Page MenuHomeFreeBSD

Limit option_len for the TCP_CCALGOOPT option

Authored by tuexen on Nov 28 2018, 10:44 AM.



When processing the IPPROTO_TCP level socket option TCP_CCALGOOPT, the kernel allocates memory based on the user provided option_len parameter. This option is currently only used by the newreno CC module, where the size used is 8 bytes.

This patch limits the size of allocated memory to 2048 bytes.

This issue was found by using syzkaller.

Diff Detail

rS FreeBSD src repository
Automatic diff as part of commit; lint not applicable.
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

tuexen created this revision.Nov 28 2018, 10:44 AM
glebius accepted this revision.Nov 28 2018, 8:05 PM
tuexen added a reviewer: bz.Nov 29 2018, 5:16 PM
rrs accepted this revision.Nov 29 2018, 5:18 PM
This revision is now accepted and ready to land.Nov 29 2018, 5:18 PM
bz accepted this revision.Nov 29 2018, 5:22 PM
This revision was automatically updated to reflect the committed changes.