From f999d5a91aee3367c16e6adb5515666a79796d5b Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gbeutner@serenityos.org>
Date: Thu, 6 May 2021 20:22:57 +0200
Subject: [PATCH] Kernel: Limit the number of in-flight packet buffers

This fixes an OOM when hitting the VM with lots of UDP packets.

fixes #6907
---
 Kernel/Net/NetworkAdapter.cpp | 7 +++++++
 Kernel/Net/NetworkAdapter.h   | 4 ++++
 2 files changed, 11 insertions(+)

diff --git a/Kernel/Net/NetworkAdapter.cpp b/Kernel/Net/NetworkAdapter.cpp
index 07b3e911b9..7a72bcc868 100644
--- a/Kernel/Net/NetworkAdapter.cpp
+++ b/Kernel/Net/NetworkAdapter.cpp
@@ -160,6 +160,11 @@ void NetworkAdapter::did_receive(ReadonlyBytes payload)
 
     Optional<KBuffer> buffer;
 
+    if (m_packet_queue_size == max_packet_buffers) {
+        // FIXME: Keep track of the number of dropped packets
+        return;
+    }
+
     if (m_unused_packet_buffers.is_empty()) {
         buffer = KBuffer::copy(payload.data(), payload.size());
     } else {
@@ -174,6 +179,7 @@ void NetworkAdapter::did_receive(ReadonlyBytes payload)
     }
 
     m_packet_queue.append({ buffer.value(), kgettimeofday() });
+    m_packet_queue_size++;
 
     if (on_receive)
         on_receive();
@@ -185,6 +191,7 @@ size_t NetworkAdapter::dequeue_packet(u8* buffer, size_t buffer_size, Time& pack
     if (m_packet_queue.is_empty())
         return 0;
     auto packet_with_timestamp = m_packet_queue.take_first();
+    m_packet_queue_size--;
     packet_timestamp = packet_with_timestamp.timestamp;
     auto packet = move(packet_with_timestamp.packet);
     size_t packet_size = packet.size();
diff --git a/Kernel/Net/NetworkAdapter.h b/Kernel/Net/NetworkAdapter.h
index 148ada3c87..dc4de36723 100644
--- a/Kernel/Net/NetworkAdapter.h
+++ b/Kernel/Net/NetworkAdapter.h
@@ -80,7 +80,11 @@ private:
         Time timestamp;
     };
 
+    // FIXME: Make this configurable
+    static constexpr size_t max_packet_buffers = 1024;
+
     SinglyLinkedList<PacketWithTimestamp> m_packet_queue;
+    size_t m_packet_queue_size { 0 };
     SinglyLinkedList<KBuffer> m_unused_packet_buffers;
     size_t m_unused_packet_buffers_count { 0 };
     String m_name;