Commit 29905be1 authored Feb 27, 2018 by Florian Westphal Committed by Gerrit - the friendly Code Review server Nov 04, 2018

netfilter: x_tables: cap allocations at 512 mbyte



Arbitrary limit, however, this still allows huge rulesets
(> 1 million rules).  This helps with automated testing as it prevents
oom-killer invocation.

Change-Id: Ide29e7bfccc68996a4dc45ac834b4645902601c1
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Git-commit: 19926968ea86a286aa6fbea16ee3f2e7442f10f0
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git


Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: Chinmay Agarwal <chinagar@codeaurora.org>

parent 137abbe9

net/netfilter/x_tables.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -40,6 +40,7 @@ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
		MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");

		#define XT_PCPU_BLOCK_SIZE 4096
		#define XT_MAX_TABLE_SIZE (512 * 1024 * 1024)

		struct compat_delta {
		unsigned int offset; /* offset in kernel */
		@@ -984,7 +985,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
		struct xt_table_info *info = NULL;
		size_t sz = sizeof(*info) + size;

		if (sz < sizeof(*info))
		if (sz < sizeof(*info) \|\| sz >= XT_MAX_TABLE_SIZE)
		return NULL;

		if (sz <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER))