This is a note to let you know that I've just added the patch titled gtp: avoid zero size hashtable to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: gtp-avoid-zero-size-hashtable.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Wed 01 Jan 2020 10:35:31 PM CET From: Taehee Yoo <ap420073@xxxxxxxxx> Date: Wed, 11 Dec 2019 08:23:48 +0000 Subject: gtp: avoid zero size hashtable From: Taehee Yoo <ap420073@xxxxxxxxx> [ Upstream commit 6a902c0f31993ab02e1b6ea7085002b9c9083b6a ] GTP default hashtable size is 1024 and userspace could set specific hashtable size with IFLA_GTP_PDP_HASHSIZE. If hashtable size is set to 0 from userspace, hashtable will not work and panic will occur. Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Taehee Yoo <ap420073@xxxxxxxxx> Signed-off-by: Jakub Kicinski <jakub.kicinski@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/gtp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -660,10 +660,13 @@ static int gtp_newlink(struct net *src_n if (err < 0) return err; - if (!data[IFLA_GTP_PDP_HASHSIZE]) + if (!data[IFLA_GTP_PDP_HASHSIZE]) { hashsize = 1024; - else + } else { hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]); + if (!hashsize) + hashsize = 1024; + } err = gtp_hashtable_new(gtp, hashsize); if (err < 0) Patches currently in stable-queue which might be from ap420073@xxxxxxxxx are queue-5.4/gtp-avoid-zero-size-hashtable.patch queue-5.4/gtp-fix-wrong-condition-in-gtp_genl_dump_pdp.patch queue-5.4/gtp-fix-an-use-after-free-in-ipv4_pdp_find.patch queue-5.4/gtp-do-not-allow-adding-duplicate-tid-and-ms_addr-pdp-context.patch