redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

netfilter: ipset: fixes possible oops in mtype_resize 

currently mtype_resize() can cause oops

        t = ip_set_alloc(htable_size(htable_bits));
        if (!t) {
                ret = -ENOMEM;
                goto out;
        }
        t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));

Increased htable_bits can force htable_size() to return 0.
In own turn ip_set_alloc(0) returns not 0 but ZERO_SIZE_PTR,
so follwoing access to t->hregion should trigger an OOPS.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
zero-sugar-mainline-defconfig
Vasily Averin 2020-12-17 11:53:40 +03:00 committed by Pablo Neira Ayuso
parent 443d6e86f8
commit 2b33d6ffa9
1 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
net/netfilter/ipset/ip_set_hash_gen.h
View File

@ -640,7 +640,7 @@ mtype_resize(struct ip_set *set, bool retried)
struct htype *h = set->data;
struct htable *t, *orig;
u8 htable_bits;
size_t dsize = set->dsize;
size_t hsize, dsize = set->dsize;
#ifdef IP_SET_HASH_WITH_NETS
u8 flags;
struct mtype_elem *tmp;
@ -664,14 +664,12 @@ mtype_resize(struct ip_set *set, bool retried)
retry:
ret = 0;
htable_bits++;
if (!htable_bits) {
/* In case we have plenty of memory :-) */
pr_warn("Cannot increase the hashsize of set %s further\n",
set->name);
ret = -IPSET_ERR_HASH_FULL;
goto out;
}
t = ip_set_alloc(htable_size(htable_bits));
if (!htable_bits)
goto hbwarn;
hsize = htable_size(htable_bits);
if (!hsize)
goto hbwarn;
t = ip_set_alloc(hsize);
if (!t) {
ret = -ENOMEM;
goto out;
@ -813,6 +811,12 @@ cleanup:
if (ret == -EAGAIN)
goto retry;
goto out;
hbwarn:
/* In case we have plenty of memory :-) */
pr_warn("Cannot increase the hashsize of set %s further\n", set->name);
ret = -IPSET_ERR_HASH_FULL;
goto out;
}
/* Get the current number of elements and ext_size in the set */