This is a note to let you know that I've just added the patch titled netfilter: nf_tables: Fix oversized kvmalloc() calls to the 5.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: netfilter-nf_tables-fix-oversized-kvmalloc-calls.patch and it can be found in the queue-5.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 45928afe94a094bcda9af858b96673d59bc4a0e9 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Date: Mon, 13 Sep 2021 20:38:52 +0200 Subject: netfilter: nf_tables: Fix oversized kvmalloc() calls From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> commit 45928afe94a094bcda9af858b96673d59bc4a0e9 upstream. The commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls") limits the max allocatable memory via kvmalloc() to MAX_INT. Reported-by: syzbot+cd43695a64bcd21b8596@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4336,7 +4336,7 @@ static int nf_tables_newset(struct sk_bu if (ops->privsize != NULL) size = ops->privsize(nla, &desc); alloc_size = sizeof(*set) + size + udlen; - if (alloc_size < size) + if (alloc_size < size || alloc_size > INT_MAX) return -ENOMEM; set = kvzalloc(alloc_size, GFP_KERNEL); if (!set) Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are queue-5.14/netfilter-nf_tables-fix-oversized-kvmalloc-calls.patch queue-5.14/netfilter-nf_tables-unlink-table-before-deleting-it.patch queue-5.14/netfilter-log-work-around-missing-softdep-backend-mo.patch queue-5.14/ipvs-check-that-ip_vs_conn_tab_bits-is-between-8-and.patch queue-5.14/netfilter-ipset-fix-oversized-kvmalloc-calls.patch queue-5.14/netfilter-conntrack-serialize-hash-resizes-and-cleanups.patch