netfilter: x_tables: fix int overflow in xt_alloc_table_info()
authorDmitry Vyukov <dvyukov@google.com>
Thu, 28 Dec 2017 08:48:54 +0000 (09:48 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 25 Feb 2018 10:07:50 +0000 (11:07 +0100)
commit6609d112229fff5dbccf57bbc31facffc1ba06dd
treec49991057b87c0d844e34d31b50236711013fa85
parent4249e8af8108afadc6316d9e4815f3333c9770d0
netfilter: x_tables: fix int overflow in xt_alloc_table_info()

commit 889c604fd0b5f6d3b8694ade229ee44124de1127 upstream.

syzkaller triggered OOM kills by passing ipt_replace.size = -1
to IPT_SO_SET_REPLACE. The root cause is that SMP_ALIGN() in
xt_alloc_table_info() causes int overflow and the size check passes
when it should not. SMP_ALIGN() is no longer needed leftover.

Remove SMP_ALIGN() call in xt_alloc_table_info().

Reported-by: syzbot+4396883fa8c4f64e0175@syzkaller.appspotmail.com
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/netfilter/x_tables.c