From 42d118b793e7fd82bde260d6635ac2ae607afdac Mon Sep 17 00:00:00 2001 From: Jozsef Kadlecsik Date: Sun, 6 May 2012 22:10:52 +0200 Subject: Fix hash size checking in kernel The hash size must fit both into u32 (jhash) and the max value of size_t. The missing checking could lead to kernel crash, bug reported by Seblu. --- kernel/include/linux/netfilter/ipset/ip_set_ahash.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'kernel/include/linux/netfilter/ipset/ip_set_ahash.h') diff --git a/kernel/include/linux/netfilter/ipset/ip_set_ahash.h b/kernel/include/linux/netfilter/ipset/ip_set_ahash.h index 05a5d72..230a290 100644 --- a/kernel/include/linux/netfilter/ipset/ip_set_ahash.h +++ b/kernel/include/linux/netfilter/ipset/ip_set_ahash.h @@ -99,6 +99,22 @@ struct ip_set_hash { #endif }; +static size_t +htable_size(u8 hbits) +{ + size_t hsize; + + /* We must fit both into u32 in jhash and size_t */ + if (hbits > 31) + return 0; + hsize = jhash_size(hbits); + if ((((size_t)-1) - sizeof(struct htable))/sizeof(struct hbucket) + < hsize) + return 0; + + return hsize * sizeof(struct hbucket) + sizeof(struct htable); +} + /* Compute htable_bits from the user input parameter hashsize */ static u8 htable_bits(u32 hashsize) -- cgit v1.2.3