Date: Mon, 17 Oct 2016 23:25:31 +0000 (UTC) From: "George V. Neville-Neil" <gnn@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r307541 - head/sys/netinet6 Message-ID: <201610172325.u9HNPV91080225@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: gnn Date: Mon Oct 17 23:25:31 2016 New Revision: 307541 URL: https://svnweb.freebsd.org/changeset/base/307541 Log: Limit the number of mbufs that can be allocated for IPV6_2292PKTOPTIONS (and IPV6_PKTOPTIONS). PR: 100219 Submitted by: Joseph Kong MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D5157 Modified: head/sys/netinet6/ip6_output.c Modified: head/sys/netinet6/ip6_output.c ============================================================================== --- head/sys/netinet6/ip6_output.c Mon Oct 17 22:57:41 2016 (r307540) +++ head/sys/netinet6/ip6_output.c Mon Oct 17 23:25:31 2016 (r307541) @@ -1393,6 +1393,15 @@ ip6_ctloutput(struct socket *so, struct int retval; #endif +/* + * Don't use more than a quarter of mbuf clusters. N.B.: + * nmbclusters is an int, but nmbclusters * MCLBYTES may overflow + * on LP64 architectures, so cast to u_long to avoid undefined + * behavior. ILP32 architectures cannot have nmbclusters + * large enough to overflow for other reasons. + */ +#define IPV6_PKTOPTIONS_MBUF_LIMIT ((u_long)nmbclusters * MCLBYTES / 4) + level = sopt->sopt_level; op = sopt->sopt_dir; optname = sopt->sopt_name; @@ -1448,6 +1457,12 @@ ip6_ctloutput(struct socket *so, struct { struct mbuf *m; + if (optlen > IPV6_PKTOPTIONS_MBUF_LIMIT) { + printf("ip6_ctloutput: mbuf limit hit\n"); + error = ENOBUFS; + break; + } + error = soopt_getm(sopt, &m); /* XXX */ if (error != 0) break;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201610172325.u9HNPV91080225>