svn commit: r307541 - head/sys/netinet6
George V. Neville-Neil
gnn at FreeBSD.org
Mon Oct 17 23:25:33 UTC 2016
Author: gnn
Date: Mon Oct 17 23:25:31 2016
New Revision: 307541
URL: https://svnweb.freebsd.org/changeset/base/307541
Log:
Limit the number of mbufs that can be allocated for IPV6_2292PKTOPTIONS
(and IPV6_PKTOPTIONS).
PR: 100219
Submitted by: Joseph Kong
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D5157
Modified:
head/sys/netinet6/ip6_output.c
Modified: head/sys/netinet6/ip6_output.c
==============================================================================
--- head/sys/netinet6/ip6_output.c Mon Oct 17 22:57:41 2016 (r307540)
+++ head/sys/netinet6/ip6_output.c Mon Oct 17 23:25:31 2016 (r307541)
@@ -1393,6 +1393,15 @@ ip6_ctloutput(struct socket *so, struct
int retval;
#endif
+/*
+ * Don't use more than a quarter of mbuf clusters. N.B.:
+ * nmbclusters is an int, but nmbclusters * MCLBYTES may overflow
+ * on LP64 architectures, so cast to u_long to avoid undefined
+ * behavior. ILP32 architectures cannot have nmbclusters
+ * large enough to overflow for other reasons.
+ */
+#define IPV6_PKTOPTIONS_MBUF_LIMIT ((u_long)nmbclusters * MCLBYTES / 4)
+
level = sopt->sopt_level;
op = sopt->sopt_dir;
optname = sopt->sopt_name;
@@ -1448,6 +1457,12 @@ ip6_ctloutput(struct socket *so, struct
{
struct mbuf *m;
+ if (optlen > IPV6_PKTOPTIONS_MBUF_LIMIT) {
+ printf("ip6_ctloutput: mbuf limit hit\n");
+ error = ENOBUFS;
+ break;
+ }
+
error = soopt_getm(sopt, &m); /* XXX */
if (error != 0)
break;
More information about the svn-src-all
mailing list