Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 11 Jan 2023 13:00:53 +0100
From:   Simon Horman <simon.horman@corigine.com>
To:     Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Cc:     Pablo Neira Ayuso <pablo@netfilter.org>,
        Jozsef Kadlecsik <kadlec@netfilter.org>,
        Florian Westphal <fw@strlen.de>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        "netfilter-devel@vger.kernel.org" <netfilter-devel@vger.kernel.org>,
        "coreteam@netfilter.org" <coreteam@netfilter.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>
Subject: Re: [PATCH v2] netfilter: ipset: Fix overflow before widen in the
 bitmap_ip_create() function.
Message-ID: <Y76k9QxybRtf9aG6@corigine.com>
References: <Y76NQ7tQVB7kE0dG@corigine.com>
 <20230111115741.3347031-1-Ilia.Gavrilov@infotecs.ru>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230111115741.3347031-1-Ilia.Gavrilov@infotecs.ru>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?juvDwWpkZ8kGoBAatIthrNz0Y2K9E3hUYzGw2sehC7sXoCh8ydbF6ANU6FCu?=
 =?us-ascii?Q?yrLnUyLw4CBxtVXfLiz+SdsyhXCJh8lZKNHHaIVD+QeA8pkLjzCP7w3WON+W?=
 =?us-ascii?Q?fRXh/pPv60S85e1SdESJrNJGQjDpcwvaX2y9NDE/nOY2lO3Hb5l3pa1FWYuS?=
 =?us-ascii?Q?qNlJ/VsXB8U9Iy1+nQVl39skKDbiv/lc2fBo1IMXbnihM034uEvSdKtCMTju?=
 =?us-ascii?Q?PUAU9hk03qqEDnTmTYgjQa+WwdhrQtk3wJeRBePtZaz9E9LQAKGEi2oS+7UU?=
 =?us-ascii?Q?qCwlW5l2utYt7+Qfw11nRCagPcl/XEsMLhu/El5voQ1bc11xRZqBHBnXIAjs?=
 =?us-ascii?Q?FGujYGq0RCiPgiPXwQQYJqmh+9ukEwu6zTpb77DlnkANyYu5xg/2O9KMjZZy?=
 =?us-ascii?Q?vwvrzMVb61mFJH/CyTCSGHoGu8IHl0KrsKuFtwFJsmU+6t7uYjFVcGggQJKu?=
 =?us-ascii?Q?qBqeoV05T70pd4UJs3VmwSWEgL0uDnfd7PrMUpASJmMCRnPVWYNIiA5vXrhJ?=
 =?us-ascii?Q?0t5TtWIwK2qAee6gFZ3CH+8q1j29TC+fTvZC+ErUa9E7qCDeq/sDfIOViZo3?=
 =?us-ascii?Q?5RuaTf0NCt9/JxvnKuiJ5R/2Cn4a6toFss/UwmKlsva7KBIiv4nI8tAmvitH?=
 =?us-ascii?Q?EQu60znyP1UaJejxCujWY/pfhozzxvzOVhbW0A9efWV/wTr+lo963i1cbt8k?=
 =?us-ascii?Q?Ks/qfcD9HgVzCjtC967fjfGlTKv5OUBSY7+jIE7uDkr6RKKm32FBejQnFc3k?=
 =?us-ascii?Q?zF7PPsjA8I/+rY6p/2GeQpYAyCxFzlRxH+R1d734zPKHEN8qN1QkplhtR6OU?=
 =?us-ascii?Q?20nJnzkcjrBwPKjqXZ2QuEfO6YHSy3U/EPtnlvyvAb7VIL2liJ9zi0Pqb2Dr?=
 =?us-ascii?Q?3gOsvwn+Gw/yQinFKfAuyK9+ykJQaOwVwrDqOVu+eBDlXChYv5TfAdAY8iBO?=
 =?us-ascii?Q?CqCM959YHolV2wQ9rXSwHnWg538lJrqqAjQKlGxYy9ISTg0X0pCaTlB9IXYb?=
 =?us-ascii?Q?QPaCxNLT78gDtYfQ1II1w+jvn2g2TbCdRYMX3Tg/83Os3F6p7Hnp3GUJSPyr?=
 =?us-ascii?Q?UTJxjPuMrdn5r4gfE4uGfcRPFEA3npEFTvKtmcDxIf0wmdw6gcGqUH8Xk+dD?=
 =?us-ascii?Q?L0yrEjRAb50PWQ9Ymr/S6ir8hBul8Z9XqTkjcs3EzGighaiHT3cjDG4YtQZY?=
 =?us-ascii?Q?GHuZP6wifZ+t17St1yk6grKGEfk0uY19LnTKu5Yr5N8avzRqiOr3s3cNDcCs?=
