CVE-2024-47702

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Fail verification for sign-extension of packet data/data_end/data_meta<br /> <br /> syzbot reported a kernel crash due to<br /> commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses").<br /> The reason is due to sign-extension of 32-bit load for<br /> packet data/data_end/data_meta uapi field.<br /> <br /> The original code looks like:<br /> r2 = *(s32 *)(r1 + 76) /* load __sk_buff-&gt;data */<br /> r3 = *(u32 *)(r1 + 80) /* load __sk_buff-&gt;data_end */<br /> r0 = r2<br /> r0 += 8<br /> if r3 &gt; r0 goto +1<br /> ...<br /> Note that __sk_buff-&gt;data load has 32-bit sign extension.<br /> <br /> After verification and convert_ctx_accesses(), the final asm code looks like:<br /> r2 = *(u64 *)(r1 +208)<br /> r2 = (s32)r2<br /> r3 = *(u64 *)(r1 +80)<br /> r0 = r2<br /> r0 += 8<br /> if r3 &gt; r0 goto pc+1<br /> ...<br /> Note that &amp;#39;r2 = (s32)r2&amp;#39; may make the kernel __sk_buff-&gt;data address invalid<br /> which may cause runtime failure.<br /> <br /> Currently, in C code, typically we have<br /> void *data = (void *)(long)skb-&gt;data;<br /> void *data_end = (void *)(long)skb-&gt;data_end;<br /> ...<br /> and it will generate<br /> r2 = *(u64 *)(r1 +208)<br /> r3 = *(u64 *)(r1 +80)<br /> r0 = r2<br /> r0 += 8<br /> if r3 &gt; r0 goto pc+1<br /> <br /> If we allow sign-extension,<br /> void *data = (void *)(long)(int)skb-&gt;data;<br /> void *data_end = (void *)(long)skb-&gt;data_end;<br /> ...<br /> the generated code looks like<br /> r2 = *(u64 *)(r1 +208)<br /> r2 = 32<br /> r3 = *(u64 *)(r1 +80)<br /> r0 = r2<br /> r0 += 8<br /> if r3 &gt; r0 goto pc+1<br /> and this will cause verification failure since "r2