d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

M_PREPEND() with an argument of M_TRYWAIT can fail, meaning the

Browse Source 
returned mbuf can be NULL.  Check for NULL in rip_output() when
prepending an IP header.  This prevents mbuf exhaustion from
causing a local kernel panic when sending raw IP packets.

PR:		kern/55886
Reported by:	Pawel Malachowski <pawmal-posting@freebsd.lublin.pl>
MFC after:	3 days
This commit is contained in:
Robert Watson 2003-08-26 14:11:48 +00:00
parent ab2baa7254
commit 6b48911b00
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=119489
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/netinet/raw_ip.c
View File

@ -288,6 +288,8 @@ rip_output(m, so, dst)
return(EMSGSIZE);
}
M_PREPEND(m, sizeof(struct ip), M_TRYWAIT);
if (m == NULL)
return(ENOBUFS);
ip = mtod(m, struct ip *);
ip->ip_tos = inp->inp_ip_tos;
ip->ip_off = 0;