Re: [syzbot] [netfilter?] KASAN: slab-out-of-bounds Read in bitmap_ip_add (2)

From: Edward Adam Davis
Date: Tue Nov 12 2024 - 04:29:25 EST


the value of first_ip or netmask are incorrect ?

#syz test

diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index e4fa00abde6a..0fe17fba3b86 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -183,6 +183,10 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[],

for (; !before(ip_to, ip); ip += map->hosts) {
e.id = ip_to_id(map, ip);
+ printk("mnm: %u, firstip: %u, hosts: %u, id: %u, %s\n", (ip & ip_set_hostmask(map->netmask)), map->first_ip, map->hosts, ei.id, __func__);
+ if (ip & ip_set_hostmask(map->netmask) < map->first_ip)
+ continue;
+
ret = adtfn(set, &e, &ext, &ext, flags);

if (ret && !ip_set_eexist(ret, flags))