Commit c05b7456 authored by Florian Westphal's avatar Florian Westphal Committed by sanglipeng
Browse files

netfilter: nf_tables: fix out of memory error handling 

stable inclusion
from stable-v5.10.193
commit d64cdb9cb6291aca0543f7da84269bda9da325c7
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9399M

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d64cdb9cb6291aca0543f7da84269bda9da325c7



--------------------------------

[ Upstream commit 5e1be4cd ]

Several instances of pipapo_resize() don't propagate allocation failures,
this causes a crash when fault injection is enabled for gfp_kernel slabs.

Fixes: 3c4287f6 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Reviewed-by: default avatarStefano Brivio <sbrivio@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent 5573af99

net/netfilter/nft_set_pipapo.c

+10 −3
Original line number Diff line number Diff line
@@ -901,12 +901,14 @@ static void pipapo_lt_bits_adjust(struct nft_pipapo_field *f) 
static int pipapo_insert(struct nft_pipapo_field *f, const uint8_t *k,

			 int mask_bits)

{

	int rule = f->rules++, group, ret, bit_offset = 0;

	int rule = f->rules, group, ret, bit_offset = 0;



	ret = pipapo_resize(f, f->rules - 1, f->rules);

	ret = pipapo_resize(f, f->rules, f->rules + 1);

	if (ret)

		return ret;



	f->rules++;



	for (group = 0; group < f->groups; group++) {

		int i, v;

		u8 mask;
@@ -1051,7 +1053,9 @@ static int pipapo_expand(struct nft_pipapo_field *f, 
			step++;

			if (step >= len) {

				if (!masks) {

					pipapo_insert(f, base, 0);

					err = pipapo_insert(f, base, 0);

					if (err < 0)

						return err;

					masks = 1;

				}

				goto out;
@@ -1234,6 +1238,9 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, 
		else

			ret = pipapo_expand(f, start, end, f->groups * f->bb);



		if (ret < 0)

			return ret;



		if (f->bsize > bsize_max)

			bsize_max = f->bsize;