On Tue, 22 Apr 2025 21:52:43 +0200
Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> When calculating the lookup table size, ensure the following
> multiplication does not overflow:
>
> - desc->field_len[] maximum value is U8_MAX multiplied by
> NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.
> - NFT_PIPAPO_BUCKETS(f->bb) is 2^8, worst case.
> - sizeof(unsigned long), from sizeof(*f->lt), lt in
> struct nft_pipapo_field.
>
> Then, use check_mul_overflow() to multiply by bucket size and then use
> check_add_overflow() to the alignment for avx2 (if needed). Finally, add
> lt_size_check_overflow() helper and use it to consolidate this.
>
> While at it, replace leftover allocation using the GFP_KERNEL to
> GFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().
>
> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
> Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Thanks for the follow-up!
Reviewed-by: Stefano Brivio <sbrivio@xxxxxxxxxx>
--
Stefano
