From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97B1A2EB5BA; Mon, 13 Apr 2026 16:17:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776097031; cv=none; b=AA6kwLQ2HVwEQpLD40/g9X9w0J4xD6i2fRSmA23aj2ReaTpmjqGiyLL7xpzv65LOJoRYUfqvoGt0OSYbF6EMiHduFcLVAAhOOW1fgOrhDTyyKP3arWvQcn43LrtLJNfpN7IAD/DKWeTVhAeTW8/bFuiutOyCrYHrGaV2B7o+oBo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776097031; c=relaxed/simple; bh=i7PbZsW1T53AGc/b4dQa/hpS276aoNkl1X1mUmqNU50=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MwSDFAkxMBDPGcJ9v2O31vM1vtxYKXQjhNcfhWq4E0Boo19Im7NfmkVOm+PrWQVk4xYPhIPCgHbjBcuTk55l6cBrw+KChXfVDWG2Ow51rnWXzSSCTl7B43YMBMRs6ObWVRQVw0S6cPy1aFTrzchYg6jQS3C2BGnoFKK4OzhH20g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FJvTAdSj; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="FJvTAdSj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F8E3C2BCB0; Mon, 13 Apr 2026 16:17:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776097031; bh=i7PbZsW1T53AGc/b4dQa/hpS276aoNkl1X1mUmqNU50=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FJvTAdSjO/QcA0flVqKfJRwoz/8zrERHNi14EZ+869xxuhAeB/C88CVTX+6f/pcoT tgQAheaznt5Fc/fYvNlf2H5VHzKJz+Rc2QSJ0iSpOJCt0NP8DaNudVwt80Pw3Nv1I6 U9jDMSXyaLlcLTC6Z0XCDbO+nIM4cezk40wJmiqI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Stefano Brivio , Florian Westphal , Mukul Sikka , Brennan Lamoreaux , Keerthana K Subject: [PATCH 6.1 35/55] netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR Date: Mon, 13 Apr 2026 18:01:09 +0200 Message-ID: <20260413155726.148097573@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260413155724.820472494@linuxfoundation.org> References: <20260413155724.820472494@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal commit 07ace0bbe03b3d8e85869af1dec5e4087b1d57b8 upstream pipapo relies on kmalloc(0) returning ZERO_SIZE_PTR (i.e., not NULL but pointer is invalid). Rework this to not call slab allocator when we'd request a 0-byte allocation. Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal Signed-off-by: Mukul Sikka Signed-off-by: Brennan Lamoreaux [Keerthana: In older stable branches (v6.6 and earlier), the allocation logic in pipapo_clone() still relies on `src->rules` rather than `src->rules_alloc` (introduced in v6.9 via 9f439bd6ef4f). Consequently, the previously backported INT_MAX clamping check uses `src->rules`. This patch correctly moves that `src->rules > (INT_MAX / ...)` check inside the new `if (src->rules > 0)` block] Signed-off-by: Keerthana K Signed-off-by: Greg Kroah-Hartman --- net/netfilter/nft_set_pipapo.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -525,6 +525,8 @@ static struct nft_pipapo_elem *pipapo_ge int i; m = priv->clone; + if (m->bsize_max == 0) + return ret; res_map = kmalloc_array(m->bsize_max, sizeof(*res_map), GFP_ATOMIC); if (!res_map) { @@ -1395,14 +1397,20 @@ static struct nft_pipapo_match *pipapo_c src->bsize * sizeof(*dst->lt) * src->groups * NFT_PIPAPO_BUCKETS(src->bb)); - if (src->rules > (INT_MAX / sizeof(*src->mt))) - goto out_mt; + if (src->rules > 0) { + if (src->rules > (INT_MAX / sizeof(*src->mt))) + goto out_mt; + + dst->mt = kvmalloc_array(src->rules, sizeof(*src->mt), + GFP_KERNEL); + if (!dst->mt) + goto out_mt; - dst->mt = kvmalloc(src->rules * sizeof(*src->mt), GFP_KERNEL_ACCOUNT); - if (!dst->mt) - goto out_mt; + memcpy(dst->mt, src->mt, src->rules * sizeof(*src->mt)); + } else { + dst->mt = NULL; + } - memcpy(dst->mt, src->mt, src->rules * sizeof(*src->mt)); src++; dst++; }