Don't send TCP segments when the IP header chain and the TCP header doesn't fit in a packet

[tuexen]

Summary

RFC 7112 requires a host to put the complete IP header chain including the TCP header in the first IP packet. Enforce this in tcp_output(). Without this check, a kernel with INVARIANTS will panic.

This issue was found by running an instance of syzkaller.

Test Plan

Test with the reproducer generated by syzkaller:

r.c9 KBDownload

Here is the issue: panic: {tcp_output:LINE}: len < 0.

[rscheff]

sys/netinet/tcp_output.c

944

From transport-call: make this a >= to have at least 1 data byte per segment, to make forward progress. Otherwise, we may continously send packet with just ip+tcp headers forever.

[tuexen]

Allow at least one byte of payload to ensure that making progress is possible. This was suggested in the transport telco.

[tuexen]

sys/netinet/tcp_output.c

944

Addressed by the last change. The same change is also applied to RACK and BBR.