On Wed, Apr 23, 2025 at 11:05:02AM +0200, Stefano Brivio wrote:
> On Tue, 22 Apr 2025 21:52:43 +0200
> Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
>
> > When calculating the lookup table size, ensure the following
> > multiplication does not overflow:
> >
> > - desc->field_len[] maximum value is U8_MAX multiplied by
> > NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.
> > - NFT_PIPAPO_BUCKETS(f->bb) is 2^8, worst case.
> > - sizeof(unsigned long), from sizeof(*f->lt), lt in
> > struct nft_pipapo_field.
> >
> > Then, use check_mul_overflow() to multiply by bucket size and then use
> > check_add_overflow() to the alignment for avx2 (if needed). Finally, add
> > lt_size_check_overflow() helper and use it to consolidate this.
> >
> > While at it, replace leftover allocation using the GFP_KERNEL to
> > GFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().
> >
> > Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
> > Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
>
> Thanks for the follow-up!
>
> Reviewed-by: Stefano Brivio <sbrivio@xxxxxxxxxx>
Applied to nf-next, thanks Stefano for reviewing.
