diff options
| author | Vasily Averin <[email protected]> | 2020-12-17 11:53:40 +0300 | 
|---|---|---|
| committer | Pablo Neira Ayuso <[email protected]> | 2020-12-17 19:44:52 +0100 | 
| commit | 2b33d6ffa9e38f344418976b06057e2fc2aa9e2a (patch) | |
| tree | e4cf6737ee7ab41d04f745fdf78f275321373274 /scripts/gcc-plugins/sancov_plugin.c | |
| parent | 443d6e86f821a165fae3fc3fc13086d27ac140b1 (diff) | |
netfilter: ipset: fixes possible oops in mtype_resize
currently mtype_resize() can cause oops
        t = ip_set_alloc(htable_size(htable_bits));
        if (!t) {
                ret = -ENOMEM;
                goto out;
        }
        t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));
Increased htable_bits can force htable_size() to return 0.
In own turn ip_set_alloc(0) returns not 0 but ZERO_SIZE_PTR,
so follwoing access to t->hregion should trigger an OOPS.
Signed-off-by: Vasily Averin <[email protected]>
Acked-by: Jozsef Kadlecsik <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>
Diffstat (limited to 'scripts/gcc-plugins/sancov_plugin.c')
0 files changed, 0 insertions, 0 deletions