]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
netfilter: x_tables: fix int overflow in xt_alloc_table_info()
authorDmitry Vyukov <dvyukov@google.com>
Thu, 28 Dec 2017 08:48:54 +0000 (09:48 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 25 Feb 2018 10:05:42 +0000 (11:05 +0100)
commit1099c708d7b7bcb701ac9f892d8f26811842abdd
tree854b87876ef6c11435c72aadd5cd704b51f6139a
parentc33f9272eefe349fed598999943e626fcef8a708
netfilter: x_tables: fix int overflow in xt_alloc_table_info()

commit 889c604fd0b5f6d3b8694ade229ee44124de1127 upstream.

syzkaller triggered OOM kills by passing ipt_replace.size = -1
to IPT_SO_SET_REPLACE. The root cause is that SMP_ALIGN() in
xt_alloc_table_info() causes int overflow and the size check passes
when it should not. SMP_ALIGN() is no longer needed leftover.

Remove SMP_ALIGN() call in xt_alloc_table_info().

Reported-by: syzbot+4396883fa8c4f64e0175@syzkaller.appspotmail.com
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/netfilter/x_tables.c