title: bpf: Fix masking negation logic upon negative dst register
description: In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix masking negation logic upon negative dst register
The negation logic for the case where the off_reg is sitting in the
dst register is not correct given then we cannot just invert the add
to a sub or vice versa. As a fix, perform the final bitwise and-op
unconditionally into AX from the off_reg, then move the pointer from
the src to dst and finally use AX as the source for the original
pointer arithmetic operation such that the inversion yields a correct
result. The single non-AX mov in between is possible given constant
blinding is retaining it as it's not an immediate based operation.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: ae03b6b1c880, lessThan: 4d542ddb88fb, status: affected, versionType: git
version: f92a819b4cbe, lessThan: 0e2dfdc74a7f, status: affected, versionType: git
version: 979d63d50c0c, lessThan: 53e0db429b37, status: affected, versionType: git
version: 979d63d50c0c, lessThan: 2cfa537674cd, status: affected, versionType: git
version: 979d63d50c0c, lessThan: 6eba92a4d4be, status: affected, versionType: git
version: 979d63d50c0c, lessThan: 7cf64d8679ca, status: affected, versionType: git
version: 979d63d50c0c, lessThan: b9b34ddbe207, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.0, status: affected
version: 0, lessThan: 5.0, status: unaffected, versionType: custom
version: 4.14.233, lessThanOrEqual: 4.14.*, status: unaffected, versionType: custom
version: 4.19.190, lessThanOrEqual: 4.19.*, status: unaffected, versionType: custom
version: 5.4.117, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.35, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.11.19, lessThanOrEqual: 5.11.*, status: unaffected, versionType: custom
version: 5.12.2, lessThanOrEqual: 5.12.*, status: unaffected, versionType: custom
version: 5.13, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
