On Fri, Jan 31, 2020 at 2:08 PM Florian Westphal [off-list ref] wrote:

Cong Wang [off-list ref] wrote:

quoted

The hashtable size could be controlled by user, so use flags
GFP_USER | __GFP_NOWARN to avoid OOM warning triggered by user-space.

Also add __GFP_NORETRY to avoid retrying, as this is just a
best effort and the failure is already handled gracefully.

Reported-and-tested-by: syzbot+adf6c6c2be1c3a718121@syzkaller.appspotmail.com
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Jozsef Kadlecsik <redacted>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Cong Wang <redacted>
---
 net/netfilter/xt_hashlimit.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index bccd47cd7190..885a266d8e57 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c

@@ -293,8 +293,9 @@ static int htable_create(struct net *net, struct hashlimit_cfg3 *cfg,
              if (size < 16)
                      size = 16;
      }
-     /* FIXME: don't use vmalloc() here or anywhere else -HW */
-     hinfo = vmalloc(struct_size(hinfo, hash, size));
+     /* FIXME: don't use __vmalloc() here or anywhere else -HW */
+     hinfo = __vmalloc(struct_size(hinfo, hash, size),
+                       GFP_USER | __GFP_NOWARN | __GFP_NORETRY, PAGE_KERNEL);

Rationale looks sane, wonder if it makes sense to drop Haralds comment
though, I don't see what other solution other than vmalloc could be used
here.

I will remove it.

Thanks.