CVE-2024-53125

In the Linux kernel, the following vulnerability has been resolved:

bpf: sync_linked_regs() must preserve subreg_def

Range propagation must not affect subreg_def marks, otherwise the

following example is rewritten by verifier incorrectly when

BPF_F_TEST_RND_HI32 flag is set:

0: call bpf_ktime_get_ns call bpf_ktime_get_ns

1: r0 &= 0x7fffffff after verifier r0 &= 0x7fffffff

2: w1 = w0 rewrites w1 = w0

3: if w0 < 10 goto +0 --------------> r11 = 0x2f5674a6 (r)

4: r1 >>= 32 r11 <<= 32 (r)

5: r0 = r1 r1 |= r11 (r)

6: exit; if w0 < 0xa goto pc+0

r1 >>= 32

r0 = r1

exit

(or zero extension of w1 at (2) is missing for architectures that

require zero extension for upper register half).

The following happens w/o this patch:

- r0 is marked as not a subreg at (0);

- w1 is marked as subreg at (2);

- w1 subreg_def is overridden at (3) by copy_register_state();

- w1 is read at (5) but mark_insn_zext() does not mark (2)

for zero extension, because w1 subreg_def is not set;

- because of BPF_F_TEST_RND_HI32 flag verifier inserts random

value for hi32 bits of (2) (marked (r));

- this random value is read at (5).