Pablo Neira Ayuso <[email protected]> wrote: [ Sorry for late reply ]
> On Sun, Apr 24, 2016 at 01:18:21AM +0200, Florian Westphal wrote: > > Can overflow so we might allocate very small table when bucket count is > > high on a 32bit platform. > > > > Note: resize is only possible from init_netns. > > > > Signed-off-by: Florian Westphal <[email protected]> > > --- > > net/netfilter/nf_conntrack_core.c | 7 +++++++ > > 1 file changed, 7 insertions(+) > > > > diff --git a/net/netfilter/nf_conntrack_core.c > > b/net/netfilter/nf_conntrack_core.c > > index 2bbb962..11daca5 100644 > > --- a/net/netfilter/nf_conntrack_core.c > > +++ b/net/netfilter/nf_conntrack_core.c > > @@ -1563,8 +1563,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int > > nulls) > > unsigned int nr_slots, i; > > size_t sz; > > > > + if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) > > + return NULL; > > *sizep gets initially set to the number of buckets. Yes. > > BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct > > hlist_head)); > > nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct > > hlist_nulls_head)); > > Then, this value is divided by the number of hlist heads that fit into > a page. No, its rounded up to a multiple of PAGE/hlist heads, so for very large values of *sizep nr_slots would be 0. > > + if (nr_slots > (UINT_MAX / sizeof(struct hlist_nulls_head))) > > + return NULL; Alternative would be to change this to: if (nr_slots == 0 || nr_slots > (UINT_MAX / sizeof(struct hlist_nulls_head))) return NULL; Or, add this check: if (nr_slots < roundup(1, PAGE_SIZE / sizeof(struct hlist_nulls_head)) nr_slots = roundup(1, PAGE_SIZE / sizeof(struct hlist_nulls_head))) I wasn't sure if its better to fail or if we should just pretend a sane value was given. Let me know what you think and I'll submit a v2. [ Its not a big deal, but eventually I'd like to make the sysctl writeable so users can just increase that, no need to use this obscure module parameter/sysfs param ... ] Cheers, Florian -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
