lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 6 Jan 2019 11:00:24 +0000 From: Kirill Tkhai <ktkhai@...tuozzo.com> To: Shakeel Butt <shakeelb@...gle.com>, Michal Hocko <mhocko@...nel.org>, Andrew Morton <akpm@...ux-foundation.org>, Florian Westphal <fw@...len.de> CC: "linux-mm@...ck.org" <linux-mm@...ck.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "syzbot+7713f3aa67be76b1552c@...kaller.appspotmail.com" <syzbot+7713f3aa67be76b1552c@...kaller.appspotmail.com>, Pablo Neira Ayuso <pablo@...filter.org>, Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>, Roopa Prabhu <roopa@...ulusnetworks.com>, Nikolay Aleksandrov <nikolay@...ulusnetworks.com>, "netfilter-devel@...r.kernel.org" <netfilter-devel@...r.kernel.org>, "coreteam@...filter.org" <coreteam@...filter.org>, "bridge@...ts.linux-foundation.org" <bridge@...ts.linux-foundation.org> Subject: Re: [PATCH v2] netfilter: account ebt_table_info to kmemcg On 03.01.2019 06:14, Shakeel Butt wrote: > The [ip,ip6,arp]_tables use x_tables_info internally and the underlying > memory is already accounted to kmemcg. Do the same for ebtables. The > syzbot, by using setsockopt(EBT_SO_SET_ENTRIES), was able to OOM the > whole system from a restricted memcg, a potential DoS. > > By accounting the ebt_table_info, the memory used for ebt_table_info can > be contained within the memcg of the allocating process. However the > lifetime of ebt_table_info is independent of the allocating process and > is tied to the network namespace. So, the oom-killer will not be able to > relieve the memory pressure due to ebt_table_info memory. The memory for > ebt_table_info is allocated through vmalloc. Currently vmalloc does not > handle the oom-killed allocating process correctly and one large > allocation can bypass memcg limit enforcement. So, with this patch, > at least the small allocations will be contained. For large allocations, > we need to fix vmalloc. > > Reported-by: syzbot+7713f3aa67be76b1552c@...kaller.appspotmail.com > Signed-off-by: Shakeel Butt <shakeelb@...gle.com> > Cc: Florian Westphal <fw@...len.de> > Cc: Michal Hocko <mhocko@...nel.org> > Cc: Kirill Tkhai <ktkhai@...tuozzo.com> > Cc: Pablo Neira Ayuso <pablo@...filter.org> > Cc: Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu> > Cc: Roopa Prabhu <roopa@...ulusnetworks.com> > Cc: Nikolay Aleksandrov <nikolay@...ulusnetworks.com> > Cc: Andrew Morton <akpm@...ux-foundation.org> > Cc: Linux MM <linux-mm@...ck.org> > Cc: netfilter-devel@...r.kernel.org > Cc: coreteam@...filter.org > Cc: bridge@...ts.linux-foundation.org > Cc: LKML <linux-kernel@...r.kernel.org> > --- > Changelog since v1: > - More descriptive commit message. Reviewed-by: Kirill Tkhai <ktkhai@...tuozzo.com> > > net/bridge/netfilter/ebtables.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c > index 491828713e0b..5e55cef0cec3 100644 > --- a/net/bridge/netfilter/ebtables.c > +++ b/net/bridge/netfilter/ebtables.c > @@ -1137,14 +1137,16 @@ static int do_replace(struct net *net, const void __user *user, > tmp.name[sizeof(tmp.name) - 1] = 0; > > countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; > - newinfo = vmalloc(sizeof(*newinfo) + countersize); > + newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT, > + PAGE_KERNEL); > if (!newinfo) > return -ENOMEM; > > if (countersize) > memset(newinfo->counters, 0, countersize); > > - newinfo->entries = vmalloc(tmp.entries_size); > + newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT, > + PAGE_KERNEL); > if (!newinfo->entries) { > ret = -ENOMEM; > goto free_newinfo; >
Powered by blists - more mailing lists