Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8dd8af4 authored by Vasily Averin's avatar Vasily Averin Committed by Greg Kroah-Hartman
Browse files

netfilter: ipset: fixes possible oops in mtype_resize 



[ Upstream commit 2b33d6ffa9e38f344418976b06057e2fc2aa9e2a ]

currently mtype_resize() can cause oops

        t = ip_set_alloc(htable_size(htable_bits));
        if (!t) {
                ret = -ENOMEM;
                goto out;
        }
        t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));

Increased htable_bits can force htable_size() to return 0.
In own turn ip_set_alloc(0) returns not 0 but ZERO_SIZE_PTR,
so follwoing access to t->hregion should trigger an OOPS.

Signed-off-by: default avatarVasily Averin <vvs@virtuozzo.com>
Acked-by: default avatarJozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ca2fc0dc

net/netfilter/ipset/ip_set_hash_gen.h

+13 −9
Original line number Diff line number Diff line
@@ -630,7 +630,7 @@ mtype_resize(struct ip_set *set, bool retried) 
	struct htype *h = set->data;

	struct htable *t, *orig;

	u8 htable_bits;

	size_t dsize = set->dsize;

	size_t hsize, dsize = set->dsize;

#ifdef IP_SET_HASH_WITH_NETS

	u8 flags;

	struct mtype_elem *tmp;
@@ -654,14 +654,12 @@ mtype_resize(struct ip_set *set, bool retried) 
retry:

	ret = 0;

	htable_bits++;

	if (!htable_bits) {

		/* In case we have plenty of memory :-) */

		pr_warn("Cannot increase the hashsize of set %s further\n",

			set->name);

		ret = -IPSET_ERR_HASH_FULL;

		goto out;

	}

	t = ip_set_alloc(htable_size(htable_bits));

	if (!htable_bits)

		goto hbwarn;

	hsize = htable_size(htable_bits);

	if (!hsize)

		goto hbwarn;

	t = ip_set_alloc(hsize);

	if (!t) {

		ret = -ENOMEM;

		goto out;
@@ -803,6 +801,12 @@ mtype_resize(struct ip_set *set, bool retried) 
	if (ret == -EAGAIN)

		goto retry;

	goto out;



hbwarn:

	/* In case we have plenty of memory :-) */

	pr_warn("Cannot increase the hashsize of set %s further\n", set->name);

	ret = -IPSET_ERR_HASH_FULL;

	goto out;

}



/* Get the current number of elements and ext_size in the set  */