CVE-2024-42072

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix may_goto with negative offset.

Zac's syzbot crafted a bpf prog that exposed two bugs in maygoto. The 1st bug is the way maygoto is patched. When offset is negative it should be patched differently. The 2nd bug is in the verifier: when current state maygotodepth is equal to visited state maygotodepth it means there is an actual infinite loop. It's not correct to prune exploration of the program at this point. Note, that this check doesn't limit the program to only one maygoto insn, since 2nd and any further maygoto will increment maygotodepth only in the queued state pushed for future exploration. The current state will have maygotodepth == 0 regardless of number of maygoto insns and the verifier has to explore the program until bpfexit.