Don't send TCP segments when the IP header chain and the TCP header doesn't fit in a packet
ClosedPublic
Actions

Authored by tuexen on Sep 15 2019, 3:36 PM.

Details

Reviewers

rrs
thj
jtl
markj
rscheff

Group Reviewers

transport

Commits

rS353040: MFS r352673:
rS353035: MFC r352868:
rS352868: RFC 7112 requires a host to put the complete IP header chain

Summary

RFC 7112 requires a host to put the complete IP header chain including the TCP header in the first IP packet. Enforce this in tcp_output(). Without this check, a kernel with INVARIANTS will panic.

This issue was found by running an instance of syzkaller.

Test Plan

Test with the reproducer generated by syzkaller:

r.c9 KBDownload

Here is the issue: panic: {tcp_output:LINE}: len < 0.

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 26756

Event Timeline

tuexen created this revision.Sep 15 2019, 3:36 PM

Herald added a reviewer: transport. · View Herald TranscriptSep 15 2019, 3:36 PM

Herald added a subscriber: imp. · View Herald Transcript

Harbormaster completed remote builds in B26507: Diff 62126.Sep 15 2019, 3:36 PM

rscheff added inline comments.Sep 26 2019, 2:18 PM

sys/netinet/tcp_output.c
944	From transport-call: make this a >= to have at least 1 data byte per segment, to make forward progress. Otherwise, we may continously send packet with just ip+tcp headers forever.