CVE-2022-48929

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Fix crash due to out of bounds access into reg2btf_ids.<br /> <br /> When commit e6ac2450d6de ("bpf: Support bpf program calling kernel function") added<br /> kfunc support, it defined reg2btf_ids as a cheap way to translate the verifier<br /> reg type to the appropriate btf_vmlinux BTF ID, however<br /> commit c25b2ae13603 ("bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL")<br /> moved the __BPF_REG_TYPE_MAX from the last member of bpf_reg_type enum to after<br /> the base register types, and defined other variants using type flag<br /> composition. However, now, the direct usage of reg-&gt;type to index into<br /> reg2btf_ids may no longer fall into __BPF_REG_TYPE_MAX range, and hence lead to<br /> out of bounds access and kernel crash on dereference of bad pointer.