svn commit: r341503 - in stable/11/sys/netinet: . cc

[Michael Tuexen]

Author: tuexen
Date: Tue Dec  4 22:25:24 2018
New Revision: 341503
URL: https://svnweb.freebsd.org/changeset/base/341503

Log:
  MFC r341335:
  
  Limit option_len for the TCP_CCALGOOPT.
  
  Limiting the length to 2048 bytes seems to be acceptable, since
  the values used right now are using 8 bytes.
  This issue was found by using syzkaller.
  
  Reviewed by:		glebius, bz, rrs
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D18366

Modified:
  stable/11/sys/netinet/cc/cc.h
  stable/11/sys/netinet/tcp_usrreq.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet/cc/cc.h
==============================================================================
--- stable/11/sys/netinet/cc/cc.h	Tue Dec  4 22:15:56 2018	(r341502)
+++ stable/11/sys/netinet/cc/cc.h	Tue Dec  4 22:25:24 2018	(r341503)
@@ -175,4 +175,6 @@ extern struct rwlock cc_list_lock;
 #define	CC_LIST_WUNLOCK()	rw_wunlock(&cc_list_lock)
 #define	CC_LIST_LOCK_ASSERT()	rw_assert(&cc_list_lock, RA_LOCKED)
 
+#define CC_ALGOOPT_LIMIT	2048
+
 #endif /* _NETINET_CC_CC_H_ */

Modified: stable/11/sys/netinet/tcp_usrreq.c
==============================================================================
--- stable/11/sys/netinet/tcp_usrreq.c	Tue Dec  4 22:15:56 2018	(r341502)
+++ stable/11/sys/netinet/tcp_usrreq.c	Tue Dec  4 22:25:24 2018	(r341503)
@@ -1549,6 +1549,8 @@ tcp_default_ctloutput(struct socket *so, struct sockop
 	switch (sopt->sopt_name) {
 	case TCP_CCALGOOPT:
 		INP_WUNLOCK(inp);
+		if (sopt->sopt_valsize > CC_ALGOOPT_LIMIT)
+			return (EINVAL);
 		pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK | M_ZERO);
 		error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
 		    sopt->sopt_valsize);