svn commit: r341335 - in head/sys/netinet: . cc

[Michael Tuexen]

Author: tuexen
Date: Fri Nov 30 10:50:07 2018
New Revision: 341335
URL: https://svnweb.freebsd.org/changeset/base/341335

Log:
  Limit option_len for the TCP_CCALGOOPT.
  
  Limiting the length to 2048 bytes seems to be acceptable, since
  the values used right now are using 8 bytes.
  
  Reviewed by:		glebius, bz, rrs
  MFC after:		3 days
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D18366

Modified:
  head/sys/netinet/cc/cc.h
  head/sys/netinet/tcp_usrreq.c

Modified: head/sys/netinet/cc/cc.h
==============================================================================
--- head/sys/netinet/cc/cc.h	Fri Nov 30 10:36:14 2018	(r341334)
+++ head/sys/netinet/cc/cc.h	Fri Nov 30 10:50:07 2018	(r341335)
@@ -184,4 +184,6 @@ extern struct rwlock cc_list_lock;
 #define	CC_LIST_WUNLOCK()	rw_wunlock(&cc_list_lock)
 #define	CC_LIST_LOCK_ASSERT()	rw_assert(&cc_list_lock, RA_LOCKED)
 
+#define CC_ALGOOPT_LIMIT	2048
+
 #endif /* _NETINET_CC_CC_H_ */

Modified: head/sys/netinet/tcp_usrreq.c
==============================================================================
--- head/sys/netinet/tcp_usrreq.c	Fri Nov 30 10:36:14 2018	(r341334)
+++ head/sys/netinet/tcp_usrreq.c	Fri Nov 30 10:50:07 2018	(r341335)
@@ -1769,6 +1769,8 @@ tcp_default_ctloutput(struct socket *so, struct sockop
 	switch (sopt->sopt_name) {
 	case TCP_CCALGOOPT:
 		INP_WUNLOCK(inp);
+		if (sopt->sopt_valsize > CC_ALGOOPT_LIMIT)
+			return (EINVAL);
 		pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK | M_ZERO);
 		error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
 		    sopt->sopt_valsize);