leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
master
linux/net/netfilter/ipset
History
Jozsef Kadlecsik 510841da1f netfilter: ipset: enforce documented limit to prevent allocating huge memory 
Daniel Xu reported that the hash:net,iface type of the ipset subsystem does
not limit adding the same network with different interfaces to a set, which
can lead to huge memory usage or allocation failure.

The quick reproducer is

$ ipset create ACL.IN.ALL_PERMIT hash:net,iface hashsize 1048576 timeout 0
$ for i in $(seq 0 100); do /sbin/ipset add ACL.IN.ALL_PERMIT 0.0.0.0/0,kaf_$i timeout 0 -exist; done

The backtrace when vmalloc fails:

        [Tue Oct 25 00:13:08 2022] ipset: vmalloc error: size 1073741848, exceeds total pages
        <...>
        [Tue Oct 25 00:13:08 2022] Call Trace:
        [Tue Oct 25 00:13:08 2022]  <TASK>
        [Tue Oct 25 00:13:08 2022]  dump_stack_lvl+0x48/0x60
        [Tue Oct 25 00:13:08 2022]  warn_alloc+0x155/0x180
        [Tue Oct 25 00:13:08 2022]  __vmalloc_node_range+0x72a/0x760
        [Tue Oct 25 00:13:08 2022]  ? hash_netiface4_add+0x7c0/0xb20
        [Tue Oct 25 00:13:08 2022]  ? __kmalloc_large_node+0x4a/0x90
        [Tue Oct 25 00:13:08 2022]  kvmalloc_node+0xa6/0xd0
        [Tue Oct 25 00:13:08 2022]  ? hash_netiface4_resize+0x99/0x710
        <...>

The fix is to enforce the limit documented in the ipset(8) manpage:

>  The internal restriction of the hash:net,iface set type is that the same
>  network prefix cannot be stored with more than 64 different interfaces
>  in a single set.

Fixes: ccf0a4b7fc ("netfilter: ipset: Add bucketsize parameter to all hash types")
Reported-by: Daniel Xu <dxu@dxuuu.xyz>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2022-11-02 19:22:23 +01:00
..
ip_set_bitmap_gen.h netfilter: ipset: use bitmap infrastructure completely 2020-01-20 17:41:45 +01:00
ip_set_bitmap_ip.c netfilter: ipset: call ip_set_free() instead of kfree() 2020-06-30 19:09:56 +02:00
ip_set_bitmap_ipmac.c netfilter: ipset: call ip_set_free() instead of kfree() 2020-06-30 19:09:56 +02:00
ip_set_bitmap_port.c netfilter: ipset: call ip_set_free() instead of kfree() 2020-06-30 19:09:56 +02:00
ip_set_core.c netfilter: move from strlcpy with unused retval to strscpy 2022-09-07 16:46:03 +02:00
ip_set_getport.c netfilter: ipset: move ip_set_get_ip_port() to ip_set_bitmap_port.c. 2019-10-07 23:59:02 +02:00
ip_set_hash_gen.h netfilter: ipset: enforce documented limit to prevent allocating huge memory 2022-11-02 19:22:23 +01:00
ip_set_hash_ip.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_hash_ipmac.c netfilter: ipset: Expose the initval hash parameter to userspace 2020-10-31 11:55:38 +01:00
ip_set_hash_ipmark.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_hash_ipport.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_hash_ipportip.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_hash_ipportnet.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_hash_mac.c netfilter: ipset: Expose the initval hash parameter to userspace 2020-10-31 11:55:38 +01:00
ip_set_hash_net.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_hash_netiface.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_hash_netnet.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_hash_netport.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_hash_netportnet.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete 2021-08-04 10:41:03 +02:00
ip_set_list_set.c netfilter: ipset: Fix subcounter update skip 2020-05-25 20:39:14 +02:00
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pfxlen.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00