* [PATCH net 2/2] netfilter: nf_tables: avoid potential overflows on 32bit arches
@ 2021-05-06 12:53 Eric Dumazet
2021-05-07 7:59 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Eric Dumazet @ 2021-05-06 12:53 UTC (permalink / raw)
To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal
Cc: netfilter-devel, netdev, Eric Dumazet, Eric Dumazet
From: Eric Dumazet <edumazet@google.com>
User space could ask for very large hash tables, we need to make sure
our size computations wont overflow.
nf_tables_newset() needs to double check the u64 size
will fit into size_t field.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: 0ed6389c483d ("netfilter: nf_tables: rename set implementations")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 7 +++++--
net/netfilter/nft_set_hash.c | 10 +++++-----
2 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0b7fe0a902ff56c162741e6715ad62d928381ea7..c14213bc714b1a54a4287ae898d3a096b21e00ac 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4184,6 +4184,7 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
unsigned char *udata;
struct nft_set *set;
struct nft_ctx ctx;
+ size_t alloc_size;
u64 timeout;
char *name;
int err, i;
@@ -4329,8 +4330,10 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
size = 0;
if (ops->privsize != NULL)
size = ops->privsize(nla, &desc);
-
- set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
+ alloc_size = sizeof(*set) + size + udlen;
+ if (alloc_size < size)
+ return -ENOMEM;
+ set = kvzalloc(alloc_size, GFP_KERNEL);
if (!set)
return -ENOMEM;
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 328f2ce32e4cbd772afe03a10f6d13a7ed6b93d5..7b3d0a78c5696747a2e71b1a58303fa141de6c2b 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -623,7 +623,7 @@ static u64 nft_hash_privsize(const struct nlattr * const nla[],
const struct nft_set_desc *desc)
{
return sizeof(struct nft_hash) +
- nft_hash_buckets(desc->size) * sizeof(struct hlist_head);
+ (u64)nft_hash_buckets(desc->size) * sizeof(struct hlist_head);
}
static int nft_hash_init(const struct nft_set *set,
@@ -663,8 +663,8 @@ static bool nft_hash_estimate(const struct nft_set_desc *desc, u32 features,
return false;
est->size = sizeof(struct nft_hash) +
- nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
- desc->size * sizeof(struct nft_hash_elem);
+ (u64)nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
+ (u64)desc->size * sizeof(struct nft_hash_elem);
est->lookup = NFT_SET_CLASS_O_1;
est->space = NFT_SET_CLASS_O_N;
@@ -681,8 +681,8 @@ static bool nft_hash_fast_estimate(const struct nft_set_desc *desc, u32 features
return false;
est->size = sizeof(struct nft_hash) +
- nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
- desc->size * sizeof(struct nft_hash_elem);
+ (u64)nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
+ (u64)desc->size * sizeof(struct nft_hash_elem);
est->lookup = NFT_SET_CLASS_O_1;
est->space = NFT_SET_CLASS_O_N;
--
2.31.1.527.g47e6f16901-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net 2/2] netfilter: nf_tables: avoid potential overflows on 32bit arches
2021-05-06 12:53 [PATCH net 2/2] netfilter: nf_tables: avoid potential overflows on 32bit arches Eric Dumazet
@ 2021-05-07 7:59 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2021-05-07 7:59 UTC (permalink / raw)
To: Eric Dumazet
Cc: Jozsef Kadlecsik, Florian Westphal, netfilter-devel, netdev,
Eric Dumazet
On Thu, May 06, 2021 at 05:53:50AM -0700, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> User space could ask for very large hash tables, we need to make sure
> our size computations wont overflow.
>
> nf_tables_newset() needs to double check the u64 size
> will fit into size_t field.
Also applied, thannks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-05-07 7:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-06 12:53 [PATCH net 2/2] netfilter: nf_tables: avoid potential overflows on 32bit arches Eric Dumazet
2021-05-07 7:59 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).