CVE-2024-50163

In the Linux kernel, the following vulnerability has been resolved:

bpf: Make sure internal and UAPI bpf_redirect flags don't overlap

The bpfredirectinfo is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri->flags field (specifically, BPFFBROADCAST == BPFFNEXTHOP). This means that if skb bpfredirectneigh() is used with a non-NULL params argument and, subsequently, an XDP redirect is performed using the same bpfredirectinfo struct, the XDP path will get confused and end up crashing, which syzbot managed to trigger.

With the stack-allocated bpfredirectinfo, the structure is no longer shared between the SKB and XDP paths, so the crash doesn't happen anymore. However, different code paths using identically-numbered flag values in the same struct field still seems like a bit of a mess, so this patch cleans that up by moving the flag definitions together and redefining the three flags in BPFFREDIRECTINTERNAL to not overlap with the flags used for XDP. It also adds a BUILDBUG_ON() check to make sure the overlap is not re-introduced by mistake.