* [PATCH nf] netfilter: nft_set_pipapo: fix out of memory error handling
@ 2023-08-23 7:27 Florian Westphal
2023-08-23 9:06 ` Stefano Brivio
2023-08-23 9:10 ` Pablo Neira Ayuso
0 siblings, 2 replies; 3+ messages in thread
From: Florian Westphal @ 2023-08-23 7:27 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal, Stefano Brivio
Several instances of pipapo_resize() don't propagate allocation failures,
this causes a crash when fault injection is used with
echo Y > /sys/kernel/debug/failslab/ignore-gfp-wait
Cc: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/nft_set_pipapo.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 3757fcc55723..6af9c9ed4b5c 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -902,12 +902,14 @@ static void pipapo_lt_bits_adjust(struct nft_pipapo_field *f)
static int pipapo_insert(struct nft_pipapo_field *f, const uint8_t *k,
int mask_bits)
{
- int rule = f->rules++, group, ret, bit_offset = 0;
+ int rule = f->rules, group, ret, bit_offset = 0;
- ret = pipapo_resize(f, f->rules - 1, f->rules);
+ ret = pipapo_resize(f, f->rules, f->rules + 1);
if (ret)
return ret;
+ f->rules++;
+
for (group = 0; group < f->groups; group++) {
int i, v;
u8 mask;
@@ -1052,7 +1054,9 @@ static int pipapo_expand(struct nft_pipapo_field *f,
step++;
if (step >= len) {
if (!masks) {
- pipapo_insert(f, base, 0);
+ err = pipapo_insert(f, base, 0);
+ if (err < 0)
+ return err;
masks = 1;
}
goto out;
@@ -1235,6 +1239,9 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,
else
ret = pipapo_expand(f, start, end, f->groups * f->bb);
+ if (ret < 0)
+ return ret;
+
if (f->bsize > bsize_max)
bsize_max = f->bsize;
--
2.41.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH nf] netfilter: nft_set_pipapo: fix out of memory error handling
2023-08-23 7:27 [PATCH nf] netfilter: nft_set_pipapo: fix out of memory error handling Florian Westphal
@ 2023-08-23 9:06 ` Stefano Brivio
2023-08-23 9:10 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Stefano Brivio @ 2023-08-23 9:06 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On Wed, 23 Aug 2023 09:27:47 +0200
Florian Westphal <fw@strlen.de> wrote:
> Several instances of pipapo_resize() don't propagate allocation failures,
> this causes a crash when fault injection is used with
>
> echo Y > /sys/kernel/debug/failslab/ignore-gfp-wait
Oops, I didn't think about that. Thanks.
> Cc: Stefano Brivio <sbrivio@redhat.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
--
Stefano
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH nf] netfilter: nft_set_pipapo: fix out of memory error handling
2023-08-23 7:27 [PATCH nf] netfilter: nft_set_pipapo: fix out of memory error handling Florian Westphal
2023-08-23 9:06 ` Stefano Brivio
@ 2023-08-23 9:10 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2023-08-23 9:10 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel, Stefano Brivio
On Wed, Aug 23, 2023 at 09:27:47AM +0200, Florian Westphal wrote:
> Several instances of pipapo_resize() don't propagate allocation failures,
> this causes a crash when fault injection is used with
>
> echo Y > /sys/kernel/debug/failslab/ignore-gfp-wait
>
> Cc: Stefano Brivio <sbrivio@redhat.com>
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> net/netfilter/nft_set_pipapo.c | 13 ++++++++++---
> 1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
> index 3757fcc55723..6af9c9ed4b5c 100644
> --- a/net/netfilter/nft_set_pipapo.c
> +++ b/net/netfilter/nft_set_pipapo.c
> @@ -902,12 +902,14 @@ static void pipapo_lt_bits_adjust(struct nft_pipapo_field *f)
> static int pipapo_insert(struct nft_pipapo_field *f, const uint8_t *k,
> int mask_bits)
> {
> - int rule = f->rules++, group, ret, bit_offset = 0;
> + int rule = f->rules, group, ret, bit_offset = 0;
>
> - ret = pipapo_resize(f, f->rules - 1, f->rules);
> + ret = pipapo_resize(f, f->rules, f->rules + 1);
> if (ret)
> return ret;
>
> + f->rules++;
> +
> for (group = 0; group < f->groups; group++) {
> int i, v;
> u8 mask;
> @@ -1052,7 +1054,9 @@ static int pipapo_expand(struct nft_pipapo_field *f,
> step++;
> if (step >= len) {
> if (!masks) {
> - pipapo_insert(f, base, 0);
> + err = pipapo_insert(f, base, 0);
> + if (err < 0)
> + return err;
> masks = 1;
> }
> goto out;
> @@ -1235,6 +1239,9 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,
> else
> ret = pipapo_expand(f, start, end, f->groups * f->bb);
>
> + if (ret < 0)
> + return ret;
> +
> if (f->bsize > bsize_max)
> bsize_max = f->bsize;
>
> --
> 2.41.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-08-23 9:43 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-08-23 7:27 [PATCH nf] netfilter: nft_set_pipapo: fix out of memory error handling Florian Westphal
2023-08-23 9:06 ` Stefano Brivio
2023-08-23 9:10 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).