svn commit: r265123 - in stable: 8/sys/netinet 8/sys/sys 9/sys/netinet 9/sys/sys

[Xin LI]

Author: delphij
Date: Wed Apr 30 04:04:20 2014
New Revision: 265123
URL: http://svnweb.freebsd.org/changeset/base/265123

Log:
  Fix TCP reassembly vulnerability.
  
  Patch done by:	glebius
  Security:	FreeBSD-SA-14:08.tcp
  Security:	CVE-2014-3000

Modified:
  stable/9/sys/netinet/tcp_reass.c
  stable/9/sys/sys/param.h

Changes in other areas also in this revision:
Modified:
  stable/8/sys/netinet/tcp_reass.c
  stable/8/sys/sys/param.h

Modified: stable/9/sys/netinet/tcp_reass.c
==============================================================================
--- stable/9/sys/netinet/tcp_reass.c	Wed Apr 30 04:03:05 2014	(r265122)
+++ stable/9/sys/netinet/tcp_reass.c	Wed Apr 30 04:04:20 2014	(r265123)
@@ -205,7 +205,7 @@ tcp_reass(struct tcpcb *tp, struct tcphd
 	 * Investigate why and re-evaluate the below limit after the behaviour
 	 * is understood.
 	 */
-	if (th->th_seq != tp->rcv_nxt &&
+	if ((th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) &&
 	    tp->t_segqlen >= (so->so_rcv.sb_hiwat / tp->t_maxseg) + 1) {
 		V_tcp_reass_overflows++;
 		TCPSTAT_INC(tcps_rcvmemdrop);
@@ -228,7 +228,7 @@ tcp_reass(struct tcpcb *tp, struct tcphd
 	 */
 	te = uma_zalloc(V_tcp_reass_zone, M_NOWAIT);
 	if (te == NULL) {
-		if (th->th_seq != tp->rcv_nxt) {
+		if (th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) {
 			TCPSTAT_INC(tcps_rcvmemdrop);
 			m_freem(m);
 			*tlenp = 0;
@@ -276,7 +276,8 @@ tcp_reass(struct tcpcb *tp, struct tcphd
 				TCPSTAT_INC(tcps_rcvduppack);
 				TCPSTAT_ADD(tcps_rcvdupbyte, *tlenp);
 				m_freem(m);
-				uma_zfree(V_tcp_reass_zone, te);
+				if (te != &tqs)
+					uma_zfree(V_tcp_reass_zone, te);
 				tp->t_segqlen--;
 				/*
 				 * Try to present any queued data

Modified: stable/9/sys/sys/param.h
==============================================================================
--- stable/9/sys/sys/param.h	Wed Apr 30 04:03:05 2014	(r265122)
+++ stable/9/sys/sys/param.h	Wed Apr 30 04:04:20 2014	(r265123)
@@ -58,7 +58,7 @@
  *		in the range 5 to 9.
  */
 #undef __FreeBSD_version
-#define __FreeBSD_version 902511	/* Master, propagated to newvers */
+#define __FreeBSD_version 902512	/* Master, propagated to newvers */
 
 /*
  * __FreeBSD_kernel__ indicates that this system uses the kernel of FreeBSD,