UBSAN: shift-out-of-bounds in hash_mac_create

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a9e26cb5 Add linux-next specific files for 20201208
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16f05123500000
kernel config: https://syzkaller.appspot.com/x/.config?x=e259434a8eaf0206
dashboard link: https://syzkaller.appspot.com/bug?extid=d66bfadebca46cf61a2b
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13afdcbd500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12b14b37500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d66bfa...@syzkaller.appspotmail.com

================================================================================
UBSAN: shift-out-of-bounds in net/netfilter/ipset/ip_set_hash_gen.h:151:6
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 0 PID: 8498 Comm: syz-executor519 Not tainted 5.10.0-rc7-next-20201208-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
htable_bits net/netfilter/ipset/ip_set_hash_gen.h:151 [inline]
hash_mac_create.cold+0x58/0x9b net/netfilter/ipset/ip_set_hash_gen.h:1524
ip_set_create+0x610/0x1380 net/netfilter/ipset/ip_set_core.c:1115
nfnetlink_rcv_msg+0xecc/0x1180 net/netfilter/nfnetlink.c:252
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
nfnetlink_rcv+0x1ac/0x420 net/netfilter/nfnetlink.c:600
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:672
____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
___sys_sendmsg+0xf3/0x170 net/socket.c:2399
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x440419
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffd29571ba8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440419
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000009 R09: 00000000004002c8
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000401c20
R13: 0000000000401cb0 R14: 0000000000000000 R15: 0000000000000000
================================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Vasily Averin]

UBSAN: shift-out-of-bounds in net/netfilter/ipset/ip_set_hash_gen.h:151:6
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 0 PID: 8498 Comm: syz-executor519
Not tainted 5.10.0-rc7-next-20201208-syzkaller #0

Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
htable_bits net/netfilter/ipset/ip_set_hash_gen.h:151 [inline]
hash_mac_create.cold+0x58/0x9b net/netfilter/ipset/ip_set_hash_gen.h:1524
ip_set_create+0x610/0x1380 net/netfilter/ipset/ip_set_core.c:1115
nfnetlink_rcv_msg+0xecc/0x1180 net/netfilter/nfnetlink.c:252
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
nfnetlink_rcv+0x1ac/0x420 net/netfilter/nfnetlink.c:600
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:672
____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
___sys_sendmsg+0xf3/0x170 net/socket.c:2399
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 1feab10d7e6d("netfilter: ipset: Unified hash type generation")
Reported-by: syzbot+d66bfa...@syzkaller.appspotmail.com
Signed-off-by: Vasily Averin <v...@virtuozzo.com>
---
net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 521e970..0c39cd11 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -150,7 +150,7 @@ struct net_prefixes {
/* Assume that hashsize == 2^htable_bits */
u8 bits = fls(hashsize - 1);

- if (jhash_size(bits) != hashsize)
+ if ((bits < 32) && (jhash_size(bits) != hashsize))
/* Round up to the first 2^n value */
bits = fls(hashsize);

--
1.8.3.1

[Jozsef Kadlecsik]

Hi Vasily,

I believe it still leaves a window open and "bits" can get the value 32
when computing from hashsize, and jhash_size() is called at several
places later on using that value. So what I'm thinking is like this:

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h
b/net/netfilter/ipset/ip_set_hash_gen.h
index 521e970be402..9c6ea446adf2 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -150,6 +150,10 @@ htable_bits(u32 hashsize)

/* Assume that hashsize == 2^htable_bits */
u8 bits = fls(hashsize - 1);

+ /* We must fit both into u32 in jhash and size_t */
+ if (bits >= 31)
+ return 31;
+
if (jhash_size(bits) != hashsize)

/* Round up to the first 2^n value */
bits = fls(hashsize);

Best regards,
Jozsef
-
E-mail : kad...@blackhole.kfki.hu, kadlecsi...@wigner.hu
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
H-1525 Budapest 114, POB. 49, Hungary

[Vasily Averin]

Dear Jozsef,
as far as I see htable_bits() is called only from IPSET_TOKEN(HTYPE, _create)()

        hbits = htable_bits(hashsize);
        hsize = htable_size(hbits);
        if (hsize == 0) {
                kfree(h);
                return -ENOMEM;

htable_size(u8 hbits)
{
...

        /* We must fit both into u32 in jhash and size_t */

        if (hbits > 31)
                return 0;

My patch does not change current behaviour:  for hashsize > 0x80000000 htable_bits returns 32,
then htable_size() returns 0. and then _create fails with -ENOMEM.
So it seems for me my patch is correct, please le me know if I'm wrong.

Your patch forces htable_bits() to return 31 and then according _create() function will allocate hash for 0x80000000 buckets.

Frankly speaking I have no objections. However such huge allocation looks insane for me and I prefer to fail it.

