mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
netfilter: xt_hashlimit: limit the max size of hashtable
commit 8d0015a7ab
upstream.
The user-specified hashtable size is unbound, this could
easily lead to an OOM or a hung task as we hold the global
mutex while allocating and initializing the new hashtable.
Add a max value to cap both cfg->size and cfg->max, as
suggested by Florian.
Reported-and-tested-by: syzbot+adf6c6c2be1c3a718121@syzkaller.appspotmail.com
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
c33c14e30f
commit
a86265edeb
1 changed files with 10 additions and 0 deletions
|
@ -845,6 +845,8 @@ hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
|
||||||
return hashlimit_mt_common(skb, par, hinfo, &info->cfg, 3);
|
return hashlimit_mt_common(skb, par, hinfo, &info->cfg, 3);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#define HASHLIMIT_MAX_SIZE 1048576
|
||||||
|
|
||||||
static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,
|
static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,
|
||||||
struct xt_hashlimit_htable **hinfo,
|
struct xt_hashlimit_htable **hinfo,
|
||||||
struct hashlimit_cfg3 *cfg,
|
struct hashlimit_cfg3 *cfg,
|
||||||
|
@ -855,6 +857,14 @@ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,
|
||||||
|
|
||||||
if (cfg->gc_interval == 0 || cfg->expire == 0)
|
if (cfg->gc_interval == 0 || cfg->expire == 0)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
if (cfg->size > HASHLIMIT_MAX_SIZE) {
|
||||||
|
cfg->size = HASHLIMIT_MAX_SIZE;
|
||||||
|
pr_info_ratelimited("size too large, truncated to %u\n", cfg->size);
|
||||||
|
}
|
||||||
|
if (cfg->max > HASHLIMIT_MAX_SIZE) {
|
||||||
|
cfg->max = HASHLIMIT_MAX_SIZE;
|
||||||
|
pr_info_ratelimited("max too large, truncated to %u\n", cfg->max);
|
||||||
|
}
|
||||||
if (par->family == NFPROTO_IPV4) {
|
if (par->family == NFPROTO_IPV4) {
|
||||||
if (cfg->srcmask > 32 || cfg->dstmask > 32)
|
if (cfg->srcmask > 32 || cfg->dstmask > 32)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
|
Loading…
Reference in a new issue