 =?us-ascii?Q?oR+BR+Q2qTmHsRWhbqgu7tIhBdVWRKAEkJtr44Z+PVyp2yTX8Fx6rBbYSCJu?=
 =?us-ascii?Q?BlDe/ryc/C1IURWS1STFmfOcrFDRc+GhECUC7moQNKwU4Zpmn8cFGcK+Z0vd?=
 =?us-ascii?Q?0941Xs91mStX7TVDMpTGlvkssJ+1/y/CquxMjSmDM/9kHTn8QNsxwSgJvec9?=
 =?us-ascii?Q?X3FHFdJiiT2kcnReSgXl4+AM1EUOpj/tp4z3KugiW+QULvgcGHWrNGuAxISd?=
 =?us-ascii?Q?+CWMtx6oONuBzfxNmPPYXk+XScXshrSjHAZ7gWtLM2VcqL4479Bmf24KTKs8?=
 =?us-ascii?Q?zcxLQsu6ELB1PPkUvXxLIGY4RJOTnvIJEeCiVyrE2ZVVdhttsUUGRVpae0Ah?=
 =?us-ascii?Q?jzU27PuaI6C7ge5IOmTEzHQEXmD5I4R/hG0qSJwtETn2Zu0xOlZLDoX2zRg4?=
 =?us-ascii?Q?TOzPlw=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8fe2856b-ea6c-4b85-e767-08daf3cb821f
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Jan 2023 12:01:01.5260
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: o6Aq7yiDdhYcSdMpT0tuJ6V3Bq5peS6ayUGsqYDDZPz2WV9mic94PDif7LgjcWosHwRVofgpvoIP7BvYdToistUz4VA2OFBQy3UMfHsHmFk=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR13MB5626
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, Jan 11, 2023 at 11:57:39AM +0000, Gavrilov Ilia wrote:
> [You don't often get email from ilia.gavrilov@infotecs.ru. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of
> an arithmetic expression 2 << (netmask - mask_bits - 1) is subject
> to overflow due to a failure casting operands to a larger data type
> before performing the arithmetic.
> 
> Note that it's harmless since the value will be checked at the next step.
> 
> Found by InfoTeCS on behalf of Linux Verification Center
> (linuxtesting.org) with SVACE.
> 
> Fixes: b9fed748185a ("netfilter: ipset: Check and reject crazy /0 input parameters")
> Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>

Reviewed-by: Simon Horman <simon.horman@corigine.com>

> ---
> v2: Fix typo of the last_ip value in the description. Fix the expression for 'hosts'.
>  net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
> index a8ce04a4bb72..e4fa00abde6a 100644
> --- a/net/netfilter/ipset/ip_set_bitmap_ip.c
> +++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
> @@ -308,8 +308,8 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
>                         return -IPSET_ERR_BITMAP_RANGE;
> 
>                 pr_debug("mask_bits %u, netmask %u\n", mask_bits, netmask);
> -               hosts = 2 << (32 - netmask - 1);
> -               elements = 2 << (netmask - mask_bits - 1);
> +               hosts = 2U << (32 - netmask - 1);
> +               elements = 2UL << (netmask - mask_bits - 1);
>         }
>         if (elements > IPSET_BITMAP_MAX_RANGE + 1)
>                 return -IPSET_ERR_BITMAP_RANGE_SIZE;
> --
> 2.30.2