From owner-svn-src-all@freebsd.org Wed Nov 23 13:14:20 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8BFEBC5067C; Wed, 23 Nov 2016 13:14:20 +0000 (UTC) (envelope-from gnn@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 5D7DBF1C; Wed, 23 Nov 2016 13:14:20 +0000 (UTC) (envelope-from gnn@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id uANDEJqG047883; Wed, 23 Nov 2016 13:14:19 GMT (envelope-from gnn@FreeBSD.org) Received: (from gnn@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id uANDEJsT047882; Wed, 23 Nov 2016 13:14:19 GMT (envelope-from gnn@FreeBSD.org) Message-Id: <201611231314.uANDEJsT047882@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: gnn set sender to gnn@FreeBSD.org using -f From: "George V. Neville-Neil" Date: Wed, 23 Nov 2016 13:14:19 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r309057 - stable/11/sys/netinet6 X-SVN-Group: stable-11 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Nov 2016 13:14:20 -0000 Author: gnn Date: Wed Nov 23 13:14:19 2016 New Revision: 309057 URL: https://svnweb.freebsd.org/changeset/base/309057 Log: MFC: 307541 Limit the number of mbufs that can be allocated for IPV6_2292PKTOPTIONS (and IPV6_PKTOPTIONS). PR: 100219 Submitted by: Joseph Kong Modified: stable/11/sys/netinet6/ip6_output.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/netinet6/ip6_output.c ============================================================================== --- stable/11/sys/netinet6/ip6_output.c Wed Nov 23 12:20:38 2016 (r309056) +++ stable/11/sys/netinet6/ip6_output.c Wed Nov 23 13:14:19 2016 (r309057) @@ -1398,6 +1398,15 @@ ip6_ctloutput(struct socket *so, struct int retval; #endif +/* + * Don't use more than a quarter of mbuf clusters. N.B.: + * nmbclusters is an int, but nmbclusters * MCLBYTES may overflow + * on LP64 architectures, so cast to u_long to avoid undefined + * behavior. ILP32 architectures cannot have nmbclusters + * large enough to overflow for other reasons. + */ +#define IPV6_PKTOPTIONS_MBUF_LIMIT ((u_long)nmbclusters * MCLBYTES / 4) + level = sopt->sopt_level; op = sopt->sopt_dir; optname = sopt->sopt_name; @@ -1453,6 +1462,12 @@ ip6_ctloutput(struct socket *so, struct { struct mbuf *m; + if (optlen > IPV6_PKTOPTIONS_MBUF_LIMIT) { + printf("ip6_ctloutput: mbuf limit hit\n"); + error = ENOBUFS; + break; + } + error = soopt_getm(sopt, &m); /* XXX */ if (error != 0) break;