Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access. This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access. I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
Product status
1cedee13d25ab118d325f95588c1a084e9317229 (git) before de44cdc50d2dce8718cb57deddf9cf1be9a7759f
1cedee13d25ab118d325f95588c1a084e9317229 (git) before 76e04bbb4296fb6eac084dbfc27e02ccc744db3e
1cedee13d25ab118d325f95588c1a084e9317229 (git) before 6d8b1a21fd5c34622b0c3893c61e4a38d8ba53ec
1cedee13d25ab118d325f95588c1a084e9317229 (git) before 4f00858cd9bbbdf67159e28b85a8ca9e77c83622
1cedee13d25ab118d325f95588c1a084e9317229 (git) before cdeafacb4f9ff261a96baef519e29480fd7b1019
1cedee13d25ab118d325f95588c1a084e9317229 (git) before fe9d33f0470350558cb08cecb54cf2267b3a45d2
1cedee13d25ab118d325f95588c1a084e9317229 (git) before ad8b4fe5617e3c85fc23267f02500c4f3bf0ff69
1cedee13d25ab118d325f95588c1a084e9317229 (git) before 6fabca2fc94d33cdf7ec102058983b086293395f
4.18
Any version before 4.18
5.4.301 (semver)
5.10.246 (semver)
5.15.195 (semver)
6.1.156 (semver)
6.6.112 (semver)
6.12.53 (semver)
6.17.3 (semver)
6.18-rc1 (original_commit_for_fix)
References
git.kernel.org/...c/de44cdc50d2dce8718cb57deddf9cf1be9a7759f
git.kernel.org/...c/76e04bbb4296fb6eac084dbfc27e02ccc744db3e
git.kernel.org/...c/6d8b1a21fd5c34622b0c3893c61e4a38d8ba53ec
git.kernel.org/...c/4f00858cd9bbbdf67159e28b85a8ca9e77c83622
git.kernel.org/...c/cdeafacb4f9ff261a96baef519e29480fd7b1019
git.kernel.org/...c/fe9d33f0470350558cb08cecb54cf2267b3a45d2
git.kernel.org/...c/ad8b4fe5617e3c85fc23267f02500c4f3bf0ff69
git.kernel.org/...c/6fabca2fc94d33cdf7ec102058983b086293395f
