In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses").The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since "r2 <<= 32" is not allowedas "r2" is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] <ahref= https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ >https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/</a>The Linux kernel CVE team has assigned CVE-2024-47702 to this issue.
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses").The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since "r2 <<= 32" is not allowedas "r2" is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] <ahref= https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ >https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/</a>The Linux kernel CVE team has assigned CVE-2024-47702 to this issue.
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ( bpf: Handle sign-extenstin ctx member accesses ).The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that r2 = (s32)r2 may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since r2 <<= 32 is not allowedas r2 is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/
In the Linux kernel, the following vulnerability has been resolved:bpf: Fail verification for sign-extension of packet data/data_end/data_metasyzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses").The reason is due to sign-extension of 32-bit load forpacket data/data_end/data_meta uapi field.The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ...Note that __sk_buff->data load has 32-bit sign extension.After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ...Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalidwhich may cause runtime failure.Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ...and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ...the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1and this will cause verification failure since "r2 <<= 32" is not allowedas "r2" is a packet pointer.To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */this patch added additional checking in is_valid_access() callbackfunction for packet data/data_end/data_meta access. If those accessesare with sign-extenstion, the verification will fail. [1] <ahref= https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ >https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/</a>The Linux kernel CVE team has assigned CVE-2024-47702 to this issue.
