snd_queue enqueue ignores ifq_maxlen unbounded kernel memory exhaustion DoS
Summary
ng_source_rcvdata enqueues every incoming mbuf onto sc->snd_queue with _IF_ENQUEUE but never checks IF_QFULL() despite ifq_maxlen=2048 at constructor(:280). In-source XXX should we check IF_QFULL() comment(:564) documents known gap. _IF_ENQUEUE unbounded list append connected upstream node can drive ifq_len total queued bytes to arbitrary size consuming mbuf clusters heap until system OOM. Latent file not built by default. [VERIFIED pass2: reproduced - pass-2 DUPLICATE of DF-2547 unbounded snd_queue 3000 over 2048, fold on triage]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2601 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| harness.c | — | 7.6 KB | view raw | |
| run.log | — | 605 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Evidence (decisive lines)
ngsource_456.log mode 4
PoC changes
same rig as DF-2547
Verified recommended fix
same as DF-2547
Verdict
Duplicate of DF-2547 (pass-2): unbounded snd_queue confirmed (3000 > 2048). netgraph7 is not in the stock kernel (DF-2539); ng_source.c is additionally absent from sys/conf/files and cannot compile as-is (:743 undeclared ifq). The harness module compiles the pristine file with only the documented build adaptations (:743 ifq->ifsq; DFly API renames IF_ENQUEUE/altq/ifq_var includes); ng7 core (netgraph.ko) kldloaded for the framework.
No comments yet.