Thank you,
  Vasily Averin

[syzbot]

> #syz test:

want 2 args (repo, branch), got 6

>
> On 12/14/20 1:13 AM, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: a9e26cb5 Add linux-next specific files for 20201208
>> git tree: linux-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=16f05123500000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=e259434a8eaf0206
>> dashboard link: https://syzkaller.appspot.com/bug?extid=d66bfadebca46cf61a2b
>> compiler: gcc (GCC) 10.1.0-syz 20200507
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13afdcbd500000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12b14b37500000
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+d66bfa...@syzkaller.appspotmail.com
>>
>> ================================================================================

>> UBSAN: shift-out-of-bounds in net/netfilter/ipset/ip_set_hash_gen.h:151:6
>> shift exponent 32 is too large for 32-bit type 'unsigned int'
>> CPU: 0 PID: 8498 Comm: syz-executor519 Not tainted 5.10.0-rc7-next-20201208-syzkaller #0

>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

>> Call Trace:
>> __dump_stack lib/dump_stack.c:79 [inline]
>> dump_stack+0x107/0x163 lib/dump_stack.c:120
>> ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
>> __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
>> htable_bits net/netfilter/ipset/ip_set_hash_gen.h:151 [inline]
>> hash_mac_create.cold+0x58/0x9b net/netfilter/ipset/ip_set_hash_gen.h:1524
>> ip_set_create+0x610/0x1380 net/netfilter/ipset/ip_set_core.c:1115
>> nfnetlink_rcv_msg+0xecc/0x1180 net/netfilter/nfnetlink.c:252
>> netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
>> nfnetlink_rcv+0x1ac/0x420 net/netfilter/nfnetlink.c:600
>> netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
>> netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
>> netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
>> sock_sendmsg_nosec net/socket.c:652 [inline]
>> sock_sendmsg+0xcf/0x120 net/socket.c:672
>> ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
>> ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
>> __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
>> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
>> entry_SYSCALL_64_after_hwframe+0x44/0xa9

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+d66bfa...@syzkaller.appspotmail.com

Tested on:

commit: 3db1a3fa Merge tag 'staging-5.11-rc1' of git://git.kernel...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=e4a8d707cb4aa124

dashboard link: https://syzkaller.appspot.com/bug?extid=d66bfadebca46cf61a2b
compiler: gcc (GCC) 10.1.0-syz 20200507

patch: https://syzkaller.appspot.com/x/patch.diff?x=10f2880f500000

Note: testing is done by a robot and is best-effort only.

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file net/netfilter/ipset/ip_set_hash_gen.h
Hunk #1 FAILED at 143.
Hunk #2 succeeded at 1521 (offset 1 line).
1 out of 2 hunks FAILED

Tested on:

commit: 3db1a3fa Merge tag 'staging-5.11-rc1' of git://git.kernel...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master

dashboard link: https://syzkaller.appspot.com/bug?extid=d66bfadebca46cf61a2b
compiler: gcc (GCC) 10.1.0-syz 20200507

patch: https://syzkaller.appspot.com/x/patch.diff?x=1733c937500000

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+d66bfa...@syzkaller.appspotmail.com

Tested on:

commit: 3db1a3fa Merge tag 'staging-5.11-rc1' of git://git.kernel...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master

kernel config: https://syzkaller.appspot.com/x/.config?x=e4a8d707cb4aa124

dashboard link: https://syzkaller.appspot.com/bug?extid=d66bfadebca46cf61a2b
compiler: gcc (GCC) 10.1.0-syz 20200507

patch: https://syzkaller.appspot.com/x/patch.diff?x=17a87923500000

[Vasily Averin]

htable_bits() can call jhash_size(32) and trigger shift-out-of-bounds

This patch replaces htable_bits() by simple fls(hashsize - 1) call:
it alone returns valid nbits both for round and non-round hashsizes.
It is normal to set any nbits here because it is validated inside
following htable_size() call which returns 0 for nbits>31.

Fixes: 1feab10d7e6d("netfilter: ipset: Unified hash type generation")
Reported-by: syzbot+d66bfa...@syzkaller.appspotmail.com
Signed-off-by: Vasily Averin <v...@virtuozzo.com>
---

net/netfilter/ipset/ip_set_hash_gen.h | 20 +++++---------------
1 file changed, 5 insertions(+), 15 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 521e970..7d01086 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -143,20 +143,6 @@ struct net_prefixes {
return hsize * sizeof(struct hbucket *) + sizeof(struct htable);
}

-/* Compute htable_bits from the user input parameter hashsize */
-static u8
-htable_bits(u32 hashsize)
-{
- /* Assume that hashsize == 2^htable_bits */
- u8 bits = fls(hashsize - 1);

-
- if (jhash_size(bits) != hashsize)

- /* Round up to the first 2^n value */
- bits = fls(hashsize);
-
- return bits;
-}
-
#ifdef IP_SET_HASH_WITH_NETS
#if IPSET_NET_COUNT > 1
#define __CIDR(cidr, i) (cidr[i])
@@ -1520,7 +1506,11 @@ struct mtype_resize_ad {
if (!h)
return -ENOMEM;

- hbits = htable_bits(hashsize);
+ /* Compute htable_bits from the user input parameter hashsize.
+ * Assume that hashsize == 2^htable_bits,
+ * otherwise round up to the first 2^n value.
+ */
+ hbits = fls(hashsize - 1);

hsize = htable_size(hbits);
if (hsize == 0) {
kfree(h);

--
1.8.3.1

[Jozsef Kadlecsik]

Acked-by: Jozsef Kadlecsik <kad...@netfilter.org>

Best regards,
Jozsef

[Pablo Neira Ayuso]

Applied, thanks.