| From 844839e796ca8bdc5b96ca52ab33006b085ba319 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 6 May 2021 05:53:23 -0700 |
| Subject: netfilter: nftables: avoid overflows in nft_hash_buckets() |
| |
| From: Eric Dumazet <edumazet@google.com> |
| |
| [ Upstream commit a54754ec9891830ba548e2010c889e3c8146e449 ] |
| |
| Number of buckets being stored in 32bit variables, we have to |
| ensure that no overflows occur in nft_hash_buckets() |
| |
| syzbot injected a size == 0x40000000 and reported: |
| |
| UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 |
| shift exponent 64 is too large for 64-bit type 'long unsigned int' |
| CPU: 1 PID: 29539 Comm: syz-executor.4 Not tainted 5.12.0-rc7-syzkaller #0 |
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| Call Trace: |
| __dump_stack lib/dump_stack.c:79 [inline] |
| dump_stack+0x141/0x1d7 lib/dump_stack.c:120 |
| ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 |
| __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 |
| __roundup_pow_of_two include/linux/log2.h:57 [inline] |
| nft_hash_buckets net/netfilter/nft_set_hash.c:411 [inline] |
| nft_hash_estimate.cold+0x19/0x1e net/netfilter/nft_set_hash.c:652 |
| nft_select_set_ops net/netfilter/nf_tables_api.c:3586 [inline] |
| nf_tables_newset+0xe62/0x3110 net/netfilter/nf_tables_api.c:4322 |
| nfnetlink_rcv_batch+0xa09/0x24b0 net/netfilter/nfnetlink.c:488 |
| nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:612 [inline] |
| nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:630 |
| netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] |
| netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 |
| netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 |
| sock_sendmsg_nosec net/socket.c:654 [inline] |
| sock_sendmsg+0xcf/0x120 net/socket.c:674 |
| ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 |
| ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 |
| __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 |
| do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 |
| |
| Fixes: 0ed6389c483d ("netfilter: nf_tables: rename set implementations") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: syzbot <syzkaller@googlegroups.com> |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/netfilter/nft_set_hash.c | 10 +++++++++- |
| 1 file changed, 9 insertions(+), 1 deletion(-) |
| |
| diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c |
| index 4d3f147e8d8d..d7083bcb20e8 100644 |
| --- a/net/netfilter/nft_set_hash.c |
| +++ b/net/netfilter/nft_set_hash.c |
| @@ -393,9 +393,17 @@ static void nft_rhash_destroy(const struct nft_set *set) |
| (void *)set); |
| } |
| |
| +/* Number of buckets is stored in u32, so cap our result to 1U<<31 */ |
| +#define NFT_MAX_BUCKETS (1U << 31) |
| + |
| static u32 nft_hash_buckets(u32 size) |
| { |
| - return roundup_pow_of_two(size * 4 / 3); |
| + u64 val = div_u64((u64)size * 4, 3); |
| + |
| + if (val >= NFT_MAX_BUCKETS) |
| + return NFT_MAX_BUCKETS; |
| + |
| + return roundup_pow_of_two(val); |
| } |
| |
| static bool nft_rhash_estimate(const struct nft_set_desc *desc, u32 features, |
| -- |
| 2.30.2 |
| |