svn commit: r341502 - in stable/12/sys/netinet: . cc

[Michael Tuexen]

Author: tuexen
Date: Tue Dec  4 22:15:56 2018
New Revision: 341502
URL: https://svnweb.freebsd.org/changeset/base/341502

Log:
  MFC r341335:
  
  Limit option_len for the TCP_CCALGOOPT.
  
  Limiting the length to 2048 bytes seems to be acceptable, since
  the values used right now are using 8 bytes.
  This issue was found by using syzkaller.
  
  Reviewed by:		glebius, bz, rrs
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D18366

Modified:
  stable/12/sys/netinet/cc/cc.h
  stable/12/sys/netinet/tcp_usrreq.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/cc/cc.h
==============================================================================
--- stable/12/sys/netinet/cc/cc.h	Tue Dec  4 22:14:18 2018	(r341501)
+++ stable/12/sys/netinet/cc/cc.h	Tue Dec  4 22:15:56 2018	(r341502)
@@ -184,4 +184,6 @@ extern struct rwlock cc_list_lock;
 #define	CC_LIST_WUNLOCK()	rw_wunlock(&cc_list_lock)
 #define	CC_LIST_LOCK_ASSERT()	rw_assert(&cc_list_lock, RA_LOCKED)
 
+#define CC_ALGOOPT_LIMIT	2048
+
 #endif /* _NETINET_CC_CC_H_ */

Modified: stable/12/sys/netinet/tcp_usrreq.c
==============================================================================
--- stable/12/sys/netinet/tcp_usrreq.c	Tue Dec  4 22:14:18 2018	(r341501)
+++ stable/12/sys/netinet/tcp_usrreq.c	Tue Dec  4 22:15:56 2018	(r341502)
@@ -1769,6 +1769,8 @@ tcp_default_ctloutput(struct socket *so, struct sockop
 	switch (sopt->sopt_name) {
 	case TCP_CCALGOOPT:
 		INP_WUNLOCK(inp);
+		if (sopt->sopt_valsize > CC_ALGOOPT_LIMIT)
+			return (EINVAL);
 		pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK | M_ZERO);
 		error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
 		    sopt->sopt_valsize);