* [PATCH] netfilter: ipset: fixes possible oops in mtype_resize
@ 2020-12-17 8:53 Vasily Averin
2020-12-17 17:12 ` Jozsef Kadlecsik
2020-12-17 18:44 ` Pablo Neira Ayuso
0 siblings, 2 replies; 3+ messages in thread
From: Vasily Averin @ 2020-12-17 8:53 UTC (permalink / raw)
To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal
Cc: David S. Miller, Jakub Kicinski, netfilter-devel, coreteam
currently mtype_resize() can cause oops
t = ip_set_alloc(htable_size(htable_bits));
if (!t) {
ret = -ENOMEM;
goto out;
}
t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));
Increased htable_bits can force htable_size() to return 0.
In own turn ip_set_alloc(0) returns not 0 but ZERO_SIZE_PTR,
so follwoing access to t->hregion should trigger an OOPS.
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
---
net/netfilter/ipset/ip_set_hash_gen.h | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 7d01086..7cd1d31 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -630,7 +630,7 @@ struct mtype_resize_ad {
struct htype *h = set->data;
struct htable *t, *orig;
u8 htable_bits;
- size_t dsize = set->dsize;
+ size_t hsize, dsize = set->dsize;
#ifdef IP_SET_HASH_WITH_NETS
u8 flags;
struct mtype_elem *tmp;
@@ -654,14 +654,12 @@ struct mtype_resize_ad {
retry:
ret = 0;
htable_bits++;
- if (!htable_bits) {
- /* In case we have plenty of memory :-) */
- pr_warn("Cannot increase the hashsize of set %s further\n",
- set->name);
- ret = -IPSET_ERR_HASH_FULL;
- goto out;
- }
- t = ip_set_alloc(htable_size(htable_bits));
+ if (!htable_bits)
+ goto hbwarn;
+ hsize = htable_size(htable_bits);
+ if (!hsize)
+ goto hbwarn;
+ t = ip_set_alloc(hsize);
if (!t) {
ret = -ENOMEM;
goto out;
@@ -803,6 +801,12 @@ struct mtype_resize_ad {
if (ret == -EAGAIN)
goto retry;
goto out;
+
+hbwarn:
+ /* In case we have plenty of memory :-) */
+ pr_warn("Cannot increase the hashsize of set %s further\n", set->name);
+ ret = -IPSET_ERR_HASH_FULL;
+ goto out;
}
/* Get the current number of elements and ext_size in the set */
--
1.8.3.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] netfilter: ipset: fixes possible oops in mtype_resize
2020-12-17 8:53 [PATCH] netfilter: ipset: fixes possible oops in mtype_resize Vasily Averin
@ 2020-12-17 17:12 ` Jozsef Kadlecsik
2020-12-17 18:44 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Jozsef Kadlecsik @ 2020-12-17 17:12 UTC (permalink / raw)
To: Vasily Averin
Cc: Pablo Neira Ayuso, Florian Westphal, David S. Miller,
Jakub Kicinski, netfilter-devel, coreteam
Hi Vasily, Pablo,
On Thu, 17 Dec 2020, Vasily Averin wrote:
> currently mtype_resize() can cause oops
>
> t = ip_set_alloc(htable_size(htable_bits));
> if (!t) {
> ret = -ENOMEM;
> goto out;
> }
> t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));
>
> Increased htable_bits can force htable_size() to return 0.
> In own turn ip_set_alloc(0) returns not 0 but ZERO_SIZE_PTR,
> so follwoing access to t->hregion should trigger an OOPS.
>
> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Good catch, thank you Vasily.
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Best regards,
Jozsef
> ---
> net/netfilter/ipset/ip_set_hash_gen.h | 22 +++++++++++++---------
> 1 file changed, 13 insertions(+), 9 deletions(-)
>
> diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
> index 7d01086..7cd1d31 100644
> --- a/net/netfilter/ipset/ip_set_hash_gen.h
> +++ b/net/netfilter/ipset/ip_set_hash_gen.h
> @@ -630,7 +630,7 @@ struct mtype_resize_ad {
> struct htype *h = set->data;
> struct htable *t, *orig;
> u8 htable_bits;
> - size_t dsize = set->dsize;
> + size_t hsize, dsize = set->dsize;
> #ifdef IP_SET_HASH_WITH_NETS
> u8 flags;
> struct mtype_elem *tmp;
> @@ -654,14 +654,12 @@ struct mtype_resize_ad {
> retry:
> ret = 0;
> htable_bits++;
> - if (!htable_bits) {
> - /* In case we have plenty of memory :-) */
> - pr_warn("Cannot increase the hashsize of set %s further\n",
> - set->name);
> - ret = -IPSET_ERR_HASH_FULL;
> - goto out;
> - }
> - t = ip_set_alloc(htable_size(htable_bits));
> + if (!htable_bits)
> + goto hbwarn;
> + hsize = htable_size(htable_bits);
> + if (!hsize)
> + goto hbwarn;
> + t = ip_set_alloc(hsize);
> if (!t) {
> ret = -ENOMEM;
> goto out;
> @@ -803,6 +801,12 @@ struct mtype_resize_ad {
> if (ret == -EAGAIN)
> goto retry;
> goto out;
> +
> +hbwarn:
> + /* In case we have plenty of memory :-) */
> + pr_warn("Cannot increase the hashsize of set %s further\n", set->name);
> + ret = -IPSET_ERR_HASH_FULL;
> + goto out;
> }
>
> /* Get the current number of elements and ext_size in the set */
> --
> 1.8.3.1
>
>
-
E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] netfilter: ipset: fixes possible oops in mtype_resize
2020-12-17 8:53 [PATCH] netfilter: ipset: fixes possible oops in mtype_resize Vasily Averin
2020-12-17 17:12 ` Jozsef Kadlecsik
@ 2020-12-17 18:44 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2020-12-17 18:44 UTC (permalink / raw)
To: Vasily Averin
Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller,
Jakub Kicinski, netfilter-devel, coreteam
On Thu, Dec 17, 2020 at 11:53:40AM +0300, Vasily Averin wrote:
> currently mtype_resize() can cause oops
>
> t = ip_set_alloc(htable_size(htable_bits));
> if (!t) {
> ret = -ENOMEM;
> goto out;
> }
> t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));
>
> Increased htable_bits can force htable_size() to return 0.
> In own turn ip_set_alloc(0) returns not 0 but ZERO_SIZE_PTR,
> so follwoing access to t->hregion should trigger an OOPS.
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-12-17 18:45 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-12-17 8:53 [PATCH] netfilter: ipset: fixes possible oops in mtype_resize Vasily Averin
2020-12-17 17:12 ` Jozsef Kadlecsik
2020-12-17 18:44 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.