[src/trunk]: src/sys/netinet Change the check to be <= instead of <. This fix...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/3816386f14e9
branches:  trunk
changeset: 321700:3816386f14e9
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sun Apr 01 12:58:47 2018 +0000

description:
Change the check to be <= instead of <. This fixes one occurrence of an
apparently widespread division-by-zero bug in our TCP code: if a user adds
huge IPv6 options with setsockopt, and if the total size of the options
happens to be equal to the available space calculated for the TCP payload,
t_segsz gets set to zero, and given that we then divide several things by
it, the kernel crashes.

diffstat:

 sys/netinet/tcp_output.c |  12 ++++++++----
 1 files changed, 8 insertions(+), 4 deletions(-)

diffs (34 lines):

diff -r 2f11925f99a7 -r 3816386f14e9 sys/netinet/tcp_output.c
--- a/sys/netinet/tcp_output.c  Sun Apr 01 12:46:50 2018 +0000
+++ b/sys/netinet/tcp_output.c  Sun Apr 01 12:58:47 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: tcp_output.c,v 1.203 2018/04/01 12:46:50 maxv Exp $    */
+/*     $NetBSD: tcp_output.c,v 1.204 2018/04/01 12:58:47 maxv Exp $    */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -135,7 +135,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.203 2018/04/01 12:46:50 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.204 2018/04/01 12:58:47 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -358,9 +358,13 @@
 #endif
        size -= optlen;
 
-       /* there may not be any room for data if mtu is too small */
-       if (size < 0)
+       /*
+        * There may not be any room for data if mtu is too small. This
+        * includes zero-sized.
+        */
+       if (size <= 0) {
                return EMSGSIZE;
+       }
 
        /*
         * *rxsegsizep holds *estimated* inbound segment size (estimation