Inconsistences in arithmetic shift implementation of interpreter

[pcy190]

In the upstream kernel eBPF specification, the offset of the arithmetic shift should be mask 0

In the interpreter of ubpf, the mask is missing for EBPF_OP_ARSH64 and EBPF_OP_ARSH

ubpf/vm/ubpf_vm.c

Lines 572 to 577 in a6082a2

	case EBPF_OP_ARSH64_IMM:
	reg[inst.dst] = (int64_t)reg[inst.dst] >> inst.imm;
	break;
	case EBPF_OP_ARSH64_REG:
	reg[inst.dst] = (int64_t)reg[inst.dst] >> reg[inst.src];
	break;

ubpf/vm/ubpf_vm.c

Lines 475 to 482 in a6082a2

	case EBPF_OP_ARSH_IMM:
	reg[inst.dst] = (int32_t)reg[inst.dst] >> inst.imm;
	reg[inst.dst] &= UINT32_MAX;
	break;
	case EBPF_OP_ARSH_REG:
	reg[inst.dst] = (int32_t)reg[inst.dst] >> u32(reg[inst.src]);
	reg[inst.dst] &= UINT32_MAX;
	break;

We should mask the src/imm offset before performing shift operation.

The following PoC program implies the differences between the specification and the implementation, while the program executed in the ubpf will trigger undefined behavior since the shift offset overflows.

mov64 r8, 0x05454500
alsh64 r8, r8
exit