From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C09292E7390; Sat, 30 May 2026 18:21:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780165311; cv=none; b=tTmGSyG6t4lsbfCAKcRV7P0xYSnrgSdxSlObLarhmd+foFoWa8XBczCFFmj+95aEehTP25it9k7KyiutQwJhxW2aK7rJ4lqFMOZmqbFCeF3CZZSJCZVz9fU1L43elPmor6wp6KY/LjweLYh3kqEMQhw1ykRSKs0kCuaTzJKoWoI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780165311; c=relaxed/simple; bh=qMHjPYgXFwVRZaZfNiDC1TYW3zKDlR3ZIkaV/EvuwRU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lVw1JRnIfq4dlxEf+U14Bu9S7G1YcTUY1SfPYCx01UGEQB6hUC3uyn87AZkoiEwQ+mh0MVb2lsfKncdkKW1hbGL2AlbtPO23U3umAZeD1+sbBdaBYPXaemqkEB+zn53+SEY5rKBS6NAYLOQP0DYVfLrxoTFOEXikCTCcxKa/j5M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yC0pYdem; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="yC0pYdem" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 123E81F00893; Sat, 30 May 2026 18:21:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1780165310; bh=IjHlr2b1PEHY8Opfbbw6ZrEjOJzYcLa2VNukCjsIrLs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=yC0pYdemNZ83ZrfwlJAJ5Nm2RWLyhSTJssFtLKS1XmEWLNkQhE+G9dWxojqm9VYim Ed8MGE0TM8/DciNvgUTZnHevoBXnHsj69MjoeYWogr8D7FAll/e+3EEbM91qeI6tHN wO5P9TtBdkikwcTsUHIXmODwUmrH/wdORu8csT4g= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Stefano Brivio , Florian Westphal , Mukul Sikka , Brennan Lamoreaux , Keerthana K , Sasha Levin Subject: [PATCH 5.10 041/589] netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Date: Sat, 30 May 2026 17:58:42 +0200 Message-ID: <20260530160225.669445682@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260530160224.570625122@linuxfoundation.org> References: <20260530160224.570625122@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal commit 07ace0bbe03b3d8e85869af1dec5e4087b1d57b8 upstream pipapo relies on kmalloc(0) returning ZERO_SIZE_PTR (i.e., not NULL but pointer is invalid). Rework this to not call slab allocator when we'd request a 0-byte allocation. Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal Signed-off-by: Mukul Sikka Signed-off-by: Brennan Lamoreaux [Keerthana: In older stable branches (v6.6 and earlier), the allocation logic in pipapo_clone() still relies on `src->rules` rather than `src->rules_alloc` (introduced in v6.9 via 9f439bd6ef4f). Consequently, the previously backported INT_MAX clamping check uses `src->rules`. This patch correctly moves that `src->rules > (INT_MAX / ...)` check inside the new `if (src->rules > 0)` block] Signed-off-by: Keerthana K Signed-off-by: Sasha Levin --- net/netfilter/nft_set_pipapo.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index baabbfe62a27f..39623bb726a5e 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -524,6 +524,9 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, struct nft_pipapo_field *f; int i; + if (m->bsize_max == 0) + return ret; + res_map = kmalloc_array(m->bsize_max, sizeof(*res_map), GFP_ATOMIC); if (!res_map) { ret = ERR_PTR(-ENOMEM); @@ -1363,14 +1366,20 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) src->bsize * sizeof(*dst->lt) * src->groups * NFT_PIPAPO_BUCKETS(src->bb)); - if (src->rules > (INT_MAX / sizeof(*src->mt))) - goto out_mt; + if (src->rules > 0) { + if (src->rules > (INT_MAX / sizeof(*src->mt))) + goto out_mt; + + dst->mt = kvmalloc_array(src->rules, sizeof(*src->mt), + GFP_KERNEL); + if (!dst->mt) + goto out_mt; - dst->mt = kvmalloc(src->rules * sizeof(*src->mt), GFP_KERNEL); - if (!dst->mt) - goto out_mt; + memcpy(dst->mt, src->mt, src->rules * sizeof(*src->mt)); + } else { + dst->mt = NULL; + } - memcpy(dst->mt, src->mt, src->rules * sizeof(*src->mt)); src++; dst++; } -- 2.53.0