Received: by 2002:a05:6a10:d5a5:0:0:0:0 with SMTP id gn37csp3923241pxb; Mon, 4 Oct 2021 12:44:46 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzBQuizBFIgkM/DA+9UJYR2wezXsxTbVH+p/ja6buc0KQn68VvKVNw0g78kNPxTjzuOg7ze X-Received: by 2002:a05:6402:203:: with SMTP id t3mr20866847edv.69.1633376685781; Mon, 04 Oct 2021 12:44:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1633376685; cv=none; d=google.com; s=arc-20160816; b=BT+WpAJ6rb+o7dEMkpedacuuX/BZRFNEb7J1yeKl+9Gt+5keIwHQkfkmM/h34rH7KI Vbr5uexbck+bmcDy6dhAvjP64RenBAupgrKSnDM7inWYBA9QDo9CAQUlu5eOhU849yw8 GrFdPfIvxTNm2HQmWWCeycMCPIzkUVRbYRUtHwnU75XugMqluY9js8qIVMwNoaOXpHVa /712pb6oA6pv+snb67GBPpk2CvAmbRImWlgLJr961rAQF8dRaBtx0FTvyrAKr2InY35u h1cwP9dGsOz5iThJLsXuiEmP3uP9/4VHrhWmQiMBIt1qKj37wuuC1l6Sj/UUgoHkqMOd x4Rw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Z1tW5g3W+Ka9yecjsaOU3Q9NROauCnyqT4+35FzXPDg=; b=nLDga7QUpyPPfImOdCPgdwT/SrMVoTyEyRSWTpw7QanVF+JyVcJ6Q1LH6C4/fU8jWW fzvNh8NeP6H4h3uWot3HGATeISXRjn2J+gV8Vihcq/HueuPRPEe1q0IqqNrxlYbjmnh0 0BFuvoVs34EUU+o6S0P0z/pr8iTkLwQbzOgsQ+45B4hXSCV9DlP6ADjcjYT0fw8em3D3 ju9okkgTb2SXRfYRydVhNaDKuAzKgzZcxgbRXTM+hhMg3ozJrG9zruzWl4fVD4GZBJip R6xgmQ2tB2Q4LTX4/bgHvJb46Lypg6EWDBUzfv9GQT7lts9AWnglD0Tk86xKyXfsqirQ /G7A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="wH3/izxR"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id nc35si12590770ejc.601.2021.10.04.12.44.17; Mon, 04 Oct 2021 12:44:45 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="wH3/izxR"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234075AbhJDNQA (ORCPT + 99 others); Mon, 4 Oct 2021 09:16:00 -0400 Received: from mail.kernel.org ([198.145.29.99]:53268 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235590AbhJDNN5 (ORCPT ); Mon, 4 Oct 2021 09:13:57 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id EFFF261BA1; Mon, 4 Oct 2021 13:05:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1633352734; bh=vqWyOeURbVSKl5y9uVz/VN+k2c77rNz1w9AaZ81FS7o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wH3/izxR5kOcmnKpUwdhhB86EUDL1/EAENCNctUI+VJdMAaSz+nKyGybYAr6oL3d7 m14h0d0ipdykWI1V9yvfxWw0x+Qmalulq4qvE/BEswtXI1sP8EfLxA1/M/ZKAncKUd Nwvoe+tNV29RH0CVqa/yNREc23xMMw/9Bdtl4M3w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+3493b1873fb3ea827986@syzkaller.appspotmail.com, syzbot+2b8443c35458a617c904@syzkaller.appspotmail.com, syzbot+ee5cb15f4a0e85e0d54e@syzkaller.appspotmail.com, Jozsef Kadlecsik , Pablo Neira Ayuso Subject: [PATCH 4.19 93/95] netfilter: ipset: Fix oversized kvmalloc() calls Date: Mon, 4 Oct 2021 14:53:03 +0200 Message-Id: <20211004125036.606912734@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20211004125033.572932188@linuxfoundation.org> References: <20211004125033.572932188@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jozsef Kadlecsik commit 7bbc3d385bd813077acaf0e6fdb2a86a901f5382 upstream. The commit commit 7661809d493b426e979f39ab512e3adf41fbcc69 Author: Linus Torvalds Date: Wed Jul 14 09:45:49 2021 -0700 mm: don't allow oversized kvmalloc() calls limits the max allocatable memory via kvmalloc() to MAX_INT. Apply the same limit in ipset. Reported-by: syzbot+3493b1873fb3ea827986@syzkaller.appspotmail.com Reported-by: syzbot+2b8443c35458a617c904@syzkaller.appspotmail.com Reported-by: syzbot+ee5cb15f4a0e85e0d54e@syzkaller.appspotmail.com Signed-off-by: Jozsef Kadlecsik Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- net/netfilter/ipset/ip_set_hash_gen.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -104,11 +104,11 @@ htable_size(u8 hbits) { size_t hsize; - /* We must fit both into u32 in jhash and size_t */ + /* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */ if (hbits > 31) return 0; hsize = jhash_size(hbits); - if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *) + if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *) < hsize) return 0;