* [PATCH v2] netfilter: ipset: fix shift-out-of-bounds in htable_bits()
[not found] <4d915d3a-6a95-7784-4057-2faa17a061@blackhole.kfki.hu>
@ 2020-12-17 14:53 ` Vasily Averin
2020-12-17 17:12 ` Jozsef Kadlecsik
2020-12-17 18:44 ` Pablo Neira Ayuso
0 siblings, 2 replies; 3+ messages in thread
From: Vasily Averin @ 2020-12-17 14:53 UTC (permalink / raw)
To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal
Cc: David S. Miller, Jakub Kicinski, netfilter-devel, coreteam,
syzkaller-bugs
htable_bits() can call jhash_size(32) and trigger shift-out-of-bounds
UBSAN: shift-out-of-bounds in net/netfilter/ipset/ip_set_hash_gen.h:151:6
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 0 PID: 8498 Comm: syz-executor519
Not tainted 5.10.0-rc7-next-20201208-syzkaller #0
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
htable_bits net/netfilter/ipset/ip_set_hash_gen.h:151 [inline]
hash_mac_create.cold+0x58/0x9b net/netfilter/ipset/ip_set_hash_gen.h:1524
ip_set_create+0x610/0x1380 net/netfilter/ipset/ip_set_core.c:1115
nfnetlink_rcv_msg+0xecc/0x1180 net/netfilter/nfnetlink.c:252
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
nfnetlink_rcv+0x1ac/0x420 net/netfilter/nfnetlink.c:600
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:672
____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
___sys_sendmsg+0xf3/0x170 net/socket.c:2399
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
This patch replaces htable_bits() by simple fls(hashsize - 1) call:
it alone returns valid nbits both for round and non-round hashsizes.
It is normal to set any nbits here because it is validated inside
following htable_size() call which returns 0 for nbits>31.
Fixes: 1feab10d7e6d("netfilter: ipset: Unified hash type generation")
Reported-by: syzbot+d66bfadebca46cf61a2b@syzkaller.appspotmail.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
---
net/netfilter/ipset/ip_set_hash_gen.h | 20 +++++---------------
1 file changed, 5 insertions(+), 15 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 521e970..7d01086 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -143,20 +143,6 @@ struct net_prefixes {
return hsize * sizeof(struct hbucket *) + sizeof(struct htable);
}
-/* Compute htable_bits from the user input parameter hashsize */
-static u8
-htable_bits(u32 hashsize)
-{
- /* Assume that hashsize == 2^htable_bits */
- u8 bits = fls(hashsize - 1);
-
- if (jhash_size(bits) != hashsize)
- /* Round up to the first 2^n value */
- bits = fls(hashsize);
-
- return bits;
-}
-
#ifdef IP_SET_HASH_WITH_NETS
#if IPSET_NET_COUNT > 1
#define __CIDR(cidr, i) (cidr[i])
@@ -1520,7 +1506,11 @@ struct mtype_resize_ad {
if (!h)
return -ENOMEM;
- hbits = htable_bits(hashsize);
+ /* Compute htable_bits from the user input parameter hashsize.
+ * Assume that hashsize == 2^htable_bits,
+ * otherwise round up to the first 2^n value.
+ */
+ hbits = fls(hashsize - 1);
hsize = htable_size(hbits);
if (hsize == 0) {
kfree(h);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] netfilter: ipset: fix shift-out-of-bounds in htable_bits()
2020-12-17 14:53 ` [PATCH v2] netfilter: ipset: fix shift-out-of-bounds in htable_bits() Vasily Averin
@ 2020-12-17 17:12 ` Jozsef Kadlecsik
2020-12-17 18:44 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Jozsef Kadlecsik @ 2020-12-17 17:12 UTC (permalink / raw)
To: Vasily Averin
Cc: Pablo Neira Ayuso, Florian Westphal, David S. Miller,
Jakub Kicinski, netfilter-devel, coreteam, syzkaller-bugs
On Thu, 17 Dec 2020, Vasily Averin wrote:
> htable_bits() can call jhash_size(32) and trigger shift-out-of-bounds
>
> UBSAN: shift-out-of-bounds in net/netfilter/ipset/ip_set_hash_gen.h:151:6
> shift exponent 32 is too large for 32-bit type 'unsigned int'
> CPU: 0 PID: 8498 Comm: syz-executor519
> Not tainted 5.10.0-rc7-next-20201208-syzkaller #0
> Call Trace:
> __dump_stack lib/dump_stack.c:79 [inline]
> dump_stack+0x107/0x163 lib/dump_stack.c:120
> ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
> __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
> htable_bits net/netfilter/ipset/ip_set_hash_gen.h:151 [inline]
> hash_mac_create.cold+0x58/0x9b net/netfilter/ipset/ip_set_hash_gen.h:1524
> ip_set_create+0x610/0x1380 net/netfilter/ipset/ip_set_core.c:1115
> nfnetlink_rcv_msg+0xecc/0x1180 net/netfilter/nfnetlink.c:252
> netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
> nfnetlink_rcv+0x1ac/0x420 net/netfilter/nfnetlink.c:600
> netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
> netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
> netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
> sock_sendmsg_nosec net/socket.c:652 [inline]
> sock_sendmsg+0xcf/0x120 net/socket.c:672
> ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
> ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
> __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> This patch replaces htable_bits() by simple fls(hashsize - 1) call:
> it alone returns valid nbits both for round and non-round hashsizes.
