svn commit: r361750 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Wed Jun  3 13:51:53 2020
New Revision: 361750
URL: https://svnweb.freebsd.org/changeset/base/361750

Log:
  Restrict enabling TCP-FASTOPEN to end-points in CLOSED or LISTEN state
  
  Enabling TCP-FASTOPEN on an end-point which is in a state other than
  CLOSED or LISTEN, is a bug in the application. So it should not work.
  Also the TCP code does not (and needs not to) handle this.
  While there, also simplify the setting of the TF_FASTOPEN flag.
  
  This issue was found by running syzkaller.
  
  Reviewed by:		rrs
  MFC after:		1 week
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D25115

Modified:
  head/sys/netinet/tcp_usrreq.c

Modified: head/sys/netinet/tcp_usrreq.c
==============================================================================
--- head/sys/netinet/tcp_usrreq.c	Wed Jun  3 13:02:31 2020	(r361749)
+++ head/sys/netinet/tcp_usrreq.c	Wed Jun  3 13:51:53 2020	(r361750)
@@ -2239,6 +2239,11 @@ unlock_and_done:
 				return (error);
 
 			INP_WLOCK_RECHECK(inp);
+			if ((tp->t_state != TCPS_CLOSED) &&
+			    (tp->t_state != TCPS_LISTEN)) {
+				error = EINVAL;
+				goto unlock_and_done;
+			}
 			if (tfo_optval.enable) {
 				if (tp->t_state == TCPS_LISTEN) {
 					if (!V_tcp_fastopen_server_enable) {
@@ -2246,7 +2251,6 @@ unlock_and_done:
 						goto unlock_and_done;
 					}
 
-					tp->t_flags |= TF_FASTOPEN;
 					if (tp->t_tfo_pending == NULL)
 						tp->t_tfo_pending =
 						    tcp_fastopen_alloc_counter();
@@ -2265,8 +2269,8 @@ unlock_and_done:
 						tp->t_tfo_client_cookie_len =
 						    TCP_FASTOPEN_PSK_LEN;
 					}
-					tp->t_flags |= TF_FASTOPEN;
 				}
+				tp->t_flags |= TF_FASTOPEN;
 			} else
 				tp->t_flags &= ~TF_FASTOPEN;
 			goto unlock_and_done;