[lkml]   [2000]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Fw: Local Denial-of-Service attack against Linux
    "David S. Miller" wrote:
    > Date: Sun, 26 Mar 2000 12:40:08 +0200
    > From: Manfred Spraul <>
    > Doesn't restore the original send buffer, it doubles the send buffer
    > size.
    > You are assuming that sysctl values and socket option settings
    > are equivalent, they are not.
    > We double on setsockopt SNDBUF to be more compatible about the
    > meaning of the send buffer size with other systems. Most systems
    > take it to mean the amount of data bytes that can be sent into
    > the socket at one time, to be more immune to massive memory usage
    > attacks we handle things differently.

    This explains why setsockopt(SNDBUF) sets sk->sndbuf to twice the user
    supplied number.

    But IMHO
    * getsockopt(SNDBUF) should return 1/2 sk->sndbuf.
    * sk->sndbuf should be initialized to 2*wmem_default.

    > When we allocate packet buffers, we act as if we are eating into twice
    > the amount of sk->sndbuf bytes as the data length. This is to account
    > for the extra overheads assosciated with the packet buffer struct and
    > protocol header bytes. For example, when the user sends 1 byte of
    > data over a socket, he is actually using a lot more memory than that
    > (1 data byte + sizeof(protocol headers) + sizeof(struct sk_buff)).

    I overlooked that when I updated the message queue code: you could kill
    the computer by sending lots of 0-byte messages to a SysV message queue


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:57    [W:0.021 / U:36.980 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site