From patchwork Wed Nov 30 19:42:22 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marcelo Ricardo Leitner X-Patchwork-Id: 701142 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3tTW8k5LHTz9t0q for ; Thu, 1 Dec 2016 06:44:54 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756237AbcK3ToU (ORCPT ); Wed, 30 Nov 2016 14:44:20 -0500 Received: from mx1.redhat.com ([209.132.183.28]:54176 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754166AbcK3Tmw (ORCPT ); Wed, 30 Nov 2016 14:42:52 -0500 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6379FC05AA54; Wed, 30 Nov 2016 19:42:47 +0000 (UTC) Received: from localhost.localdomain.com (vpn1-4-105.gru2.redhat.com [10.97.4.105]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id uAUJgjST024901; Wed, 30 Nov 2016 14:42:45 -0500 From: Marcelo Ricardo Leitner To: andreyknvl@google.com Cc: fw@strlen.de, nhorman@tuxdriver.com, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] netfilter: avoid warn and OOM on vmalloc call Date: Wed, 30 Nov 2016 17:42:22 -0200 Message-Id: <6fd343e83c26c5108d4b6c189e434a5a6e7ebd01.1480534469.git.marcelo.leitner@gmail.com> In-Reply-To: <20161130192145.GB13169@localhost.localdomain> References: <20161130192145.GB13169@localhost.localdomain> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Wed, 30 Nov 2016 19:42:47 +0000 (UTC) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi Andrey, Please let me know how this works for you. It seems good here, though your poc may still trigger OOM through other means. Thanks, Marcelo ---8<--- Andrey Konovalov reported that this vmalloc call is based on an userspace request and that it's spewing traces, which may flood the logs and cause DoS if abused. Florian Westphal also mentioned that this call should not trigger OOM, as kmalloc one is already not triggering it. This patch brings the vmalloc call in sync to kmalloc and disables the warn trace on allocation failure and also disable OOM invocation. Note, however, that under such stress situation, other places may trigger OOM invocation. Reported-by: Andrey Konovalov Cc: Florian Westphal Signed-off-by: Marcelo Ricardo Leitner --- net/netfilter/x_tables.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c index fc4977456c30e098197b4f987b758072c9cf60d9..dece525bf83a0098dad607fce665cd0bde228362 100644 --- a/net/netfilter/x_tables.c +++ b/net/netfilter/x_tables.c @@ -958,7 +958,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) if (sz <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) info = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); if (!info) { - info = vmalloc(sz); + info = __vmalloc(sz, GFP_KERNEL | __GFP_NOWARN | + __GFP_NORETRY | __GFP_HIGHMEM, + PAGE_KERNEL); if (!info) return NULL; }