] 0x7265677368657265<br /> LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10<br /> Call Trace:<br /> [c0000000fffb3cf0] [c00000000000bdac] soft_nmi_common+0x13c/0x1d0 (unreliable)<br /> --- interrupt: 700 at decrementer_common_virt+0xb8/0x230<br /> NIP: c0000000000098b8 LR: c00000000006c0c8 CTR: c0000000000097f0<br /> REGS: c0000000fffb3d60 TRAP: 0700 Not tainted<br /> MSR: 9000000000021031 CR: 22424282 XER: 20040000<br /> CFAR: c0000000000098b0 IRQMASK: 0<br /> GPR00: c00000000006c964 0000000000002400 c000000001513800 0000000000000000<br /> GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299<br /> GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8<br /> GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001<br /> GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8<br /> GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158<br /> GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300<br /> GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80<br /> NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230<br /> LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10<br /> --- interrupt: 700<br /> Instruction dump:<br /> XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX<br /> XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX<br /> ---[ end trace 6d28218e0cc3c949 ]---<br /> <br /> After:<br /> <br /> ------------[ cut here ]------------<br /> kernel BUG at arch/powerpc/kernel/exceptions-64s.S:491!<br /> Oops: Exception in kernel mode, sig: 5 [#1]<br /> LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV<br /> Modules linked in:<br /> CPU: 0 PID: 88 Comm: login Not tainted 5.15.0-rc2-00034-ge057cdade6e5-dirty #2638<br /> NIP: c0000000000098b8 LR: c00000000006bf04 CTR: c0000000000097f0<br /> REGS: c0000000fffb3d60 TRAP: 0700 Not tainted<br /> MSR: 9000000000021031 CR: 24482227 XER: 00040000<br /> CFAR: c0000000000098b0 IRQMASK: 0<br /> GPR00: c00000000006bf04 0000000000002400 c000000001513800 c000000001271868<br /> GPR04: 00000000100f0d29 0000000042000000 0000000000000007 0000000000000009<br /> GPR08: 00000000100f0d29 0000000024482227 0000000000002710 c000000000181b3c<br /> GPR12: 9000000000009033 c0000000016b0000 00000000100f0d29 c000000005b22f00<br /> GPR16: 00000000ffff0000 0000000000000001 0000000000000009 00000000100eed90<br /> GPR20: 00000000100eed90 00000<br /> ---truncated---