diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-09-13 20:38:52 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-09-21 03:46:55 +0200 |
| commit | 45928afe94a094bcda9af858b96673d59bc4a0e9 (patch) | |
| tree | f207a007e9f7ad4fce0aca38b0342a796dc9e119 /net | |
| parent | netfilter: nf_tables: unlink table before deleting it (diff) | |
| download | linux-45928afe94a094bcda9af858b96673d59bc4a0e9.tar.xz linux-45928afe94a094bcda9af858b96673d59bc4a0e9.zip | |
netfilter: nf_tables: Fix oversized kvmalloc() calls
The commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls")
limits the max allocatable memory via kvmalloc() to MAX_INT.
Reported-by: syzbot+cd43695a64bcd21b8596@syzkaller.appspotmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 33e771cd847c..b9546defdc28 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4336,7 +4336,7 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, if (ops->privsize != NULL) size = ops->privsize(nla, &desc); alloc_size = sizeof(*set) + size + udlen; - if (alloc_size < size) + if (alloc_size < size || alloc_size > INT_MAX) return -ENOMEM; set = kvzalloc(alloc_size, GFP_KERNEL); if (!set) |