Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1533532

[PATCH] netfilter: avoid warn and OOM on vmalloc call

From Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Newsgroups linux.kernel
Subject [PATCH] netfilter: avoid warn and OOM on vmalloc call
Date 2016-11-30 20:50 +0100
Message-ID <sJj3c-1QN-9@gated-at.bofh.it> (permalink)
References <sJiJR-1JG-95@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

Hi Andrey,

Please let me know how this works for you. It seems good here, though
your poc may still trigger OOM through other means.

Thanks,
Marcelo

---8<---

Andrey Konovalov reported that this vmalloc call is based on an
userspace request and that it's spewing traces, which may flood the logs
and cause DoS if abused.

Florian Westphal also mentioned that this call should not trigger OOM,
as kmalloc one is already not triggering it.

This patch brings the vmalloc call in sync to kmalloc and disables the
warn trace on allocation failure and also disable OOM invocation.

Note, however, that under such stress situation, other places may
trigger OOM invocation.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
---
 net/netfilter/x_tables.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index fc4977456c30e098197b4f987b758072c9cf60d9..dece525bf83a0098dad607fce665cd0bde228362 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -958,7 +958,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
 	if (sz <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER))
 		info = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
 	if (!info) {
-		info = vmalloc(sz);
+		info = __vmalloc(sz, GFP_KERNEL | __GFP_NOWARN |
+				     __GFP_NORETRY | __GFP_HIGHMEM,
+				 PAGE_KERNEL);
 		if (!info)
 			return NULL;
 	}
-- 
2.9.3

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

net/sctp: vmalloc allocation failure in sctp_setsockopt/xt_alloc_table_info Andrey Konovalov <andreyknvl@google.com> - 2016-11-28 14:10 +0100
  Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Neil Horman <nhorman@tuxdriver.com> - 2016-11-28 15:20 +0100
    Re: net/sctp: vmalloc allocation failure in sctp_setsockopt/xt_alloc_table_info Andrey Konovalov <andreyknvl@google.com> - 2016-11-28 15:40 +0100
      Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Neil Horman <nhorman@tuxdriver.com> - 2016-11-28 15:50 +0100
        Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2016-11-28 16:20 +0100
          Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Neil Horman <nhorman@tuxdriver.com> - 2016-11-28 18:50 +0100
            Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Florian Westphal <fw@strlen.de> - 2016-11-28 19:00 +0100
              Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Neil Horman <nhorman@tuxdriver.com> - 2016-11-28 19:00 +0100
                Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2016-11-28 19:20 +0100
                Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2016-11-30 20:30 +0100
                [PATCH] netfilter: avoid warn and OOM on vmalloc call Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2016-11-30 20:50 +0100
                Re: [PATCH] netfilter: avoid warn and OOM on vmalloc call Andrey Konovalov <andreyknvl@google.com> - 2016-12-01 10:50 +0100
                Re: [PATCH] netfilter: avoid warn and OOM on vmalloc call Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2016-12-01 20:10 +0100
                Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Florian Westphal <fw@strlen.de> - 2016-11-28 19:20 +0100
                Re: net/sctp: vmalloc allocation failure in  sctp_setsockopt/xt_alloc_table_info Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-28 19:40 +0100

csiph-web