[lkml]   [2000]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Fw: Local Denial-of-Service attack against Linux
"David S. Miller" wrote:
> Date: Sun, 26 Mar 2000 12:40:08 +0200
> From: Manfred Spraul <>
> Doesn't restore the original send buffer, it doubles the send buffer
> size.
> You are assuming that sysctl values and socket option settings
> are equivalent, they are not.
> We double on setsockopt SNDBUF to be more compatible about the
> meaning of the send buffer size with other systems. Most systems
> take it to mean the amount of data bytes that can be sent into
> the socket at one time, to be more immune to massive memory usage
> attacks we handle things differently.

This explains why setsockopt(SNDBUF) sets sk->sndbuf to twice the user
supplied number.

* getsockopt(SNDBUF) should return 1/2 sk->sndbuf.
* sk->sndbuf should be initialized to 2*wmem_default.

> When we allocate packet buffers, we act as if we are eating into twice
> the amount of sk->sndbuf bytes as the data length. This is to account
> for the extra overheads assosciated with the packet buffer struct and
> protocol header bytes. For example, when the user sends 1 byte of
> data over a socket, he is actually using a lot more memory than that
> (1 data byte + sizeof(protocol headers) + sizeof(struct sk_buff)).

I overlooked that when I updated the message queue code: you could kill
the computer by sending lots of 0-byte messages to a SysV message queue


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:57    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean