Page MenuHomeFreeBSD

Limit option_len for the TCP_CCALGOOPT option
ClosedPublic

Authored by tuexen on Wed, Nov 28, 10:44 AM.

Details

Summary

When processing the IPPROTO_TCP level socket option TCP_CCALGOOPT, the kernel allocates memory based on the user provided option_len parameter. This option is currently only used by the newreno CC module, where the size used is 8 bytes.

This patch limits the size of allocated memory to 2048 bytes.

This issue was found by using syzkaller.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

tuexen created this revision.Wed, Nov 28, 10:44 AM
glebius accepted this revision.Wed, Nov 28, 8:05 PM
tuexen added a reviewer: bz.Thu, Nov 29, 5:16 PM
rrs accepted this revision.Thu, Nov 29, 5:18 PM
This revision is now accepted and ready to land.Thu, Nov 29, 5:18 PM
bz accepted this revision.Thu, Nov 29, 5:22 PM
This revision was automatically updated to reflect the committed changes.