netfilter: x_tables: avoid warn and OOM killer on vmalloc call

Andrey Konovalov reported that this vmalloc call is based on an
userspace request and that it's spewing traces, which may flood the logs
and cause DoS if abused.

Florian Westphal also mentioned that this call should not trigger OOM
killer.

This patch brings the vmalloc call in sync to kmalloc and disables the
warn trace on allocation failure and also disable OOM killer invocation.

Note, however, that under such stress situation, other places may
trigger OOM killer invocation.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index f6ce4a7036e69fbfd4f62006608c2ae3b92c9f7a..2ff499680cc60b6ea7e22a8d02e2b82e32005a23 100644 (file)
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -959,7 +959,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
        if (sz <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER))
                info = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
        if (!info) {
-               info = vmalloc(sz);
+               info = __vmalloc(sz, GFP_KERNEL | __GFP_NOWARN |
+                                    __GFP_NORETRY | __GFP_HIGHMEM,
+                                PAGE_KERNEL);
                if (!info)
                        return NULL;
        }