networkd: enforce a limit on the number of statically assigned addresses/routes/fdb entries

We should put a limit on everything, hence also on these resources.

1 files changed, 17 insertions, 8 deletions

diff --git a/src/network/networkd-fdb.c b/src/network/networkd-fdb.c
index 241f486211..4d51fa41e2 100644
--- a/src/network/networkd-fdb.c
+++ b/src/network/networkd-fdb.c
@@ -27,14 +27,19 @@
 #include "networkd.h"
 #include "util.h"
 
+#define STATIC_FDB_ENTRIES_PER_NETWORK_MAX 1024U
+
 /* create a new FDB entry or get an existing one. */
-int fdb_entry_new_static(Network *const network,
-                         const unsigned section,
-                         FdbEntry **ret) {
+int fdb_entry_new_static(
+                Network *network,
+                const unsigned section,
+                FdbEntry **ret) {
+
         _cleanup_fdbentry_free_ FdbEntry *fdb_entry = NULL;
         struct ether_addr *mac_addr = NULL;
 
         assert(network);
+        assert(ret);
 
         /* search entry in hashmap first. */
         if (section) {
@@ -47,6 +52,9 @@ int fdb_entry_new_static(Network *const network,
                 }
         }
 
+        if (network->n_static_fdb_entries >= STATIC_FDB_ENTRIES_PER_NETWORK_MAX)
+                return -E2BIG;
+
         /* allocate space for MAC address. */
         mac_addr = new0(struct ether_addr, 1);
         if (!mac_addr)
@@ -54,7 +62,6 @@ int fdb_entry_new_static(Network *const network,
 
         /* allocate space for and FDB entry. */
         fdb_entry = new0(FdbEntry, 1);
-
         if (!fdb_entry) {
                 /* free previously allocated space for mac_addr. */
                 free(mac_addr);
@@ -66,6 +73,7 @@ int fdb_entry_new_static(Network *const network,
         fdb_entry->mac_addr = mac_addr;
 
         LIST_PREPEND(static_fdb_entries, network->static_fdb_entries, fdb_entry);
+        network->n_static_fdb_entries++;
 
         if (section) {
                 fdb_entry->section = section;
@@ -145,12 +153,13 @@ void fdb_entry_free(FdbEntry *fdb_entry) {
                 return;
 
         if (fdb_entry->network) {
-                LIST_REMOVE(static_fdb_entries, fdb_entry->network->static_fdb_entries,
-                            fdb_entry);
+                LIST_REMOVE(static_fdb_entries, fdb_entry->network->static_fdb_entries, fdb_entry);
+
+                assert(fdb_entry->network->n_static_fdb_entries > 0);
+                fdb_entry->network->n_static_fdb_entries--;
 
                 if (fdb_entry->section)
-                        hashmap_remove(fdb_entry->network->fdb_entries_by_section,
-                                       UINT_TO_PTR(fdb_entry->section));
+                        hashmap_remove(fdb_entry->network->fdb_entries_by_section, UINT_TO_PTR(fdb_entry->section));
         }
 
         free(fdb_entry->mac_addr);