Re: [syzbot] [netfilter?] KASAN: slab-out-of-bounds Read in bitmap_ip_add (2)

[Edward Adam Davis]

the value of first_ip or netmask are incorrect ?

#syz test

diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index e4fa00abde6a..0fe17fba3b86 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -183,6 +183,10 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	for (; !before(ip_to, ip); ip += map->hosts) {
 		e.id = ip_to_id(map, ip);
+		printk("mnm: %u, firstip: %u, hosts: %u, id: %u, %s\n", (ip & ip_set_hostmask(map->netmask)),  map->first_ip, map->hosts, ei.id, __func__);
+		if (ip & ip_set_hostmask(map->netmask) < map->first_ip)
+			continue;
+
 		ret = adtfn(set, &e, &ext, &ext, flags);
 
 		if (ret && !ip_set_eexist(ret, flags))