[src/trunk]: src/sys/netinet Don't allow zero sized segments that will panic ...

[mlelstv <mlelstv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/81c95055fb1c
branches:  trunk
changeset: 461156:81c95055fb1c
user:      mlelstv <mlelstv%NetBSD.org@localhost>
date:      Sun Nov 17 08:21:25 2019 +0000

description:
Don't allow zero sized segments that will panic the stack.
Reported-by: syzbot+5542516fa4afe7a101e6%syzkaller.appspotmail.com@localhost

diffstat:

 sys/netinet/tcp_output.c |  12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diffs (40 lines):

diff -r 5698a8e30967 -r 81c95055fb1c sys/netinet/tcp_output.c
--- a/sys/netinet/tcp_output.c  Sun Nov 17 02:59:25 2019 +0000
+++ b/sys/netinet/tcp_output.c  Sun Nov 17 08:21:25 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: tcp_output.c,v 1.211 2019/02/25 10:49:16 maxv Exp $    */
+/*     $NetBSD: tcp_output.c,v 1.212 2019/11/17 08:21:25 mlelstv Exp $ */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -135,7 +135,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.211 2019/02/25 10:49:16 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.212 2019/11/17 08:21:25 mlelstv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -252,6 +252,7 @@
                break;
 #endif
        default:
+               hdrlen = 1; /* prevent zero sized segments */
                goto out;
        }
 
@@ -386,6 +387,13 @@
                *txsegsizep = uimin(so->so_snd.sb_hiwat >> 1, *txsegsizep);
        }
 
+       /*
+        * A segment must at least store header + options
+        */
+       if (*txsegsizep < hdrlen + optlen) {
+               return EMSGSIZE;
+       }
+
        if (*txsegsizep != tp->t_segsz) {
                /*
                 * If the new segment size is larger, we don't want to