Shakeel Butt
c6c0e52ab3
netfilter: ebtables: account ebt_table_info to kmemcg ...
commit e2c8d550a973bb34fc28bc8d0ec996f84562fb8a upstream.
The [ip,ip6,arp]_tables use x_tables_info internally and the underlying
memory is already accounted to kmemcg. Do the same for ebtables. The
syzbot, by using setsockopt(EBT_SO_SET_ENTRIES), was able to OOM the
whole system from a restricted memcg, a potential DoS.
By accounting the ebt_table_info, the memory used for ebt_table_info can
be contained within the memcg of the allocating process. However the
lifetime of ebt_table_info is independent of the allocating process and
is tied to the network namespace. So, the oom-killer will not be able to
relieve the memory pressure due to ebt_table_info memory. The memory for
ebt_table_info is allocated through vmalloc. Currently vmalloc does not
handle the oom-killed allocating process correctly and one large
allocation can bypass memcg limit enforcement. So, with this patch,
at least the small allocations will be contained. For large allocations,
we need to fix vmalloc.
Reported-by: syzbot+7713f3aa67be76b1552c@syzkaller.appspotmail.com
Signed-off-by: Shakeel Butt <shakeelb@google.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-23 08:10:56 +01:00
6lowpan: iphc: reset mac_header after decompress to fix panic
2018-10-03 17:01:42 -07:00
9p/net: put a lower bound on msize
2019-01-13 10:03:52 +01:00
vlan: also check phy_driver ts_info for vlan's real device
2018-04-13 19:48:34 +02:00
appletalk: use IS_ENABLED() instead of checking for built-in or module
2016-09-10 21:19:10 -07:00
net: atm: Fix potential Spectre v1
2018-05-16 10:08:44 +02:00
ax25: fix a use-after-free in ax25_fillin_cb()
2019-01-09 16:16:39 +01:00
batman-adv: Expand merged fragment buffer for full packet
2018-12-13 09:20:25 +01:00
Bluetooth: SMP: fix crash in unpairing
2018-11-10 07:42:42 -08:00
netfilter: ebtables: account ebt_table_info to kmemcg
2019-01-23 08:10:56 +01:00
net: caif: Add a missing rcu_read_unlock() in caif_flow_cb
2018-09-05 09:20:00 +02:00
can: gw: ensure DLC boundaries after CAN frame modification
2019-01-23 08:10:53 +01:00
libceph: fix CEPH_FEATURE_CEPHX_V2 check in calc_signature()
2019-01-13 10:03:50 +01:00
sock: Make sock->sk_stamp thread-safe
2019-01-09 16:16:41 +01:00
net: dcb: For wild-card lookups, use priority -1, not 0
2018-09-19 22:47:15 +02:00
inet: make sure to grab rcu_read_lock before using ireq->ireq_opt
2018-10-18 09:13:23 +02:00
dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
2018-02-25 11:05:44 +01:00
KEYS: DNS: fix parsing multiple options
2018-07-22 14:27:39 +02:00
net: dsa: Do not suspend/resume closed slave_dev
2018-08-06 16:23:03 +02:00
net: introduce device min_header_len
2017-02-18 15:11:43 +01:00
hsr: fix incorrect warning
2018-04-13 19:48:29 +02:00
ieee802154: lowpan_header_create check must check daddr
2019-01-09 16:16:40 +01:00
ip: on queued skb use skb_header_pointer instead of pskb_may_pull
2019-01-23 08:10:54 +01:00
ip: on queued skb use skb_header_pointer instead of pskb_may_pull
2019-01-23 08:10:54 +01:00
ipx: call ipxitf_put() in ioctl error path
2017-05-25 15:44:41 +02:00
irda: Only insert new objects into the global database via setsockopt
2018-09-15 09:43:01 +02:00
net/iucv: Free memory obtained by kzalloc
2018-03-31 18:11:34 +02:00
kcm: Fix use-after-free caused by clonned sockets
2018-06-13 16:16:42 +02:00
af_key: Always verify length of provided sadb_key
2018-06-16 09:52:32 +02:00
l2tp: remove configurable payload offset
2018-11-10 07:42:54 -08:00
net: ipv6: Remove l3mdev_get_saddr6
2016-09-10 23:12:53 -07:00
llc: do not use sk_eat_skb()
2018-12-01 09:44:19 +01:00
mac80211: Fix condition validating WMM IE
2018-12-21 14:11:32 +01:00
net: mac802154: tx: expand tailroom if necessary
2018-09-09 20:01:19 +02:00
mpls, nospec: Sanitize array index in mpls_label_ok()
2018-03-11 16:21:34 +01:00
net/ncsi: Improve HNCDSC AEN handler
2016-10-20 11:23:08 -04:00
netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
2019-01-13 10:03:48 +01:00
netlabel: check for IPV4MASK in addrinfo_get
2018-10-18 09:13:22 +02:00
netlink: Don't shift on 64 for ngroups
2018-08-09 12:17:59 +02:00
netrom: fix locking in nr_find_socket()
2019-01-09 16:16:40 +01:00
NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
2018-09-29 03:07:30 -07:00
openvswitch: Remove padding from packet before L3+ conntrack processing
2018-05-30 07:50:23 +02:00
packet: Do not leak dev refcounts on error exit
2019-01-23 08:10:54 +01:00
net: qrtr: Broadcast messages only from control port
2018-08-24 13:12:36 +02:00
rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp
2018-11-10 07:42:50 -08:00
rfkill: gpio: fix memory leak in probe error path
2018-05-16 10:08:43 +02:00
rose: limit sk_filter trim to payload
2016-07-13 11:53:40 -07:00
rxrpc: Only take the rwind and mtu values from latest ACK
2018-11-10 07:42:56 -08:00
net: Prevent invalid access to skb->prev in __qdisc_drop_all
2018-12-17 09:38:31 +01:00
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
2019-01-09 16:16:40 +01:00
strparser: Fix incorrect strp->need_bytes value.
2018-04-29 11:32:02 +02:00
sunrpc: handle ENOMEM in rpcb_getport_async
2019-01-23 08:10:55 +01:00
switchdev: Execute bridge ndos only for bridge ports
2016-10-19 10:58:04 -04:00
tipc: compare remote and local protocols in tipc_udp_enable()
2019-01-09 16:16:41 +01:00
net/unix: don't show information about sockets from other namespaces
2017-11-18 11:22:22 +01:00
VSOCK: Send reset control packet when socket is partially bound
2019-01-09 16:16:41 +01:00
nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT
2018-11-10 07:42:42 -08:00
net: x25: fix one potential use-after-free issue
2018-04-13 19:48:00 +02:00
xfrm: Fix bucket count reported to userspace
2019-01-13 10:03:48 +01:00
sock: Make sock->sk_stamp thread-safe
2019-01-09 16:16:41 +01:00
strparser: Stream parser for messages
2016-08-17 19:36:23 -04:00
strparser: Stream parser for messages
2016-08-17 19:36:23 -04:00
net: socket: fix a missing-check bug
2018-11-10 07:42:58 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2016-10-06 09:52:23 -07:00
c6c0e52ab3