* Fw: [Bug 60665] New: `int backlog` is assigned to `unsigned short sk_max_ack_backlog` -> overflow
@ 2013-07-31 15:36 Stephen Hemminger
0 siblings, 0 replies; only message in thread
From: Stephen Hemminger @ 2013-07-31 15:36 UTC (permalink / raw)
To: netdev
Begin forwarded message:
Date: Wed, 31 Jul 2013 06:33:07 -0700
From: "bugzilla-daemon@bugzilla.kernel.org" <bugzilla-daemon@bugzilla.kernel.org>
To: "stephen@networkplumber.org" <stephen@networkplumber.org>
Subject: [Bug 60665] New: `int backlog` is assigned to `unsigned short sk_max_ack_backlog` -> overflow
https://bugzilla.kernel.org/show_bug.cgi?id=60665
Bug ID: 60665
Summary: `int backlog` is assigned to `unsigned short
sk_max_ack_backlog` -> overflow
Product: Networking
Version: 2.5
Kernel Version: 3.11-rc3
Hardware: All
OS: Linux
Tree: Mainline
Status: NEW
Severity: high
Priority: P1
Component: IPV4
Assignee: shemminger@linux-foundation.org
Reporter: ojab@ojab.ru
Regression: No
I'm not sure that my analysis is correct, but:
sk_max_ack_backlog declared as unsigned short @
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/include/net/sock.h?id=refs/tags/v3.11-rc3#n377
and we're assigning `int backlog` to it @
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/net/ipv4/af_inet.c?id=refs/tags/v3.10.4#n239
So if we'll set sysctls "net.ipv4.tcp_abort_on_overflow=1",
"net.core.somaxconn=65536" (or larger) and backlog > 65536, we'll have real
backlog = `somaxconn mod 65536`.
So AFAIU there shouldn't be possible to set somaxconn > 65535 or this behaviour
should be fixed.
--
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2013-07-31 15:36 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-07-31 15:36 Fw: [Bug 60665] New: `int backlog` is assigned to `unsigned short sk_max_ack_backlog` -> overflow Stephen Hemminger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).