diff options
| author | Jozsef Kadlecsik <kadlec@netfilter.org> | 2020-01-19 12:04:13 +0100 |
|---|---|---|
| committer | Jozsef Kadlecsik <kadlec@netfilter.org> | 2020-01-19 22:09:38 +0100 |
| commit | b661f385ab7457f4d45b2693631b590aa26c8a8f (patch) | |
| tree | 0f1eac0549c5a127b8bf0850b8b1ba0375b8f7dc /kernel/net/netfilter/ipset/ip_set_bitmap_gen.h | |
| parent | d5bfa437b4c0efb49873c5f5e4d2e1d543252112 (diff) | |
netfilter: ipset: use bitmap infrastructure completely
The bitmap allocation did not use full unsigned long sizes
when calculating the required size and that was triggered by KASAN
as slab-out-of-bounds read in several places. The patch fixes all
of them.
Reported-by: syzbot+fabca5cbf5e54f3fe2de@syzkaller.appspotmail.com
Reported-by: syzbot+827ced406c9a1d9570ed@syzkaller.appspotmail.com
Reported-by: syzbot+190d63957b22ef673ea5@syzkaller.appspotmail.com
Reported-by: syzbot+dfccdb2bdb4a12ad425e@syzkaller.appspotmail.com
Reported-by: syzbot+df0d0f5895ef1f41a65b@syzkaller.appspotmail.com
Reported-by: syzbot+b08bd19bb37513357fd4@syzkaller.appspotmail.com
Reported-by: syzbot+53cdd0ec0bbabd53370a@syzkaller.appspotmail.com
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Diffstat (limited to 'kernel/net/netfilter/ipset/ip_set_bitmap_gen.h')
| -rw-r--r-- | kernel/net/netfilter/ipset/ip_set_bitmap_gen.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/net/netfilter/ipset/ip_set_bitmap_gen.h b/kernel/net/netfilter/ipset/ip_set_bitmap_gen.h index 3f2bd26..0479750 100644 --- a/kernel/net/netfilter/ipset/ip_set_bitmap_gen.h +++ b/kernel/net/netfilter/ipset/ip_set_bitmap_gen.h @@ -76,7 +76,7 @@ mtype_flush(struct ip_set *set) if (set->extensions & IPSET_EXT_DESTROY) mtype_ext_cleanup(set); - memset(map->members, 0, map->memsize); + bitmap_zero(map->members, map->elements); set->elements = 0; set->ext_size = 0; } |