5.4-stable patches

added patches:
	netfilter-ipset-fix-overflow-before-widen-in-the-bitmap_ip_create-function.patch

diff --git a/queue-5.4/netfilter-ipset-fix-overflow-before-widen-in-the-bitmap_ip_create-function.patch b/queue-5.4/netfilter-ipset-fix-overflow-before-widen-in-the-bitmap_ip_create-function.patch
new file mode 100644 (file)
index 0000000..ae6d2ef
--- /dev/null
+++ b/queue-5.4/netfilter-ipset-fix-overflow-before-widen-in-the-bitmap_ip_create-function.patch
@@ -0,0 +1,41 @@
+From 9ea4b476cea1b7d461d16dda25ca3c7e616e2d15 Mon Sep 17 00:00:00 2001
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Date: Wed, 11 Jan 2023 11:57:39 +0000
+Subject: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+commit 9ea4b476cea1b7d461d16dda25ca3c7e616e2d15 upstream.
+
+When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of
+an arithmetic expression 2 << (netmask - mask_bits - 1) is subject
+to overflow due to a failure casting operands to a larger data type
+before performing the arithmetic.
+
+Note that it's harmless since the value will be checked at the next step.
+
+Found by InfoTeCS on behalf of Linux Verification Center
+(linuxtesting.org) with SVACE.
+
+Fixes: b9fed748185a ("netfilter: ipset: Check and reject crazy /0 input parameters")
+Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipset/ip_set_bitmap_ip.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
++++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
+@@ -296,8 +296,8 @@ bitmap_ip_create(struct net *net, struct
+                       return -IPSET_ERR_BITMAP_RANGE;
+ 
+               pr_debug("mask_bits %u, netmask %u\n", mask_bits, netmask);
+-              hosts = 2 << (32 - netmask - 1);
+-              elements = 2 << (netmask - mask_bits - 1);
++              hosts = 2U << (32 - netmask - 1);
++              elements = 2UL << (netmask - mask_bits - 1);
+       }
+       if (elements > IPSET_BITMAP_MAX_RANGE + 1)
+               return -IPSET_ERR_BITMAP_RANGE_SIZE;

diff --git a/queue-5.4/series b/queue-5.4/series
index 6cf558a6343b3fdcd363c67d26d16f16a3596330..c7f8999487d180f15a58587205eb132d9174ed08 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -629,3 +629,4 @@ ext4-fix-bug_on-in-__es_tree_search-caused-by-bad-qu.patch
 ext4-lost-matching-pair-of-trace-in-ext4_truncate.patch
 ext4-fix-use-after-free-in-ext4_orphan_cleanup.patch
 ext4-fix-uninititialized-value-in-ext4_evict_inode.patch
+netfilter-ipset-fix-overflow-before-widen-in-the-bitmap_ip_create-function.patch