]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
netfilter: x_tables: fix int overflow in xt_alloc_table_info()
authorDmitry Vyukov <dvyukov@google.com>
Thu, 28 Dec 2017 08:48:54 +0000 (09:48 +0100)
committerSeth Forshee <seth.forshee@canonical.com>
Wed, 28 Feb 2018 14:46:37 +0000 (08:46 -0600)
commit81ba4903f4ac5637258c67d76a36874a558153c8
treeaa810db53439f2edad9995b5b487f11b8e2f310b
parent9bdc046c05eeabed1d52214a02f09d3b8a1a8f7f
netfilter: x_tables: fix int overflow in xt_alloc_table_info()

BugLink: http://bugs.launchpad.net/bugs/1752119
commit 889c604fd0b5f6d3b8694ade229ee44124de1127 upstream.

syzkaller triggered OOM kills by passing ipt_replace.size = -1
to IPT_SO_SET_REPLACE. The root cause is that SMP_ALIGN() in
xt_alloc_table_info() causes int overflow and the size check passes
when it should not. SMP_ALIGN() is no longer needed leftover.

Remove SMP_ALIGN() call in xt_alloc_table_info().

Reported-by: syzbot+4396883fa8c4f64e0175@syzkaller.appspotmail.com
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
net/netfilter/x_tables.c