summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorJozsef Kadlecsik <kadlec@netfilter.org>2021-07-28 17:01:15 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2021-08-04 10:41:03 +0200
commit5f7b51bf09baca8e4f80cbe879536842bafb5f31 (patch)
treebce22856b41c8a21912bda7a40cd77275f2a54e7 /include
parentc7d102232649226a69dddd58a4942cf13cff4f7c (diff)
netfilter: ipset: Limit the maximal range of consecutive elements to add/delete
The range size of consecutive elements were not limited. Thus one could define a huge range which may result soft lockup errors due to the long execution time. Now the range size is limited to 2^20 entries. Reported-by: Brad Spengler <spender@grsecurity.net> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include')
-rw-r--r--include/linux/netfilter/ipset/ip_set.h3
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index 10279c4830ac..ada1296c87d5 100644
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -196,6 +196,9 @@ struct ip_set_region {
u32 elements; /* Number of elements vs timeout */
};
+/* Max range where every element is added/deleted in one step */
+#define IPSET_MAX_RANGE (1<<20)
+
/* The max revision number supported by any set type + 1 */
#define IPSET_REVISION_MAX 9