From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Eric Dumazet <edumazet@google.com>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Florian Westphal <fw@strlen.de>
Subject: [PATCH 5.10 13/26] netfilter: nftables: avoid potential overflows on 32bit arches
Date: Fri, 10 Sep 2021 14:30:17 +0200 [thread overview]
Message-ID: <20210910122916.682588706@linuxfoundation.org> (raw)
In-Reply-To: <20210910122916.253646001@linuxfoundation.org>
From: Eric Dumazet <edumazet@google.com>
commit 6c8774a94e6ad26f29ef103c8671f55c255c6201 upstream.
User space could ask for very large hash tables, we need to make sure
our size computations wont overflow.
nf_tables_newset() needs to double check the u64 size
will fit into size_t field.
Fixes: 0ed6389c483d ("netfilter: nf_tables: rename set implementations")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_tables_api.c | 7 +++++--
net/netfilter/nft_set_hash.c | 10 +++++-----
2 files changed, 10 insertions(+), 7 deletions(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4115,6 +4115,7 @@ static int nf_tables_newset(struct net *
struct nft_table *table;
struct nft_set *set;
struct nft_ctx ctx;
+ size_t alloc_size;
char *name;
u64 size;
u64 timeout;
@@ -4263,8 +4264,10 @@ static int nf_tables_newset(struct net *
size = 0;
if (ops->privsize != NULL)
size = ops->privsize(nla, &desc);
-
- set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
+ alloc_size = sizeof(*set) + size + udlen;
+ if (alloc_size < size)
+ return -ENOMEM;
+ set = kvzalloc(alloc_size, GFP_KERNEL);
if (!set)
return -ENOMEM;
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -604,7 +604,7 @@ static u64 nft_hash_privsize(const struc
const struct nft_set_desc *desc)
{
return sizeof(struct nft_hash) +
- nft_hash_buckets(desc->size) * sizeof(struct hlist_head);
+ (u64)nft_hash_buckets(desc->size) * sizeof(struct hlist_head);
}
static int nft_hash_init(const struct nft_set *set,
@@ -644,8 +644,8 @@ static bool nft_hash_estimate(const stru
return false;
est->size = sizeof(struct nft_hash) +
- nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
- desc->size * sizeof(struct nft_hash_elem);
+ (u64)nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
+ (u64)desc->size * sizeof(struct nft_hash_elem);
est->lookup = NFT_SET_CLASS_O_1;
est->space = NFT_SET_CLASS_O_N;
@@ -662,8 +662,8 @@ static bool nft_hash_fast_estimate(const
return false;
est->size = sizeof(struct nft_hash) +
- nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
- desc->size * sizeof(struct nft_hash_elem);
+ (u64)nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
+ (u64)desc->size * sizeof(struct nft_hash_elem);
est->lookup = NFT_SET_CLASS_O_1;
est->space = NFT_SET_CLASS_O_N;
next prev parent reply other threads:[~2021-09-10 12:33 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-10 12:30 [PATCH 5.10 00/26] 5.10.64-rc1 review Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 01/26] igmp: Add ip_mc_list lock in ip_check_mc_rcu Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 02/26] USB: serial: mos7720: improve OOM-handling in read_mos_reg() Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 03/26] net: ll_temac: Remove left-over debug message Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 04/26] mm/page_alloc: speed up the iteration of max_order Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 05/26] net: kcov: dont select SKB_EXTENSIONS when there is no NET Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 06/26] serial: 8250: 8250_omap: Fix unused variable warning Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 07/26] net: linux/skbuff.h: combine SKB_EXTENSIONS + KCOV handling Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 08/26] tty: drop termiox user definitions Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 09/26] Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM" Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 10/26] x86/events/amd/iommu: Fix invalid Perf result due to IOMMU PMC power-gating Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 11/26] blk-mq: fix kernel panic during iterating over flush request Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 12/26] blk-mq: fix is_flush_rq Greg Kroah-Hartman
2021-09-10 12:30 ` Greg Kroah-Hartman [this message]
2021-09-10 12:30 ` [PATCH 5.10 14/26] netfilter: nf_tables: initialize set before expression setup Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 15/26] netfilter: nftables: clone set element expression template Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 16/26] blk-mq: clearing flush request reference in tags->rqs[] Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 17/26] ALSA: usb-audio: Add registration quirk for JBL Quantum 800 Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 18/26] usb: host: xhci-rcar: Dont reload firmware after the completion Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 19/26] usb: gadget: tegra-xudc: fix the wrong mult value for HS isoc or intr Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 20/26] usb: mtu3: restore HS function when set SS/SSP Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 21/26] usb: mtu3: use @mult for HS isoc or intr Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 22/26] usb: mtu3: fix the wrong HS mult value Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 23/26] xhci: fix even more unsafe memory usage in xhci tracing Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 24/26] xhci: fix " Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 25/26] x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions Greg Kroah-Hartman
2021-09-10 12:30 ` [PATCH 5.10 26/26] PCI: Call Max Payload Size-related fixup quirks early Greg Kroah-Hartman
2021-09-10 19:02 ` [PATCH 5.10 00/26] 5.10.64-rc1 review Florian Fainelli
2021-09-10 19:52 ` Pavel Machek
2021-09-10 22:51 ` Fox Chen
2021-09-10 23:17 ` Shuah Khan
2021-09-11 6:14 ` Samuel Zou
2021-09-11 15:56 ` Sudip Mukherjee
2021-09-11 19:37 ` Guenter Roeck
2021-09-12 0:49 ` Daniel Díaz
2021-09-12 12:18 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210910122916.682588706@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).