Commit 0a4feb89 authored Dec 17, 2020 by Vasily Averin Committed by Greg Kroah-Hartman Jan 12, 2021

netfilter: ipset: fix shift-out-of-bounds in htable_bits()



commit 5c8193f568ae16f3242abad6518dc2ca6c8eef86 upstream.

htable_bits() can call jhash_size(32) and trigger shift-out-of-bounds

UBSAN: shift-out-of-bounds in net/netfilter/ipset/ip_set_hash_gen.h:151:6
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 0 PID: 8498 Comm: syz-executor519
 Not tainted 5.10.0-rc7-next-20201208-syzkaller #0
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 htable_bits net/netfilter/ipset/ip_set_hash_gen.h:151 [inline]
 hash_mac_create.cold+0x58/0x9b net/netfilter/ipset/ip_set_hash_gen.h:1524
 ip_set_create+0x610/0x1380 net/netfilter/ipset/ip_set_core.c:1115
 nfnetlink_rcv_msg+0xecc/0x1180 net/netfilter/nfnetlink.c:252
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 nfnetlink_rcv+0x1ac/0x420 net/netfilter/nfnetlink.c:600
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

This patch replaces htable_bits() by simple fls(hashsize - 1) call:
it alone returns valid nbits both for round and non-round hashsizes.
It is normal to set any nbits here because it is validated inside
following htable_size() call which returns 0 for nbits>31.

Fixes: 1feab10d("netfilter: ipset: Unified hash type generation")
Reported-by:  <syzbot+d66bfadebca46cf61a2b@syzkaller.appspotmail.com>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 00d2619b

net/netfilter/ipset/ip_set_hash_gen.h

+5 −15

Original line number	Diff line number	Diff line
		@@ -113,20 +113,6 @@ htable_size(u8 hbits)
		return hsize * sizeof(struct hbucket *) + sizeof(struct htable);
		}

		/* Compute htable_bits from the user input parameter hashsize */
		static u8
		htable_bits(u32 hashsize)
		{
		/* Assume that hashsize == 2^htable_bits */
		u8 bits = fls(hashsize - 1);

		if (jhash_size(bits) != hashsize)
		/* Round up to the first 2^n value */
		bits = fls(hashsize);

		return bits;
		}

		#ifdef IP_SET_HASH_WITH_NETS
		#if IPSET_NET_COUNT > 1
		#define __CIDR(cidr, i) (cidr[i])
		@@ -1309,7 +1295,11 @@ IPSET_TOKEN(HTYPE, _create)(struct net net, struct ip_set set,
		get_random_bytes(&h->initval, sizeof(h->initval));
		set->timeout = IPSET_NO_TIMEOUT;

		hbits = htable_bits(hashsize);
		/* Compute htable_bits from the user input parameter hashsize.
		* Assume that hashsize == 2^htable_bits,
		* otherwise round up to the first 2^n value.
		*/
		hbits = fls(hashsize - 1);
		hsize = htable_size(hbits);
		if (hsize == 0) {
		kfree(h);