netfilter: ipset: fix hash size checking in kernel

The hash size must fit both into u32 (jhash) and the max value of
size_t. The missing checking could lead to kernel crash, bug reported
by Seblu.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

7 files changed, 49 insertions, 21 deletions

diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index 5139dea6019e..828ce46cb34b 100644
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -364,6 +364,7 @@ hash_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 netmask, hbits;
+        size_t hsize;
         struct ip_set_hash *h;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
@@ -405,9 +406,12 @@ hash_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index 9c27e249c171..e8dbb498af8f 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -449,6 +449,7 @@ hash_ipport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -476,9 +477,12 @@ hash_ipport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index 9134057c0728..52f79d8ef741 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -467,6 +467,7 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -494,9 +495,12 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 5d05e6969862..97583f5af745 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -616,6 +616,7 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -645,9 +646,12 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index 7c3d945517cf..1721cdecc9f9 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -460,6 +460,7 @@ hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         struct ip_set_hash *h;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -489,9 +490,12 @@ hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index f24037ff4322..33bafc97ca6d 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -722,6 +722,7 @@ hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -752,9 +753,12 @@ hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->ahash_max = AHASH_MAX_SIZE;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index ce2e77100b64..3a5e198641d6 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -572,6 +572,7 @@ hash_netport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         struct ip_set_hash *h;
         u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
         u8 hbits;
+        size_t hsize;
 
         if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                 return -IPSET_ERR_INVALID_FAMILY;
@@ -601,9 +602,12 @@ hash_netport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
         h->timeout = IPSET_NO_TIMEOUT;
 
         hbits = htable_bits(hashsize);
-        h->table = ip_set_alloc(
-                        sizeof(struct htable)
-                        + jhash_size(hbits) * sizeof(struct hbucket));
+        hsize = htable_size(hbits);
+        if (hsize == 0) {
+                kfree(h);
+                return -ENOMEM;
+        }
+        h->table = ip_set_alloc(hsize);
         if (!h->table) {
                 kfree(h);
                 return -ENOMEM;