lkml.org 
[lkml]   [2018]   [Apr]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.15 32/72] netfilter: x_tables: make allocation less aggressive
    Date
    4.15-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Michal Hocko <mhocko@kernel.org>

    commit 0537250fdc6c876ed4cbbe874c739aebef493ee2 upstream.

    syzbot has noticed that xt_alloc_table_info can allocate a lot of memory.
    This is an admin only interface but an admin in a namespace is sufficient
    as well. eacd86ca3b03 ("net/netfilter/x_tables.c: use kvmalloc() in
    xt_alloc_table_info()") has changed the opencoded kmalloc->vmalloc
    fallback into kvmalloc. It has dropped __GFP_NORETRY on the way because
    vmalloc has simply never fully supported __GFP_NORETRY semantic. This is
    still the case because e.g. page tables backing the vmalloc area are
    hardcoded GFP_KERNEL.

    Revert back to __GFP_NORETRY as a poors man defence against excessively
    large allocation request here. We will not rule out the OOM killer
    completely but __GFP_NORETRY should at least stop the large request in
    most cases.

    [akpm@linux-foundation.org: coding-style fixes]
    Fixes: eacd86ca3b03 ("net/netfilter/x_tables.c: use kvmalloc() in xt_alloc_tableLink: http://lkml.kernel.org/r/20180130140104.GE21609@dhcp22.suse.cz
    Signed-off-by: Michal Hocko <mhocko@suse.com>
    Acked-by: Florian Westphal <fw@strlen.de>
    Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
    Cc: David S. Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/netfilter/x_tables.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    --- a/net/netfilter/x_tables.c
    +++ b/net/netfilter/x_tables.c
    @@ -1008,7 +1008,12 @@ struct xt_table_info *xt_alloc_table_inf
    if ((size >> PAGE_SHIFT) + 2 > totalram_pages)
    return NULL;

    - info = kvmalloc(sz, GFP_KERNEL);
    + /* __GFP_NORETRY is not fully supported by kvmalloc but it should
    + * work reasonably well if sz is too large and bail out rather
    + * than shoot all processes down before realizing there is nothing
    + * more to reclaim.
    + */
    + info = kvmalloc(sz, GFP_KERNEL | __GFP_NORETRY);
    if (!info)
    return NULL;


    \
     
     \ /
      Last update: 2018-04-06 16:04    [W:4.022 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site