On Thu, Dec 28, 2017 at 9:48 AM, Dmitry Vyukov <[email protected]> wrote: > syzkaller triggered OOM kills by passing ipt_replace.size = -1 > to IPT_SO_SET_REPLACE. The root cause is that SMP_ALIGN() in > xt_alloc_table_info() causes int overflow and the size check passes > when it should not. SMP_ALIGN() is no longer needed leftover. > > Remove SMP_ALIGN() call in xt_alloc_table_info(). > > Reported-by: [email protected] > Signed-off-by: Dmitry Vyukov <[email protected]> > Cc: Pablo Neira Ayuso <[email protected]> > Cc: Jozsef Kadlecsik <[email protected]> > Cc: Florian Westphal <[email protected]> > Cc: "David S. Miller" <[email protected]> > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > Cc: [email protected] > --- > net/netfilter/x_tables.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c > index 55802e97f906..e02a21549c99 100644 > --- a/net/netfilter/x_tables.c > +++ b/net/netfilter/x_tables.c > @@ -39,7 +39,6 @@ MODULE_LICENSE("GPL"); > MODULE_AUTHOR("Harald Welte <[email protected]>"); > MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); > > -#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) > #define XT_PCPU_BLOCK_SIZE 4096 > > struct compat_delta { > @@ -1000,7 +999,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int > size) > return NULL; > > /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ > - if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages) > + if ((size >> PAGE_SHIFT) + 2 > totalram_pages) > return NULL; > > info = kvmalloc(sz, GFP_KERNEL);
Ping. Dave, will this go into net/net-next?
