This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: Fix oversized kvmalloc() calls
to the 5.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-fix-oversized-kvmalloc-calls.patch
and it can be found in the queue-5.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 45928afe94a094bcda9af858b96673d59bc4a0e9 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Mon, 13 Sep 2021 20:38:52 +0200
Subject: netfilter: nf_tables: Fix oversized kvmalloc() calls
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit 45928afe94a094bcda9af858b96673d59bc4a0e9 upstream.
The commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls")
limits the max allocatable memory via kvmalloc() to MAX_INT.
Reported-by: syzbot+cd43695a64bcd21b8596@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4336,7 +4336,7 @@ static int nf_tables_newset(struct sk_bu
if (ops->privsize != NULL)
size = ops->privsize(nla, &desc);
alloc_size = sizeof(*set) + size + udlen;
- if (alloc_size < size)
+ if (alloc_size < size || alloc_size > INT_MAX)
return -ENOMEM;
set = kvzalloc(alloc_size, GFP_KERNEL);
if (!set)
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-5.14/netfilter-nf_tables-fix-oversized-kvmalloc-calls.patch
queue-5.14/netfilter-nf_tables-unlink-table-before-deleting-it.patch
queue-5.14/netfilter-log-work-around-missing-softdep-backend-mo.patch
queue-5.14/ipvs-check-that-ip_vs_conn_tab_bits-is-between-8-and.patch
queue-5.14/netfilter-ipset-fix-oversized-kvmalloc-calls.patch
queue-5.14/netfilter-conntrack-serialize-hash-resizes-and-cleanups.patch
