CVE-2021-47428

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/64s: fix program check interrupt emergency stack path

Emergency stack path was jumping into a 3: label inside the

__GEN_COMMON_BODY macro for the normal path after it had finished,

rather than jumping over it. By a small miracle this is the correct

place to build up a new interrupt frame with the existing stack

pointer, so things basically worked okay with an added weird looking

700 trap frame on top (which had the wrong ->nip so it didn't decode

bug messages either).

Fix this by avoiding using numeric labels when jumping over non-trivial

macros.

Before:

LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV

Modules linked in:

CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637

NIP: 7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0

REGS: c0000000fffb3a50 TRAP: 0700 Not tainted

MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 00000700 XER: 20040000

CFAR: c000000000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References