All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jozsef Kadlecsik <kadlec@netfilter.org>,
	syzbot+3493b1873fb3ea827986@syzkaller.appspotmail.com,
	syzbot+2b8443c35458a617c904@syzkaller.appspotmail.com,
	syzbot+ee5cb15f4a0e85e0d54e@syzkaller.appspotmail.com,
	Pablo Neira Ayuso <pablo@netfilter.org>,
	Sasha Levin <sashal@kernel.org>,
	fw@strlen.de, davem@davemloft.net, kuba@kernel.org,
	vvs@virtuozzo.com, netfilter-devel@vger.kernel.org,
	coreteam@netfilter.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.14 09/40] netfilter: ipset: Fix oversized kvmalloc() calls
Date: Tue,  5 Oct 2021 09:49:48 -0400	[thread overview]
Message-ID: <20211005135020.214291-9-sashal@kernel.org> (raw)
In-Reply-To: <20211005135020.214291-1-sashal@kernel.org>

From: Jozsef Kadlecsik <kadlec@netfilter.org>

[ Upstream commit 7bbc3d385bd813077acaf0e6fdb2a86a901f5382 ]

The commit

commit 7661809d493b426e979f39ab512e3adf41fbcc69
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Jul 14 09:45:49 2021 -0700

    mm: don't allow oversized kvmalloc() calls

limits the max allocatable memory via kvmalloc() to MAX_INT. Apply the
same limit in ipset.

Reported-by: syzbot+3493b1873fb3ea827986@syzkaller.appspotmail.com
Reported-by: syzbot+2b8443c35458a617c904@syzkaller.appspotmail.com
Reported-by: syzbot+ee5cb15f4a0e85e0d54e@syzkaller.appspotmail.com
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 6186358eac7c..6e391308431d 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -130,11 +130,11 @@ htable_size(u8 hbits)
 {
 	size_t hsize;
 
-	/* We must fit both into u32 in jhash and size_t */
+	/* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */
 	if (hbits > 31)
 		return 0;
 	hsize = jhash_size(hbits);
-	if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *)
+	if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *)
 	    < hsize)
 		return 0;
 
-- 
2.33.0


  parent reply	other threads:[~2021-10-05 13:50 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-05 13:49 [PATCH AUTOSEL 5.14 01/40] ext4: check and update i_disksize properly Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 02/40] ext4: correct the error path of ext4_write_inline_data_end() Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 03/40] ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic Sasha Levin
2021-10-05 13:49   ` Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 04/40] ext4: enforce buffer head state assertion in ext4_da_map_blocks Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 05/40] ALSA: oxfw: fix transmission method for Loud models based on OXFW971 Sasha Levin
2021-10-05 13:49   ` Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 06/40] dt-bindings: interconnect: sdm660: Add missing a2noc qos clocks Sasha Levin
2021-10-05 19:11   ` Georgi Djakov
2021-10-06 15:12     ` Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 07/40] interconnect: qcom: " Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 08/40] ALSA: usb-audio: Unify mixer resume and reset_resume procedure Sasha Levin
2021-10-05 13:49   ` Sasha Levin
2021-10-05 13:49 ` Sasha Levin [this message]
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 10/40] HID: betop: fix slab-out-of-bounds Write in betop_probe Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 11/40] HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 12/40] netfilter: ip6_tables: zero-initialize fragment offset Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 13/40] HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 14/40] HID: amd_sfh: Fix potential NULL pointer dereference Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 15/40] ASoC: SOF: loader: release_firmware() on load failure to avoid batching Sasha Levin
2021-10-05 13:49   ` Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 16/40] KVM: arm64: nvhe: Fix missing FORCE for hyp-reloc.S build rule Sasha Levin
2021-10-05 13:49   ` Sasha Levin
2021-10-05 13:49   ` Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 17/40] netfilter: nf_tables: Fix oversized kvmalloc() calls Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 18/40] netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 19/40] netfilter: nf_nat_masquerade: defer conntrack walk to work queue Sasha Levin
2021-10-05 13:49 ` [PATCH AUTOSEL 5.14 20/40] netfilter: conntrack: serialize hash resizes and cleanups Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 21/40] mac80211: Drop frames from invalid MAC address in ad-hoc mode Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 22/40] pinctrl: qcom: sc7280: Add PM suspend callbacks Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 23/40] m68k: Handle arrivals of multiple signals correctly Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 24/40] hwmon: (ltc2947) Properly handle errors when looking for the external clock Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 25/40] net: prevent user from passing illegal stab size Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 26/40] mac80211: check return value of rhashtable_init Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 27/40] net: bgmac-platform: handle mac-address deferral Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 28/40] net: mdiobus: Fix memory leak in __mdiobus_register Sasha Levin
2021-10-05 14:02   ` Andrew Lunn
2021-10-06 15:12     ` Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 29/40] nvme: add command id quirk for apple controllers Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 30/40] vboxfs: fix broken legacy mount signature checking Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 31/40] net: sun: SUNVNET_COMMON should depend on INET Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 32/40] drm/amdgpu: fix gart.bo pin_count leak Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 33/40] scsi: ses: Fix unsigned comparison with less than zero Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 34/40] scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" Sasha Levin
2021-10-05 13:50   ` Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 35/40] scsi: qla2xxx: Fix excessive messages during device logout Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 36/40] perf/x86: Reset destroy callback on event init failure Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 37/40] perf/core: fix userpage->time_enabled of inactive events Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 38/40] sched: Always inline is_percpu_thread() Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 39/40] io_uring: kill fasync Sasha Levin
2021-10-05 13:50 ` [PATCH AUTOSEL 5.14 40/40] hwmon: (pmbus/ibm-cffps) max_power_out swap changes Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211005135020.214291-9-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=coreteam@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=fw@strlen.de \
    --cc=kadlec@netfilter.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+2b8443c35458a617c904@syzkaller.appspotmail.com \
    --cc=syzbot+3493b1873fb3ea827986@syzkaller.appspotmail.com \
    --cc=syzbot+ee5cb15f4a0e85e0d54e@syzkaller.appspotmail.com \
    --cc=vvs@virtuozzo.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.