From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+d66bfadebca46cf61a2b@syzkaller.appspotmail.com,
Vasily Averin <vvs@virtuozzo.com>,
Jozsef Kadlecsik <kadlec@netfilter.org>,
Pablo Neira Ayuso <pablo@netfilter.org>
Subject: [PATCH 5.4 88/92] netfilter: ipset: fix shift-out-of-bounds in htable_bits()
Date: Mon, 11 Jan 2021 14:02:32 +0100 [thread overview]
Message-ID: <20210111130043.400224281@linuxfoundation.org> (raw)
In-Reply-To: <20210111130039.165470698@linuxfoundation.org>
From: Vasily Averin <vvs@virtuozzo.com>
commit 5c8193f568ae16f3242abad6518dc2ca6c8eef86 upstream.
htable_bits() can call jhash_size(32) and trigger shift-out-of-bounds
UBSAN: shift-out-of-bounds in net/netfilter/ipset/ip_set_hash_gen.h:151:6
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 0 PID: 8498 Comm: syz-executor519
Not tainted 5.10.0-rc7-next-20201208-syzkaller #0
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
htable_bits net/netfilter/ipset/ip_set_hash_gen.h:151 [inline]
hash_mac_create.cold+0x58/0x9b net/netfilter/ipset/ip_set_hash_gen.h:1524
ip_set_create+0x610/0x1380 net/netfilter/ipset/ip_set_core.c:1115
nfnetlink_rcv_msg+0xecc/0x1180 net/netfilter/nfnetlink.c:252
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
nfnetlink_rcv+0x1ac/0x420 net/netfilter/nfnetlink.c:600
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:672
____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
___sys_sendmsg+0xf3/0x170 net/socket.c:2399
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
This patch replaces htable_bits() by simple fls(hashsize - 1) call:
it alone returns valid nbits both for round and non-round hashsizes.
It is normal to set any nbits here because it is validated inside
following htable_size() call which returns 0 for nbits>31.
Fixes: 1feab10d7e6d("netfilter: ipset: Unified hash type generation")
Reported-by: syzbot+d66bfadebca46cf61a2b@syzkaller.appspotmail.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipset/ip_set_hash_gen.h | 20 +++++---------------
1 file changed, 5 insertions(+), 15 deletions(-)
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -143,20 +143,6 @@ htable_size(u8 hbits)
return hsize * sizeof(struct hbucket *) + sizeof(struct htable);
}
-/* Compute htable_bits from the user input parameter hashsize */
-static u8
-htable_bits(u32 hashsize)
-{
- /* Assume that hashsize == 2^htable_bits */
- u8 bits = fls(hashsize - 1);
-
- if (jhash_size(bits) != hashsize)
- /* Round up to the first 2^n value */
- bits = fls(hashsize);
-
- return bits;
-}
-
#ifdef IP_SET_HASH_WITH_NETS
#if IPSET_NET_COUNT > 1
#define __CIDR(cidr, i) (cidr[i])
@@ -1520,7 +1506,11 @@ IPSET_TOKEN(HTYPE, _create)(struct net *
if (!h)
return -ENOMEM;
- hbits = htable_bits(hashsize);
+ /* Compute htable_bits from the user input parameter hashsize.
+ * Assume that hashsize == 2^htable_bits,
+ * otherwise round up to the first 2^n value.
+ */
+ hbits = fls(hashsize - 1);
hsize = htable_size(hbits);
if (hsize == 0) {
kfree(h);
next prev parent reply other threads:[~2021-01-11 13:37 UTC|newest]
Thread overview: 96+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-11 13:01 [PATCH 5.4 00/92] 5.4.89-rc1 review Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 01/92] workqueue: Kick a worker based on the actual activation of delayed works Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 02/92] scsi: ufs: Fix wrong print message in dev_err() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 03/92] scsi: ufs-pci: Ensure UFS device is in PowerDown mode for suspend-to-disk ->poweroff() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 04/92] scsi: ide: Do not set the RQF_PREEMPT flag for sense requests Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 05/92] scsi: scsi_transport_spi: Set RQF_PM for domain validation commands Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 06/92] lib/genalloc: fix the overflow when size is too big Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 07/92] depmod: handle the case of /sbin/depmod without /sbin in PATH Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 08/92] proc: change ->nlink under proc_subdir_lock Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 09/92] proc: fix lookup in /proc/net subdirectories after setns(2) Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 10/92] i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 11/92] iavf: fix double-release of rtnl_lock Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 12/92] net: mvpp2: Add TCAM entry to drop flow control pause frames Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 13/92] net: mvpp2: prs: fix PPPoE with ipv6 packet parse Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 14/92] net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 15/92] ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 16/92] ethernet: ucc_geth: set dev->max_mtu to 1518 Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 17/92] atm: idt77252: call pci_disable_device() on error path Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 18/92] net: mvpp2: Fix GoP port 3 Networking Complex Control configurations Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 19/92] ibmvnic: continue fatal error reset after passive init Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 20/92] net: ethernet: mvneta: Fix error handling in mvneta_probe Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 21/92] qede: fix offload for IPIP tunnel packets Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 22/92] virtio_net: Fix recursive call to cpus_read_lock() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 23/92] net: dcb: Validate netlink message in DCB handler Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 24/92] net/ncsi: Use real net-device for response handler Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 25/92] net: ethernet: Fix memleak in ethoc_probe Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 26/92] net-sysfs: take the rtnl lock when storing xps_cpus Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 27/92] net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 28/92] net-sysfs: take the rtnl lock when storing xps_rxqs Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 29/92] net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 30/92] net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 31/92] tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 32/92] net: mvpp2: fix pkt coalescing int-threshold configuration Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 33/92] ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 34/92] net: sched: prevent invalid Scell_log shift count Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 