Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1bbbcf6d authored by Kadlecsik József's avatar Kadlecsik József Committed by Greg Kroah-Hartman
Browse files

netfilter: ipset: use bitmap infrastructure completely 



commit 32c72165dbd0e246e69d16a3ad348a4851afd415 upstream.

The bitmap allocation did not use full unsigned long sizes
when calculating the required size and that was triggered by KASAN
as slab-out-of-bounds read in several places. The patch fixes all
of them.

Reported-by: default avatar <syzbot+fabca5cbf5e54f3fe2de@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+827ced406c9a1d9570ed@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+190d63957b22ef673ea5@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+dfccdb2bdb4a12ad425e@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+df0d0f5895ef1f41a65b@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+b08bd19bb37513357fd4@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+53cdd0ec0bbabd53370a@syzkaller.appspotmail.com>
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 33a451d9

include/linux/netfilter/ipset/ip_set.h

+0 −7
Original line number Diff line number Diff line
@@ -537,13 +537,6 @@ ip6addrptr(const struct sk_buff *skb, bool src, struct in6_addr *addr) 
	       sizeof(*addr));

}



/* Calculate the bytes required to store the inclusive range of a-b */

static inline int

bitmap_bytes(u32 a, u32 b)

{

	return 4 * ((((b - a + 8) / 8) + 3) / 4);

}



#include <linux/netfilter/ipset/ip_set_timeout.h>

#include <linux/netfilter/ipset/ip_set_comment.h>

net/netfilter/ipset/ip_set_bitmap_gen.h

+1 −1
Original line number Diff line number Diff line
@@ -81,7 +81,7 @@ mtype_flush(struct ip_set *set) 


	if (set->extensions & IPSET_EXT_DESTROY)

		mtype_ext_cleanup(set);

	memset(map->members, 0, map->memsize);

	bitmap_zero(map->members, map->elements);

}



static int

net/netfilter/ipset/ip_set_bitmap_ip.c

+3 −3
Original line number Diff line number Diff line
@@ -40,7 +40,7 @@ MODULE_ALIAS("ip_set_bitmap:ip"); 


/* Type structure */

struct bitmap_ip {

	void *members;		/* the set members */

	unsigned long *members;	/* the set members */

	u32 first_ip;		/* host byte order, included in range */

	u32 last_ip;		/* host byte order, included in range */

	u32 elements;		/* number of max elements in the set */
@@ -222,7 +222,7 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map, 
	    u32 first_ip, u32 last_ip,

	    u32 elements, u32 hosts, u8 netmask)

{

	map->members = ip_set_alloc(map->memsize);

	map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);

	if (!map->members)

		return false;

	map->first_ip = first_ip;
@@ -315,7 +315,7 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[], 
	if (!map)

		return -ENOMEM;



	map->memsize = bitmap_bytes(0, elements - 1);

	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);

	set->variant = &bitmap_ip;

	if (!init_map_ip(set, map, first_ip, last_ip,

			 elements, hosts, netmask)) {

net/netfilter/ipset/ip_set_bitmap_ipmac.c

+3 −3
Original line number Diff line number Diff line
@@ -46,7 +46,7 @@ enum { 


/* Type structure */

struct bitmap_ipmac {

	void *members;		/* the set members */

	unsigned long *members;	/* the set members */

	u32 first_ip;		/* host byte order, included in range */

	u32 last_ip;		/* host byte order, included in range */

	u32 elements;		/* number of max elements in the set */
@@ -299,7 +299,7 @@ static bool 
init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,

	       u32 first_ip, u32 last_ip, u32 elements)

{

	map->members = ip_set_alloc(map->memsize);

	map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);

	if (!map->members)

		return false;

	map->first_ip = first_ip;
@@ -363,7 +363,7 @@ bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[], 
	if (!map)

		return -ENOMEM;



	map->memsize = bitmap_bytes(0, elements - 1);

	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);

	set->variant = &bitmap_ipmac;

	if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {

		kfree(map);

net/netfilter/ipset/ip_set_bitmap_port.c

+3 −3
Original line number Diff line number Diff line
@@ -34,7 +34,7 @@ MODULE_ALIAS("ip_set_bitmap:port"); 


/* Type structure */

struct bitmap_port {

	void *members;		/* the set members */

	unsigned long *members;	/* the set members */

	u16 first_port;		/* host byte order, included in range */

	u16 last_port;		/* host byte order, included in range */

	u32 elements;		/* number of max elements in the set */
@@ -207,7 +207,7 @@ static bool 
init_map_port(struct ip_set *set, struct bitmap_port *map,

	      u16 first_port, u16 last_port)

{

	map->members = ip_set_alloc(map->memsize);

	map->members = bitmap_zalloc(map->elements, GFP_KERNEL | __GFP_NOWARN);

	if (!map->members)

		return false;

	map->first_port = first_port;
@@ -250,7 +250,7 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[], 
		return -ENOMEM;



	map->elements = elements;

	map->memsize = bitmap_bytes(0, map->elements);

	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);

	set->variant = &bitmap_port;

	if (!init_map_port(set, map, first_port, last_port)) {

		kfree(map);