Received-SPF: pass (google.com: domain of linux-kernel+bounces-88622-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Fri, 1 Mar 2024 16:29:25 +0100
From: Jiri Pirko <jiri@resnulli.us>
To: Lena Wang =?utf-8?B?KOeOi+WonCk=?= <Lena.Wang@mediatek.com>
Cc: "fw@strlen.de" <fw@strlen.de>,
	"davem@davemloft.net" <davem@davemloft.net>,
	"pablo@netfilter.org" <pablo@netfilter.org>,
	"kadlec@netfilter.org" <kadlec@netfilter.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
	"netfilter-devel@vger.kernel.org" <netfilter-devel@vger.kernel.org>
Subject: Re: [PATCH net v2] netfilter: Add protection for bmp length out of
 range
Message-ID: <ZeH0VdU-q_UyX0t0@nanopsycho>
References: <d2b63acc5cd76db46132eb6ebd106f159fc5132d.camel@mediatek.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <d2b63acc5cd76db46132eb6ebd106f159fc5132d.camel@mediatek.com>

Fri, Mar 01, 2024 at 04:12:24PM CET, Lena.Wang@mediatek.com wrote:
>From: Lena Wang <lena.wang@mediatek.com>
>
>UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts
>that are out of bounds for their data type.
>
>vmlinux   get_bitmap(b=75) + 712
><net/netfilter/nf_conntrack_h323_asn1.c:0>
>vmlinux   decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018,
>level=134443100) + 1956
><net/netfilter/nf_conntrack_h323_asn1.c:592>
>vmlinux   decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216
><net/netfilter/nf_conntrack_h323_asn1.c:814>
>vmlinux   decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812
><net/netfilter/nf_conntrack_h323_asn1.c:576>
>vmlinux   decode_choice(base=0xFFFFFFD008037280, level=0) + 1216
><net/netfilter/nf_conntrack_h323_asn1.c:814>
>vmlinux   DecodeRasMessage() + 304
><net/netfilter/nf_conntrack_h323_asn1.c:833>
>vmlinux   ras_help() + 684
><net/netfilter/nf_conntrack_h323_main.c:1728>
>vmlinux   nf_confirm() + 188
><net/netfilter/nf_conntrack_proto.c:137>
>
>Due to abnormal data in skb->data, the extension bitmap length
>exceeds 32 when decoding ras message. Then get_bitmap uses the
>length to make a shift operation. It will change into negative
>after several loop.
>
>UBSAN load can detect a negative shift as an undefined behaviour
>and reports an exception.
>
>So we should add the protection to avoid the length exceeding 32.
>If it exceeds it will return out of range error and stop decoding
>ras message.
>
>Signed-off-by: Lena Wang <lena.wang@mediatek.com>

Missing "Fixes" tag, again...