CVE-2023-53634

In the Linux kernel, the following vulnerability has been resolved:

bpf, arm64: Fixed a BTI error on returning to patched function

When BPFTRAMPFCALLORIG is set, BPF trampoline uses BLR to jump back to the instruction next to call site to call the patched function. For BTI-enabled kernel, the instruction next to call site is usually PACIASP, in this case, it's safe to jump back with BLR. But when the call site is not followed by a PACIASP or bti, a BTI exception is triggered.

Here is a fault log:

Unhandled 64-bit el1h sync exception on CPU0, ESR 0x0000000034000002 -- BTI CPU: 0 PID: 263 Comm: testprogs Tainted: GF Hardware name: linux,dummy-virt (DT) pstate: 40400805 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=-c) pc : bpffentrytest1+0xc/0x30 lr : bpftrampoline64425738920+0x48/0x1000 sp : ffff80000c0c3a50 x29: ffff80000c0c3a90 x28: ffff0000c2e6c080 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000050 x23: 0000000000000000 x22: 0000ffffcfd2a7f0 x21: 000000000000000a x20: 0000ffffcfd2a7f0 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffcfd2a7f0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff80000914f5e4 x9 : ffff8000082a1528 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0101010101010101 x5 : 0000000000000000 x4 : 00000000fffffff2 x3 : 0000000000000001 x2 : ffff8001f4b82000 x1 : 0000000000000000 x0 : 0000000000000001 Kernel panic - not syncing: Unhandled exception CPU: 0 PID: 263 Comm: testprogs Tainted: GF Hardware name: linux,dummy-virt (DT) Call trace: dumpbacktrace+0xec/0x144 showstack+0x24/0x7c dumpstacklvl+0x8c/0xb8 dumpstack+0x18/0x34 panic+0x1cc/0x3ec _el0errorhandlercommon+0x0/0x130 el1h64synchandler+0x60/0xd0 el1h64sync+0x78/0x7c bpffentrytest1+0xc/0x30 bpffentrytest1+0xc/0x30 bpfprogtestruntracing+0xdc/0x2a0 _sysbpf+0x438/0x22a0 _arm64sysbpf+0x30/0x54 invokesyscall+0x78/0x110 el0svccommon.constprop.0+0x6c/0x1d0 doel0svc+0x38/0xe0 el0svc+0x30/0xd0 el0t64synchandler+0x1ac/0x1b0 el0t64_sync+0x1a0/0x1a4 Kernel Offset: disabled CPU features: 0x0000,00034c24,f994fdab Memory Limit: none

And the instruction next to call site of bpffentrytest1 is ADD, not PACIASP:

<bpf_fentry_test1>: bti c nop nop add w0, w0, #0x1 paciasp

For BPF prog, JIT always puts a PACIASP after call site for BTI-enabled kernel, so there is no problem. To fix it, replace BLR with RET to bypass the branch target check.