On Sun, Apr 24, 2016 at 01:18:21AM +0200, Florian Westphal wrote: > Can overflow so we might allocate very small table when bucket count is > high on a 32bit platform. > > Note: resize is only possible from init_netns. > > Signed-off-by: Florian Westphal <fw@xxxxxxxxx> > --- > net/netfilter/nf_conntrack_core.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c > index 2bbb962..11daca5 100644 > --- a/net/netfilter/nf_conntrack_core.c > +++ b/net/netfilter/nf_conntrack_core.c > @@ -1563,8 +1563,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) > unsigned int nr_slots, i; > size_t sz; > > + if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) > + return NULL; *sizep gets initially set to the number of buckets. > BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head)); > nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head)); Then, this value is divided by the number of hlist heads that fit into a page. > + > + if (nr_slots > (UINT_MAX / sizeof(struct hlist_nulls_head))) > + return NULL; So, isn't is enough with this sole check? I might be missing anything. > + > sz = nr_slots * sizeof(struct hlist_nulls_head); > hash = (void *)__get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO, > get_order(sz)); > -- > 2.7.3 > > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
