diff options
| author | rwatson <rwatson@FreeBSD.org> | 2003-08-26 14:11:48 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2003-08-26 14:11:48 +0000 |
| commit | bfe66075cf6940f2c1e9a0297cf821651a24a70d (patch) | |
| tree | 6f3d9c16a6f7ca69d0b15565a84c0ae82c4fcd29 | |
| parent | 05b6d7c95ac193c44a7cbc5f1e2a89939a1fc2c4 (diff) | |
| download | FreeBSD-src-bfe66075cf6940f2c1e9a0297cf821651a24a70d.zip FreeBSD-src-bfe66075cf6940f2c1e9a0297cf821651a24a70d.tar.gz | |
M_PREPEND() with an argument of M_TRYWAIT can fail, meaning the
returned mbuf can be NULL. Check for NULL in rip_output() when
prepending an IP header. This prevents mbuf exhaustion from
causing a local kernel panic when sending raw IP packets.
PR: kern/55886
Reported by: Pawel Malachowski <pawmal-posting@freebsd.lublin.pl>
MFC after: 3 days
| -rw-r--r-- | sys/netinet/raw_ip.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c index d4766ab..6e60033 100644 --- a/sys/netinet/raw_ip.c +++ b/sys/netinet/raw_ip.c @@ -288,6 +288,8 @@ rip_output(m, so, dst) return(EMSGSIZE); } M_PREPEND(m, sizeof(struct ip), M_TRYWAIT); + if (m == NULL) + return(ENOBUFS); ip = mtod(m, struct ip *); ip->ip_tos = inp->inp_ip_tos; ip->ip_off = 0; |
