[PATCH] bpf: fix verifier model mismatch on __sk_buff.remote_port narrow read

[Henry Martin <bsdhenrymartin@gmail.com>]

On little endian, the ctx access conversion for __sk_buff.remote_port
loads the 16-bit skc_dport and shifts it left by 16, producing a
4-byte value of up to 0xffff0000.  It reports its width through
bpf_target_off() as 2, the member size.

A 2-byte read is a narrower load of this 4-byte ctx field, but the
fixup pass only masks the result when the access size is smaller
than the reported width, so the masking is skipped.  The verifier
models the register as [0, 0xffff] while the runtime value is
[0, 0xffff0000].  Arithmetic the verifier folds to a constant can
therefore take any 16-bit port value at runtime, enabling
out-of-bounds reads and writes relative to map values.

Report the real produced width (4) so the fixup pass applies the
usual RSH/AND masking to narrow reads.  Full 4-byte reads are
unaffected.

This issue was discovered by Tencent CodeBuddy Security.

Reported-by: zeroday zhao <zerodayzhao@tencent.com>
Fixes: 8a31db5615667 ("bpf: add access to sock fields and pkt data from sk_skb programs")
Cc: stable@vger.kernel.org
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 net/core/filter.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 9245009d9f1eb..6eb4751441f39 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -10455,13 +10455,19 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
 	case offsetof(struct __sk_buff, remote_port):
 		BUILD_BUG_ON(sizeof_field(struct sock_common, skc_dport) != 2);
 
+		/*
+		 * The converted value is 4 bytes wide, not 2: on little
+		 * endian the 16-bit port is shifted into the high half.
+		 * Don't use bpf_target_off() here, it would report the
+		 * member size and the narrow-load masking in the fixup
+		 * pass would be skipped.
+		 */
+		*target_size = 4;
 		*insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct sk_buff, sk),
 				      si->dst_reg, si->src_reg,
 				      offsetof(struct sk_buff, sk));
 		*insn++ = BPF_LDX_MEM(BPF_H, si->dst_reg, si->dst_reg,
-				      bpf_target_off(struct sock_common,
-						     skc_dport,
-						     2, target_size));
+				      offsetof(struct sock_common, skc_dport));
 #ifndef __BIG_ENDIAN_BITFIELD
 		*insn++ = BPF_ALU32_IMM(BPF_LSH, si->dst_reg, 16);
 #endif
-- 
2.43.7