diff options
| author | George V. Neville-Neil <gnn@FreeBSD.org> | 2016-10-17 23:25:31 +0000 |
|---|---|---|
| committer | George V. Neville-Neil <gnn@FreeBSD.org> | 2016-10-17 23:25:31 +0000 |
| commit | aec9c8d5a5ee52dd6d19892138ef78fc78ef2210 (patch) | |
| tree | 4a22fe28f7c29d436fb22a60be58395e545e4302 /sys/netinet6 | |
| parent | 3239d652388160b0641657b24843c7fdb3aa86ba (diff) | |
| download | src-aec9c8d5a5ee52dd6d19892138ef78fc78ef2210.tar.gz src-aec9c8d5a5ee52dd6d19892138ef78fc78ef2210.zip | |
Limit the number of mbufs that can be allocated for IPV6_2292PKTOPTIONS
(and IPV6_PKTOPTIONS).
PR: 100219
Submitted by: Joseph Kong
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D5157
Notes
Notes:
svn path=/head/; revision=307541
Diffstat (limited to 'sys/netinet6')
| -rw-r--r-- | sys/netinet6/ip6_output.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index 6045ee1e185b..49b89564b978 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -1393,6 +1393,15 @@ ip6_ctloutput(struct socket *so, struct sockopt *sopt) int retval; #endif +/* + * Don't use more than a quarter of mbuf clusters. N.B.: + * nmbclusters is an int, but nmbclusters * MCLBYTES may overflow + * on LP64 architectures, so cast to u_long to avoid undefined + * behavior. ILP32 architectures cannot have nmbclusters + * large enough to overflow for other reasons. + */ +#define IPV6_PKTOPTIONS_MBUF_LIMIT ((u_long)nmbclusters * MCLBYTES / 4) + level = sopt->sopt_level; op = sopt->sopt_dir; optname = sopt->sopt_name; @@ -1448,6 +1457,12 @@ ip6_ctloutput(struct socket *so, struct sockopt *sopt) { struct mbuf *m; + if (optlen > IPV6_PKTOPTIONS_MBUF_LIMIT) { + printf("ip6_ctloutput: mbuf limit hit\n"); + error = ENOBUFS; + break; + } + error = soopt_getm(sopt, &m); /* XXX */ if (error != 0) break; |