]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: ipset: fixes possible oops in mtype_resize
authorVasily Averin <vvs@virtuozzo.com>
Thu, 17 Dec 2020 08:53:40 +0000 (11:53 +0300)
committerPablo Neira Ayuso <pablo@netfilter.org>
Thu, 17 Dec 2020 18:44:52 +0000 (19:44 +0100)
commit4ed8fb85276cfcf2d30bbe8bce0ea5052970e331
treee4cf6737ee7ab41d04f745fdf78f275321373274
parent26d27132879a487b5e1f68d6b3bbf4f5ee7da13f
netfilter: ipset: fixes possible oops in mtype_resize

currently mtype_resize() can cause oops

        t = ip_set_alloc(htable_size(htable_bits));
        if (!t) {
                ret = -ENOMEM;
                goto out;
        }
        t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));

Increased htable_bits can force htable_size() to return 0.
In own turn ip_set_alloc(0) returns not 0 but ZERO_SIZE_PTR,
so follwoing access to t->hregion should trigger an OOPS.

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/ipset/ip_set_hash_gen.h