Commit 5f671d6b4ec3e6d66c2a868738af2cdea09e7509
Committed by
David S. Miller
1 parent
3508ea333e
Exists in
smarc-imx_3.14.28_1.0.0_ga
and in
1 other branch
net: check net.core.somaxconn sysctl values
It's possible to assign an invalid value to the net.core.somaxconn sysctl variable, because there is no checks at all. The sk_max_ack_backlog field of the sock structure is defined as unsigned short. Therefore, the backlog argument in inet_listen() shouldn't exceed USHRT_MAX. The backlog argument in the listen() syscall is truncated to the somaxconn value. So, the somaxconn value shouldn't exceed 65535 (USHRT_MAX). Also, negative values of somaxconn are meaningless. before: $ sysctl -w net.core.somaxconn=256 net.core.somaxconn = 256 $ sysctl -w net.core.somaxconn=65536 net.core.somaxconn = 65536 $ sysctl -w net.core.somaxconn=-100 net.core.somaxconn = -100 after: $ sysctl -w net.core.somaxconn=256 net.core.somaxconn = 256 $ sysctl -w net.core.somaxconn=65536 error: "Invalid argument" setting key "net.core.somaxconn" $ sysctl -w net.core.somaxconn=-100 error: "Invalid argument" setting key "net.core.somaxconn" Based on a prior patch from Changli Gao. Signed-off-by: Roman Gushchin <klamm@yandex-team.ru> Reported-by: Changli Gao <xiaosuo@gmail.com> Suggested-by: Eric Dumazet <edumazet@google.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Showing 1 changed file with 5 additions and 1 deletions Side-by-side Diff
net/core/sysctl_net_core.c
... | ... | @@ -21,7 +21,9 @@ |
21 | 21 | #include <net/net_ratelimit.h> |
22 | 22 | #include <net/busy_poll.h> |
23 | 23 | |
24 | +static int zero = 0; | |
24 | 25 | static int one = 1; |
26 | +static int ushort_max = USHRT_MAX; | |
25 | 27 | |
26 | 28 | #ifdef CONFIG_RPS |
27 | 29 | static int rps_sock_flow_sysctl(struct ctl_table *table, int write, |
... | ... | @@ -339,7 +341,9 @@ |
339 | 341 | .data = &init_net.core.sysctl_somaxconn, |
340 | 342 | .maxlen = sizeof(int), |
341 | 343 | .mode = 0644, |
342 | - .proc_handler = proc_dointvec | |
344 | + .extra1 = &zero, | |
345 | + .extra2 = &ushort_max, | |
346 | + .proc_handler = proc_dointvec_minmax | |
343 | 347 | }, |
344 | 348 | { } |
345 | 349 | }; |