Re: Deadlock with icmpv6fuzz
From: David Miller <davem@davemloft.net>
Date: 2009-02-06 09:06:03
From: David Miller <davem@davemloft.net>
Date: 2009-02-06 09:06:03
From: Herbert Xu <herbert@gondor.apana.org.au> Date: Fri, 6 Feb 2009 19:54:06 +1100
This should eliminate the backtrace as reported, but it'll just show up somewhere else. In particular, the control message (see sys_sendmsg) itself is copied to kernel memory via kmalloc and it's limited to INT_MAX :)
Can you be more specific, do you mean this is happening via datagram_send_ctl()? If we limit how big these txoption blobs can be, at all sites where we parse instances the user gives us, I can't see any such problems.