35/92] net: hns: fix return value check in __lb_other_process() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 36/92] erspan: fix version 1 check in gre_parse_header() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 37/92] net: hdlc_ppp: Fix issues when mod_timer is called while timer is running Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 38/92] r8169: work around power-saving bug on some chip versions Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 39/92] net: dsa: lantiq_gswip: Enable GSWIP_MII_CFG_EN also for internal PHYs Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 40/92] net: dsa: lantiq_gswip: Fix GSWIP_MII_CFG(p) register access Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 41/92] CDC-NCM: remove "connected" log message Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 42/92] net: usb: qmi_wwan: add Quectel EM160R-GL Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 43/92] vhost_net: fix ubuf refcount incorrectly when sendmsg fails Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 44/92] ionic: account for vlan tag len in rx buffer len Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 45/92] net/sched: sch_taprio: ensure to reset/destroy all child qdiscs Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 46/92] kbuild: dont hardcode depmod path Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 47/92] Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 48/92] video: hyperv_fb: Fix the mmap() regression for v5.4.y and older Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 49/92] crypto: ecdh - avoid buffer overflow in ecdh_set_secret() Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 50/92] crypto: asym_tpm: correct zero out potential secrets Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 51/92] powerpc: Handle .text.{hot,unlikely}.* in linker script Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 52/92] staging: mt7621-dma: Fix a resource leak in an error handling path Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 53/92] usb: gadget: enable super speed plus Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 54/92] USB: cdc-acm: blacklist another IR Droid device Greg Kroah-Hartman
2021-01-11 13:01 ` [PATCH 5.4 55/92] USB: cdc-wdm: Fix use after free in service_outstanding_interrupt() Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 56/92] usb: dwc3: ulpi: Use VStsDone to detect PHY regs access completion Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 57/92] usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 58/92] USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 59/92] usb: usbip: vhci_hcd: protect shift size Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 60/92] usb: uas: Add PNY USB Portable SSD to unusual_uas Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 61/92] USB: serial: iuu_phoenix: fix DMA from stack Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 62/92] USB: serial: option: add LongSung M5710 module support Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 63/92] USB: serial: option: add Quectel EM160R-GL Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 64/92] USB: yurex: fix control-URB timeout handling Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 65/92] USB: usblp: fix DMA to stack Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 66/92] ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 67/92] usb: gadget: select CONFIG_CRC32 Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 68/92] usb: gadget: f_uac2: reset wMaxPacketSize Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 69/92] usb: gadget: function: printer: Fix a memory leak for interface descriptor Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 70/92] usb: gadget: u_ether: Fix MTU size mismatch with RX packet size Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 71/92] USB: gadget: legacy: fix return error code in acm_ms_bind() Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 72/92] usb: gadget: Fix spinlock lockup on usb_function_deactivate Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 73/92] usb: gadget: configfs: Preserve function ordering after bind failure Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 74/92] usb: gadget: configfs: Fix use-after-free issue with udc_name Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 75/92] USB: serial: keyspan_pda: remove unused variable Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 76/92] x86/mm: Fix leak of pmd ptlock Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 77/92] kvm: check tlbs_dirty directly Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 78/92] ALSA: hda/via: Fix runtime PM for Clevo W35xSS Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 79/92] ALSA: hda/conexant: add a new hda codec CX11970 Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 80/92] ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 81/92] ALSA: hda/realtek: Enable mute and micmute LED on HP EliteBook 850 G7 Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 82/92] ALSA: hda/realtek: Add two "Intel Reference board" SSID in the ALC256 Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 83/92] btrfs: send: fix wrong file path when there is an inode with a pending rmdir Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 84/92] Revert "device property: Keep secondary firmware node secondary by type" Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 85/92] dmabuf: fix use-after-free of dmabufs file->f_inode Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 86/92] drm/i915: clear the gpu reloc batch Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 87/92] netfilter: x_tables: Update remaining dereference to RCU Greg Kroah-Hartman
2021-01-11 13:02 ` Greg Kroah-Hartman [this message]
2021-01-11 13:02 ` [PATCH 5.4 89/92] netfilter: xt_RATEEST: reject non-null terminated string from userspace Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 90/92] netfilter: nft_dynset: report EOPNOTSUPP on missing set feature Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 91/92] x86/mtrr: Correct the range check before performing MTRR type lookups Greg Kroah-Hartman
2021-01-11 13:02 ` [PATCH 5.4 92/92] KVM: x86: fix shift out of bounds reported by UBSAN Greg Kroah-Hartman
2021-01-11 21:53 ` [PATCH 5.4 00/92] 5.4.89-rc1 review Guenter Roeck
2021-01-11 23:38 ` Shuah Khan
2021-01-12 6:54 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210111130043.400224281@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=kadlec@netfilter.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+d66bfadebca46cf61a2b@syzkaller.appspotmail.com \
--cc=vvs@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).