[BUG] net: sched: em_meta accepts shifts outside the integer width

[BUG] net: sched: em_meta accepts shifts outside the integer width

[shaos]

Hello,

em_meta accepts a user-controlled shift exponent in tcf_meta_val and meta_int_apply_extras() applies it to an unsigned long without checking the range.  A shift of 64 on a 64-bit kernel reaches C undefined behavior in the network classifier.

HEAD commit:    fe2ec83746e501645709761605c2464a44fd2929
git tree:       upstream Linux checkout, local branch master
source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
compiler:       gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)

console output:
https://gist.githubusercontent.com/shaos26/4d0a6531f00fd3baeabe040993953402/raw/1677be670d3d39c0054b4ecd40c69b375630381c/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/4d0a6531f00fd3baeabe040993953402/raw/e47da1b0ca0ffe6d0ac3a988e2c30c7eb634ede3/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/4d0a6531f00fd3baeabe040993953402/raw/1f5f1944a0a8d87af969b58f80c4dfb10e50eca2/poc.c

Build and run the standalone PoC on a 64-bit kernel with UBSAN enabled.  The program creates its own user and network namespaces, installs the em_meta filter, and sends the triggering packet:

    gcc -O2 -Wall -Wextra -static -o em_meta_shift_poc poc.c
    ./em_meta_shift_poc pos
    ./em_meta_shift_poc ctrl
    ./em_meta_shift_poc nofilter

Two fresh boots with shift=64 reported UBSAN shift-out-of-bounds in meta_int_apply_extras(); shift=8 matched without a report, and a no-filter control was clean.  The observed effect is undefined behavior and a wrong classifier result; x86 masks the hardware shift count, and no memory corruption or privilege escalation is shown.

Impact and prerequisites:
The demonstrated result is kernel undefined behavior visible under UBSAN and incorrect packet classification.  UBSAN is needed for the diagnostic; the current evidence does not establish a production crash or a security boundary violation.

Validation: Two fresh boots reported UBSAN shift-out-of-bounds for shift 64.  Shift 8 and no-filter controls were clean; no memory corruption or privilege escalation was observed.

Thanks,

shaos