2 files changed, 4 insertions, 1 deletions

diff --git a/include/linux/netfilter/ipset/ip_set_list.h b/include/linux/netfilter/ipset/ip_set_list.h
index 68c2aea897f5..fe2622a00151 100644
--- a/include/linux/netfilter/ipset/ip_set_list.h
+++ b/include/linux/netfilter/ipset/ip_set_list.h
@@ -6,5 +6,6 @@
 
 #define IP_SET_LIST_DEFAULT_SIZE        8
 #define IP_SET_LIST_MIN_SIZE            4
+#define IP_SET_LIST_MAX_SIZE            65536
 
 #endif /* __IP_SET_LIST_H */
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 3e2317f3cf68..f87adbad6076 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -597,7 +597,9 @@ init_list_set(struct net *net, struct ip_set *set, u32 size)
         struct set_elem *e;
         u32 i;
 
-        map = kzalloc(sizeof(*map) + size * set->dsize, GFP_KERNEL);
+        map = kzalloc(sizeof(*map) +
+                      min_t(u32, size, IP_SET_LIST_MAX_SIZE) * set->dsize,
+                      GFP_KERNEL);
         if (!map)
                 return false;