DF-2601
snd_queue enqueue ignores ifq_maxlen unbounded kernel memory exhaustion DoS
Summary
ng_source_rcvdata enqueues every incoming mbuf onto sc->snd_queue with _IF_ENQUEUE but never checks IF_QFULL() despite ifq_maxlen=2048 at constructor(:280). In-source XXX should we check IF_QFULL() comment(:564) documents known gap. _IF_ENQUEUE unbounded list append connected upstream node can drive ifq_len total queued bytes to arbitrary size consuming mbuf clusters heap until system OOM. Latent file not built by default.
No comments yet.