In the Linux kernel, the following vulnerability has been resolved:
bpf, testrun: Fix alignment problem in bpfprogtestrun_skb()
We got a syzkaller problem because of aarch64 alignment fault if KFENCE enabled. When the size from user bpf program is an odd number, like 399, 407, etc, it will cause the struct skbsharedinfo's unaligned access. As seen below:
BUG: KFENCE: use-after-free read in _skbclone+0x23c/0x2a0 net/core/skbuff.c:1032
Use-after-free read at 0xffff6254fffac077 (in kfence-#213): lseatomicadd arch/arm64/include/asm/atomiclse.h:26 [inline] archatomicadd arch/arm64/include/asm/atomic.h:28 [inline] archatomicinc include/linux/atomic-arch-fallback.h:270 [inline] atomicinc include/asm-generic/atomic-instrumented.h:241 [inline] _skbclone+0x23c/0x2a0 net/core/skbuff.c:1032 skbclone+0xf4/0x214 net/core/skbuff.c:1481 _bpfcloneredirect net/core/filter.c:2433 [inline] bpfcloneredirect+0x78/0x1c0 net/core/filter.c:2420 bpfprogd3839dd9068ceb51+0x80/0x330 bpfdispatchernopfunc include/linux/bpf.h:728 [inline] bpftestrun+0x3c0/0x6c0 net/bpf/testrun.c:53 bpfprogtestrunskb+0x638/0xa7c net/bpf/testrun.c:594 bpfprogtestrun kernel/bpf/syscall.c:3148 [inline] _dosysbpf kernel/bpf/syscall.c:4441 [inline] _sesysbpf+0xad0/0x1634 kernel/bpf/syscall.c:4381
kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512
allocated by task 15074 on cpu 0 at 1342.585390s: kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:675 [inline] bpftestinit.isra.0+0xac/0x290 net/bpf/testrun.c:191 bpfprogtestrunskb+0x11c/0xa7c net/bpf/testrun.c:512 bpfprogtestrun kernel/bpf/syscall.c:3148 [inline] _dosysbpf kernel/bpf/syscall.c:4441 [inline] _sesysbpf+0xad0/0x1634 kernel/bpf/syscall.c:4381 _arm64sysbpf+0x50/0x60 kernel/bpf/syscall.c:4381
To fix the problem, we adjust @size so that (@size + @hearoom) is a multiple of SMPCACHEBYTES. So we make sure the struct skbsharedinfo is aligned to a cache line.
[
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-083ed606",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "149239036380140269446066003985861343541",
                "335338481780096090201090993720381883297",
                "178048774305386485995686764329317446697"
            ]
        },
        "target": {
            "file": "net/bpf/test_run.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b597f2d6a55e9f549989913860ad5170da04964",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-124ab7d7",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "215188813150125144558994609791310159335",
                "213502929367930133835680623621772270189",
                "273245731065233214304560624781797923353"
            ]
        },
        "target": {
            "file": "net/bpf/test_run.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@047824a730699c6c66df43306b80f700c9dfc2fd",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-38ab26b2",
        "signature_type": "Function",
        "digest": {
            "length": 552.0,
            "function_hash": "350458719708230894600421483710995612"
        },
        "target": {
            "file": "net/bpf/test_run.c",
            "function": "bpf_test_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eaa8edd86514afac9deb9bf9a5053e74f37edf40",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-4abeeb57",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "149239036380140269446066003985861343541",
                "335338481780096090201090993720381883297",
                "178048774305386485995686764329317446697"
            ]
        },
        "target": {
            "file": "net/bpf/test_run.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3fd203f36d46aa29600a72d57a1b61af80e4a25",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-4bc78032",
        "signature_type": "Function",
        "digest": {
            "length": 459.0,
            "function_hash": "55674311206535435366908262290649342882"
        },
        "target": {
            "file": "net/bpf/test_run.c",
            "function": "bpf_test_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a704dbfd3735304e261f2787c52fbc7c3884736",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-5a1732d6",
        "signature_type": "Function",
        "digest": {
            "length": 527.0,
            "function_hash": "303946336232147271225716929644605636357"
        },
        "target": {
            "file": "net/bpf/test_run.c",
            "function": "bpf_test_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3fd203f36d46aa29600a72d57a1b61af80e4a25",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-660451db",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "149239036380140269446066003985861343541",
                "335338481780096090201090993720381883297",
                "178048774305386485995686764329317446697"
            ]
        },
        "target": {
            "file": "net/bpf/test_run.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e60f37a1d379c821c17b08f366412dce9ef3d99f",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-7414f758",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "215188813150125144558994609791310159335",
                "213502929367930133835680623621772270189",
                "273245731065233214304560624781797923353"
            ]
        },
        "target": {
            "file": "net/bpf/test_run.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a704dbfd3735304e261f2787c52fbc7c3884736",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-815b53a5",
        "signature_type": "Function",
        "digest": {
            "length": 527.0,
            "function_hash": "303946336232147271225716929644605636357"
        },
        "target": {
            "file": "net/bpf/test_run.c",
            "function": "bpf_test_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b597f2d6a55e9f549989913860ad5170da04964",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-c06c319a",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "215188813150125144558994609791310159335",
                "213502929367930133835680623621772270189",
                "273245731065233214304560624781797923353"
            ]
        },
        "target": {
            "file": "net/bpf/test_run.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@730fb1ef974a13915bc7651364d8b3318891cd70",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-c437bc0f",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "149239036380140269446066003985861343541",
                "335338481780096090201090993720381883297",
                "178048774305386485995686764329317446697"
            ]
        },
        "target": {
            "file": "net/bpf/test_run.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eaa8edd86514afac9deb9bf9a5053e74f37edf40",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-cdab6afe",
        "signature_type": "Function",
        "digest": {
            "length": 459.0,
            "function_hash": "55674311206535435366908262290649342882"
        },
        "target": {
            "file": "net/bpf/test_run.c",
            "function": "bpf_test_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@047824a730699c6c66df43306b80f700c9dfc2fd",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-ce8ff9d3",
        "signature_type": "Function",
        "digest": {
            "length": 459.0,
            "function_hash": "55674311206535435366908262290649342882"
        },
        "target": {
            "file": "net/bpf/test_run.c",
            "function": "bpf_test_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@730fb1ef974a13915bc7651364d8b3318891cd70",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2022-49840-ddb2f458",
        "signature_type": "Function",
        "digest": {
            "length": 552.0,
            "function_hash": "350458719708230894600421483710995612"
        },
        "target": {
            "file": "net/bpf/test_run.c",
            "function": "bpf_test_init"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e60f37a1d379c821c17b08f366412dce9ef3d99f",
        "deprecated": false
    }
]