Zhiling Zou <[email protected]> wrote:
> compat_do_replace() allocates per-CPU counters from the compat header's
> nentries before it parses the entries blob. A malformed request can claim
> millions of rules while supplying only a single empty chain, causing a
> large vmalloc() before the request is rejected by later validation.
>
> Each rule occupies at least sizeof(struct ebt_entry) bytes in the input
> blob. Reject a rule count that cannot fit in entries_size before the
> compat path allocates counters.
Looks like a nothingburger. User could also supply a larger blob?
Also: CONFIG_COMPAT should no longer be reachable from userns:
ec1806a730a1 ("netfilter: x_tables: disable 32bit compat interface in user
namespaces")
@Pablo: if you prefer to take this, no objections from my side;
it doesn't look wrong.