> It is normal to set any nbits here because it is validated inside
> following htable_size() call which returns 0 for nbits>31.
>
> Fixes: 1feab10d7e6d("netfilter: ipset: Unified hash type generation")
> Reported-by: syzbot+d66bfadebca46cf61a2b@syzkaller.appspotmail.com
> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Best regards,
Jozsef
> ---
> net/netfilter/ipset/ip_set_hash_gen.h | 20 +++++---------------
> 1 file changed, 5 insertions(+), 15 deletions(-)
>
> diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
> index 521e970..7d01086 100644
> --- a/net/netfilter/ipset/ip_set_hash_gen.h
> +++ b/net/netfilter/ipset/ip_set_hash_gen.h
> @@ -143,20 +143,6 @@ struct net_prefixes {
> return hsize * sizeof(struct hbucket *) + sizeof(struct htable);
> }
>
> -/* Compute htable_bits from the user input parameter hashsize */
> -static u8
> -htable_bits(u32 hashsize)
> -{
> - /* Assume that hashsize == 2^htable_bits */
> - u8 bits = fls(hashsize - 1);
> -
> - if (jhash_size(bits) != hashsize)
> - /* Round up to the first 2^n value */
> - bits = fls(hashsize);
> -
> - return bits;
> -}
> -
> #ifdef IP_SET_HASH_WITH_NETS
> #if IPSET_NET_COUNT > 1
> #define __CIDR(cidr, i) (cidr[i])
> @@ -1520,7 +1506,11 @@ struct mtype_resize_ad {
> if (!h)
> return -ENOMEM;
>
> - hbits = htable_bits(hashsize);
> + /* Compute htable_bits from the user input parameter hashsize.
> + * Assume that hashsize == 2^htable_bits,
> + * otherwise round up to the first 2^n value.
> + */
> + hbits = fls(hashsize - 1);
> hsize = htable_size(hbits);
> if (hsize == 0) {
> kfree(h);
> --
> 1.8.3.1
>
>
-
E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] netfilter: ipset: fix shift-out-of-bounds in htable_bits()
2020-12-17 14:53 ` [PATCH v2] netfilter: ipset: fix shift-out-of-bounds in htable_bits() Vasily Averin
2020-12-17 17:12 ` Jozsef Kadlecsik
@ 2020-12-17 18:44 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2020-12-17 18:44 UTC (permalink / raw)
To: Vasily Averin
Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller,
Jakub Kicinski, netfilter-devel, coreteam, syzkaller-bugs
On Thu, Dec 17, 2020 at 05:53:18PM +0300, Vasily Averin wrote:
> htable_bits() can call jhash_size(32) and trigger shift-out-of-bounds
>
> UBSAN: shift-out-of-bounds in net/netfilter/ipset/ip_set_hash_gen.h:151:6
> shift exponent 32 is too large for 32-bit type 'unsigned int'
> CPU: 0 PID: 8498 Comm: syz-executor519
> Not tainted 5.10.0-rc7-next-20201208-syzkaller #0
> Call Trace:
> __dump_stack lib/dump_stack.c:79 [inline]
> dump_stack+0x107/0x163 lib/dump_stack.c:120
> ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
> __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
> htable_bits net/netfilter/ipset/ip_set_hash_gen.h:151 [inline]
> hash_mac_create.cold+0x58/0x9b net/netfilter/ipset/ip_set_hash_gen.h:1524
> ip_set_create+0x610/0x1380 net/netfilter/ipset/ip_set_core.c:1115
> nfnetlink_rcv_msg+0xecc/0x1180 net/netfilter/nfnetlink.c:252
> netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
> nfnetlink_rcv+0x1ac/0x420 net/netfilter/nfnetlink.c:600
> netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
> netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
> netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
> sock_sendmsg_nosec net/socket.c:652 [inline]
> sock_sendmsg+0xcf/0x120 net/socket.c:672
> ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
> ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
> __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> This patch replaces htable_bits() by simple fls(hashsize - 1) call:
> it alone returns valid nbits both for round and non-round hashsizes.
> It is normal to set any nbits here because it is validated inside
> following htable_size() call which returns 0 for nbits>31.
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-12-17 18:44 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <4d915d3a-6a95-7784-4057-2faa17a061@blackhole.kfki.hu>
2020-12-17 14:53 ` [PATCH v2] netfilter: ipset: fix shift-out-of-bounds in htable_bits() Vasily Averin
2020-12-17 17:12 ` Jozsef Kadlecsik
2020-12-17 18:44 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).