M_PREPEND() with an argument of M_TRYWAIT can fail, meaning the
returned mbuf can be NULL. Check for NULL in rip_output() when prepending an IP header. This prevents mbuf exhaustion from causing a local kernel panic when sending raw IP packets. PR: kern/55886 Reported by: Pawel Malachowski <pawmal-posting@freebsd.lublin.pl> MFC after: 3 days
This commit is contained in:
parent
ab2baa7254
commit
6b48911b00
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=119489
@ -288,6 +288,8 @@ rip_output(m, so, dst)
|
||||
return(EMSGSIZE);
|
||||
}
|
||||
M_PREPEND(m, sizeof(struct ip), M_TRYWAIT);
|
||||
if (m == NULL)
|
||||
return(ENOBUFS);
|
||||
ip = mtod(m, struct ip *);
|
||||
ip->ip_tos = inp->inp_ip_tos;
|
||||
ip->ip_off = 0;
|
||||
|
Loading…
Reference in New Issue
Block a user