ipset: Adjust the maximum timeout jiffies of set timeout extension

Refer to: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=764328

Marek Lukács has reported that the set with huge default timeout, 2419200 as an example, is replaced by 4294967 which is non-sense.

The msecs_to_jiffies() in kernel/time/time.c has a condition that

500 unsigned long msecs_to_jiffies(const unsigned int m) 501 {
502 /*
503 * Negative value, means infinite timeout:
504 */
505 if ((int)m < 0)
506 return MAX_JIFFY_OFFSET;

Therefore, the maximum timeout jiffies should be less than or equal to ((UINT_MAX >> 1)) / MSEC_PER_SEC.

Signed-off-by Neutron Soutmun <[email protected]>

---
 include/linux/netfilter/ipset/ip_set_timeout.h | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

include/linux/netfilter/ipset/ip_set_timeout.h +5 -2

index 83c2f9e..b1798df 100644
@@ -23,6 +23,9 @@
 /* Set is defined with timeout support: timeout value may be 0 */
 #define IPSET_NO_TIMEOUT	UINT_MAX
 
+/* Set maximum jiffies offset, msecs_to_jiffies() condition */
+#define IPSET_MAX_JIFFY_OFFSET  ((UINT_MAX >> 1))
+
 #define ip_set_adt_opt_timeout(opt, set)	\
 ((opt)->ext.timeout != IPSET_NO_TIMEOUT ? (opt)->ext.timeout : (set)->timeout)
 

@@ -32,8 +35,8 @@ ip_set_timeout_uget(struct nlattr *tb)
 	unsigned int timeout = ip_set_get_h32(tb);
 
 	/* Normalize to fit into jiffies */
-	if (timeout > UINT_MAX/MSEC_PER_SEC)
-		timeout = UINT_MAX/MSEC_PER_SEC;
+	if (msecs_to_jiffies(timeout * MSEC_PER_SEC) == MAX_JIFFY_OFFSET)
+		timeout = IPSET_MAX_JIFFY_OFFSET / MSEC_PER_SEC;
 
 	/* Userspace supplied TIMEOUT parameter: adjust crazy size */
 	return timeout == IPSET_NO_TIMEOUT ? IPSET_NO_TIMEOUT - 1 : timeout;

Signature · 1 line

2.1.1