lkml.org 
[lkml]   [2000]   [Mar]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Local Denial-of-Service attack against Linux (fwd)
Daniel Giemza wrote:
>
>
> Apparently unix domain sockets are ignoring the /proc/sys/net/core/wmem_max
> parameter, despite the documentation to the contrary. The fix should be
> simple, but I haven't had time to chase it down, and I'm not (usually) a
> Linux kernel developer.

* Linux allows you to send one message, even if that message is longer
than wmem_max.
* linux/net/core/sock.c:sock_alloc_send_skb(), around line 800:

skb=sock_wmalloc(...);
if(skb)
break;
+ if(try_size > 131072)
+ break;

should fix the problem [untested]

I noticed 2 further problems:
* 131072 should be a define (KMALLOC_MAX)
* linux/net/unix/af_unix.c:unix_stream_sendmsg() assumes that the page
size is 4096.

s/4096-16/PAGESIZE/g

--
Manfred

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:0.028 / U:0.592 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site