CVE: CVE-2024-26588
Published: 2024-02-22
Description: In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Prevent out-of-bounds memory access

The test_tag test triggers an unhandled page fault:

  # ./test_tag
  [  130.640218] CPU 0 Unable to handle kernel paging request at virtual address ffff80001b898004, era ==[PII_REDACTED]137f7c, ra ==[PII_REDACTED]139e70
  [  130.640501] Oops[#3]:
  [  130.640553] CPU: 0 PID: 1326 Comm: test_tag Tainted: G      D    O       6.7.0-rc4-loong-devel-gb62ab1a397cf #47 61985c1d94084daa2432f771daa45b56b10d8d2a
  [  130.640764] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022
  [  130.640874] pc[PII_REDACTED]137f7c ra[PII_REDACTED]139e70 tp[PII_REDACTED]cb4000 sp[PII_REDACTED]cb7a40
  [  130.641001] a0 ffff80001b894000 a1 ffff80001b897ff8 a2 000000006ba210be a3 [PII_REDACTED]
  [  130.641128] a4 000000006ba210be a5[PII_REDACTED]0000f1 a6[PII_REDACTED]0000b3 a7 [PII_REDACTED]
  [  130.641256] t0 [PII_REDACTED] t[PII_REDACTED]0007f6 t2 [PII_REDACTED] t3[PII_REDACTED]091b70
  [  130.641387] t4 000000006ba210be t5 [PII_REDACTED] t6 fffffffffffffff0 t7[PII_REDACTED]0913e0
  [  130.641512] t8 [PII_REDACTED] u0[PII_REDACTED]000dc0 s9 [PII_REDACTED] s0[PII_REDACTED]cb7ae0
  [  130.641641] s[PII_REDACTED]0007f6 s2 [PII_REDACTED] s3 [PII_REDACTED] s4 [PII_REDACTED]
  [  130.641771] s5 ffff80001b894000 s6 ffff80001b897fb0 s7[PII_REDACTED]090c50 s8 [PII_REDACTED]
  [  130.641900]    ra:[PII_REDACTED]139e70 build_body+0x1fcc/0x4988
  [  130.642007]   ERA:[PII_REDACTED]137f7c build_body+0xd8/0x4988
  [  130.642112]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
  [  130.642261]  PRMD: 00000004 (PPLV0 +PIE -PWE)
  [  130.642353]  EUEN: 00000003 (+FPE +SXE -ASXE -BTE)
  [  130.642458]  ECFG: 00071c1c (LIE=2-4,10-12 VS=7)
  [  130.642554] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)
  [  130.642658]  BADV: ffff80001b898004
  [  130.642719]  PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)
  [  130.642815] Modules linked in: [last unloaded: bpf_testmod(O)]
  [  130.642924] Process test_tag (pid: 1326, threadinfo=00000000f7f4015f, task=[PII_REDACTED]99f9fd)
  [  130.643062] Stack : [PII_REDACTED] [PII_REDACTED] [PII_REDACTED][PII_REDACTED]cb7be8
  [  130.643213]         [PII_REDACTED] 25af8d9b6e[PII_REDACTED]000106250ea0[PII_REDACTED]cb7ae0
  [  130.643378]         [PII_REDACTED] [PII_REDACTED][PII_REDACTED]cb7be8[PII_REDACTED]9f6000
  [  130.643538]         [PII_REDACTED][PII_REDACTED]250ea0 ffff80001b894000 ffff80001b894000
  [  130.643685]         00007ffffb[PII_REDACTED]00000313ca94 [PII_REDACTED] [PII_REDACTED]
  [  130.643831]         ffff80001b[PII_REDACTED]000000000ff7 [PII_REDACTED] [PII_REDACTED]
  [  130.643983]         [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] 25af8d9b6e600558
  [  130.644131]        [PII_REDACTED]000bb7 ffff80001b894048 [PII_REDACTED] [PII_REDACTED]
  [  130.644276]        [PII_REDACTED]cb7be8[PII_REDACTED]9f6000 [PII_REDACTED][PII_REDACTED]cb7bdc
  [  130.644423]         ffff80001b894000 [PII_REDACTED] 00007ffffb[PII_REDACTED]0000032acfb0
  [  130.644572]         ...
  [  130.644629] Call Trace:
  [  130.644641] [<[PII_REDACTED]137f7c>] build_body+0xd8/0x4988
  [  130.644785] [<[PII_REDACTED]13ca94>] bpf_int_jit_compile+0x228/0x4ec
  [  130.644891] [<[PII_REDACTED]2acfb0>] bpf_prog_select_runtime+0x158/0x1b0
  [  130.645003] [<[PII_REDACTED]2b3504>] bpf_prog_load+0x760/0xb44
  [  130.645089] [<[PII_REDACTED]2b6744>] __sys_bpf+0xbb8/0x2588
  [  130.645175] [<[PII_REDACTED]2b8388>] sys_bpf+0x20/0x2c
  [  130.645259] [<[PII_REDACTED]f6ab38>] do_syscall+0x7c/0x94
  [  130.645369] [<[PII_REDACTED]121c5c>] handle_syscall+0xbc/0x158
  [  130.645507]
  [  130.645539] Code: 380839f6  380831f9  28412bae <24000ca6> 004081ad  0014cb50  004083e8  02bff34c  58008e91
  [  130.645729]
  [  130.646418] ---[ end trace [PII_REDACTED] ]---

On my machine, which has CONFIG_PAGE_SIZE_16KB=y, the test failed at
loading a BPF prog with 2039 instructions:

  prog = (struct bpf_prog *)ffff80001b894000
  insn = (struct bpf_insn *)(prog->insnsi)fff
---truncated---
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-125
References: https://git.kernel.org/stable/c/36a87385e31c9343af9a4756598e704741250a67; https://git.kernel.org/stable/c/4631c2dd69d928bca396f9f58baeddf85e14ced5; https://git.kernel.org/stable/c/7924ade13a49c0067da6ea13e398102979c0654a