From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9369524E4AF; Mon, 13 Apr 2026 16:14:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776096854; cv=none; b=Spm1EoLO7B//Vu8SXZn+7Jo77GJH0r9uBbRHaYxAtuRN8SWZo4FoAUaLL661Oegh5jnEmgNTJVX7GVqX99Q7qCl0kZfXiKi3jBZHrC4AMbmcIEGnowgw7gjFWGiGhCCoi/LbNRc29g64ke8pyVd67RKfiinJYfrBOOk5zmSAFf0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776096854; c=relaxed/simple; bh=JzXzjkEado495Cohowa0XtaNZCAb8cwCol92yZCCeEU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ks2qY5KzowHAdognYiqBNoSuhrCHT+Cggf3BrHXDeDlRrZd1NOHjnZxtKx7GMkhhDihfsb0t2ylTzDuy7vgqNlq85RizYd8RaUP4DZqk1jqoDagDjz4i5AuHyjkXj73N3n5kr0t2u+S2awHMI3dXemeH5Svqczxn7PVRJcoTQP0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZWwcKIjT; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ZWwcKIjT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 29AD2C2BCAF; Mon, 13 Apr 2026 16:14:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776096854; bh=JzXzjkEado495Cohowa0XtaNZCAb8cwCol92yZCCeEU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZWwcKIjT9V+5H7NqnhXIqMP24acLZigapXR2r+jiPVbARScUyopMZBXftYtqUEC3+ ahq3t3hXcLMDU1UU+Mk/5DdjahjMM69Qxbty3XF92Sm15yuaYNRyDHK6xNz+x47Myt QWZok+2m4BkBz2vOcjeNrul1sKvLjp5Gn6DAZt7Q= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Stefano Brivio , Florian Westphal , Mukul Sikka , Brennan Lamoreaux , Keerthana K Subject: [PATCH 6.6 18/50] netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Date: Mon, 13 Apr 2026 18:00:45 +0200 Message-ID: <20260413155725.193597037@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260413155724.497323914@linuxfoundation.org> References: <20260413155724.497323914@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal commit 07ace0bbe03b3d8e85869af1dec5e4087b1d57b8 upstream pipapo relies on kmalloc(0) returning ZERO_SIZE_PTR (i.e., not NULL but pointer is invalid). Rework this to not call slab allocator when we'd request a 0-byte allocation. Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal Signed-off-by: Mukul Sikka Signed-off-by: Brennan Lamoreaux [Keerthana: In older stable branches (v6.6 and earlier), the allocation logic in pipapo_clone() still relies on `src->rules` rather than `src->rules_alloc` (introduced in v6.9 via 9f439bd6ef4f). Consequently, the previously backported INT_MAX clamping check uses `src->rules`. This patch correctly moves that `src->rules > (INT_MAX / ...)` check inside the new `if (src->rules > 0)` block] Signed-off-by: Keerthana K Signed-off-by: Greg Kroah-Hartman --- net/netfilter/nft_set_pipapo.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -525,6 +525,8 @@ static struct nft_pipapo_elem *pipapo_ge int i; m = priv->clone; + if (m->bsize_max == 0) + return ret; res_map = kmalloc_array(m->bsize_max, sizeof(*res_map), GFP_ATOMIC); if (!res_map) { @@ -1394,14 +1396,20 @@ static struct nft_pipapo_match *pipapo_c src->bsize * sizeof(*dst->lt) * src->groups * NFT_PIPAPO_BUCKETS(src->bb)); - if (src->rules > (INT_MAX / sizeof(*src->mt))) - goto out_mt; + if (src->rules > 0) { + if (src->rules > (INT_MAX / sizeof(*src->mt))) + goto out_mt; + + dst->mt = kvmalloc_array(src->rules, sizeof(*src->mt), + GFP_KERNEL); + if (!dst->mt) + goto out_mt; - dst->mt = kvmalloc(src->rules * sizeof(*src->mt), GFP_KERNEL_ACCOUNT); - if (!dst->mt) - goto out_mt; + memcpy(dst->mt, src->mt, src->rules * sizeof(*src->mt)); + } else { + dst->mt = NULL; + } - memcpy(dst->mt, src->mt, src->rules * sizeof(*src->mt)); src++; dst++; }