linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Vasily Averin <vvs@virtuozzo.com>,
	Jozsef Kadlecsik <kadlec@netfilter.org>,
	Pablo Neira Ayuso <pablo@netfilter.org>,
	Sasha Levin <sashal@kernel.org>,
	netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 08/51] netfilter: ipset: fixes possible oops in mtype_resize
Date: Tue, 12 Jan 2021 07:54:50 -0500	[thread overview]
Message-ID: <20210112125534.70280-8-sashal@kernel.org> (raw)
In-Reply-To: <20210112125534.70280-1-sashal@kernel.org>

From: Vasily Averin <vvs@virtuozzo.com>

[ Upstream commit 2b33d6ffa9e38f344418976b06057e2fc2aa9e2a ]

currently mtype_resize() can cause oops

        t = ip_set_alloc(htable_size(htable_bits));
        if (!t) {
                ret = -ENOMEM;
                goto out;
        }
        t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));

Increased htable_bits can force htable_size() to return 0.
In own turn ip_set_alloc(0) returns not 0 but ZERO_SIZE_PTR,
so follwoing access to t->hregion should trigger an OOPS.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 521e970be4028..8d4a9e0fd723f 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -644,7 +644,7 @@ mtype_resize(struct ip_set *set, bool retried)
 	struct htype *h = set->data;
 	struct htable *t, *orig;
 	u8 htable_bits;
-	size_t dsize = set->dsize;
+	size_t hsize, dsize = set->dsize;
 #ifdef IP_SET_HASH_WITH_NETS
 	u8 flags;
 	struct mtype_elem *tmp;
@@ -668,14 +668,12 @@ mtype_resize(struct ip_set *set, bool retried)
 retry:
 	ret = 0;
 	htable_bits++;
-	if (!htable_bits) {
-		/* In case we have plenty of memory :-) */
-		pr_warn("Cannot increase the hashsize of set %s further\n",
-			set->name);
-		ret = -IPSET_ERR_HASH_FULL;
-		goto out;
-	}
-	t = ip_set_alloc(htable_size(htable_bits));
+	if (!htable_bits)
+		goto hbwarn;
+	hsize = htable_size(htable_bits);
+	if (!hsize)
+		goto hbwarn;
+	t = ip_set_alloc(hsize);
 	if (!t) {
 		ret = -ENOMEM;
 		goto out;
@@ -817,6 +815,12 @@ mtype_resize(struct ip_set *set, bool retried)
 	if (ret == -EAGAIN)
 		goto retry;
 	goto out;
+
+hbwarn:
+	/* In case we have plenty of memory :-) */
+	pr_warn("Cannot increase the hashsize of set %s further\n", set->name);
+	ret = -IPSET_ERR_HASH_FULL;
+	goto out;
 }
 
 /* Get the current number of elements and ext_size in the set  */
-- 
2.27.0


  parent reply	other threads:[~2021-01-12 13:19 UTC|newest]

Thread overview: 54+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-12 12:54 [PATCH AUTOSEL 5.10 01/51] ARC: build: remove non-existing bootpImage from KBUILD_IMAGE Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 02/51] ARC: build: add uImage.lzma to the top-level target Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 03/51] ARC: build: add boot_targets to PHONY Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 04/51] ARC: build: move symlink creation to arch/arc/Makefile to avoid race Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 05/51] ARM: omap2: pmic-cpcap: fix maximum voltage to be consistent with defaults on xt875 Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 06/51] ath11k: fix crash caused by NULL rx_channel Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 07/51] rtlwifi: rise completion at the last step of firmware callback Sasha Levin
2021-01-12 12:54 ` Sasha Levin [this message]
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 09/51] ath11k: qmi: try to allocate a big block of DMA memory first Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 10/51] btrfs: fix async discard stall Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 11/51] btrfs: merge critical sections of discard lock in workfn Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 12/51] btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 13/51] regulator: bd718x7: Add enable times Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 14/51] ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 15/51] ARM: dts: ux500/golden: Set display max brightness Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 16/51] qede: fix offload for IPIP tunnel packets Sasha Levin
2021-01-12 12:54 ` [PATCH AUTOSEL 5.10 17/51] stmmac: intel: Add PCI IDs for TGL-H platform Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 18/51] e1000e: Only run S0ix flows if shutdown succeeded Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 19/51] habanalabs: adjust pci controller init to new firmware Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 20/51] habanalabs/gaudi: retry loading TPC f/w on -EINTR Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 21/51] habanalabs: register to pci shutdown callback Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 22/51] staging: spmi: hisi-spmi-controller: Fix some error handling paths Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 23/51] CDC-NCM: remove "connected" log message Sasha Levin
2021-01-12 13:11   ` Greg Kroah-Hartman
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 24/51] spi: altera: fix return value for altera_spi_txrx() Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 25/51] habanalabs: Fix memleak in hl_device_reset Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 26/51] hwmon: (pwm-fan) Ensure that calculation doesn't discard big period values Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 27/51] lib/raid6: Let $(UNROLL) rules work with macOS userland Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 28/51] kconfig: remove 'kvmconfig' and 'xenconfig' shorthands Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 29/51] spi: fix the divide by 0 error when calculating xfer waiting time Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 30/51] dmaengine: stm32-mdma: fix STM32_MDMA_VERY_HIGH_PRIORITY value Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 31/51] net: usb: qmi_wwan: add Quectel EM160R-GL Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 32/51] io_uring: drop file refs after task cancel Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 33/51] bfq: Fix computation of shallow depth Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 34/51] arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 35/51] misdn: dsp: select CONFIG_BITREVERSE Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 36/51] net: ethernet: fs_enet: Add missing MODULE_LICENSE Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 37/51] selftests: fix the return value for UDP GRO test Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 38/51] nvme-pci: mark Samsung PM1725a as IGNORE_DEV_SUBNQN Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 39/51] nvme: avoid possible double fetch in handling CQE Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 40/51] nvmet-rdma: Fix list_del corruption on queue establishment failure Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 41/51] drm/amd/display: fix sysfs amdgpu_current_backlight_pwm NULL pointer issue Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 42/51] drm/amdgpu: fix a GPU hang issue when remove device Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 43/51] drm/amd/pm: fix the failure when change power profile for renoir Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 44/51] drm/amdgpu: fix potential memory leak during navi12 deinitialization Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 45/51] gcc-plugins: fix gcc 11 indigestion with plugins Sasha Levin
2021-01-12 17:31   ` Kees Cook
2021-01-17 16:18     ` Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 46/51] usb: typec: Fix copy paste error for NVIDIA alt-mode description Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 47/51] iommu/vt-d: Fix lockdep splat in sva bind()/unbind() Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 48/51] ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 49/51] drm/msm: Call msm_init_vram before binding the gpu Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 50/51] ARM: picoxcell: fix missing interrupt-parent properties Sasha Levin
2021-01-12 12:55 ` [PATCH AUTOSEL 5.10 51/51] poll: fix performance regression due to out-of-line __put_user() Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210112125534.70280-8-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=coreteam@netfilter.org \
    --cc=kadlec@netfilter.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=stable@vger.kernel.org \
    --cc=vvs@virtuozzo.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).