netfilter: x_tables: avoid warn and OOM killer on vmalloc call
authorMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Fri, 2 Dec 2016 09:46:38 +0000 (07:46 -0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 7 Dec 2016 12:31:41 +0000 (13:31 +0100)
commit5bad87348c70bb4d36e876523aade31e9dedd2fc
tree85979f9b3631a7cde6add79a502ba4e36a344071
parent8411b6442e59810fe0750a2f321b9dcb7d0a3d17
netfilter: x_tables: avoid warn and OOM killer on vmalloc call

Andrey Konovalov reported that this vmalloc call is based on an
userspace request and that it's spewing traces, which may flood the logs
and cause DoS if abused.

Florian Westphal also mentioned that this call should not trigger OOM
killer.

This patch brings the vmalloc call in sync to kmalloc and disables the
warn trace on allocation failure and also disable OOM killer invocation.

Note, however, that under such stress situation, other places may
trigger OOM killer invocation.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/x_tables.c