Re: [PATCH nf-next,v2 1/2] netfilter: nft_set_pipapo: prevent overflow in lookup table allocation

[Stefano Brivio <sbrivio@redhat.com>]

On Tue, 22 Apr 2025 21:52:43 +0200
Pablo Neira Ayuso <pablo@netfilter.org> wrote:

> When calculating the lookup table size, ensure the following
> multiplication does not overflow:
> 
> - desc->field_len[] maximum value is U8_MAX multiplied by
>   NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.
> - NFT_PIPAPO_BUCKETS(f->bb) is 2^8, worst case.
> - sizeof(unsigned long), from sizeof(*f->lt), lt in
>   struct nft_pipapo_field.
> 
> Then, use check_mul_overflow() to multiply by bucket size and then use
> check_add_overflow() to the alignment for avx2 (if needed). Finally, add
> lt_size_check_overflow() helper and use it to consolidate this.
> 
> While at it, replace leftover allocation using the GFP_KERNEL to
> GFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().
> 
> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Thanks for the follow-up!

Reviewed-by: Stefano Brivio <sbrivio@redhat.com>

-- 
Stefano