⬢ DragonFlyBSD Kernel Audit
DF-3317 / fix.diff
← back to finding ↓ download raw
--- tcp_subr.c.orig
+++ tcp_subr.c
@@ -1587,6 +1587,17 @@
 		} else {
 			goto out;
 		}
+		/*
+		 * RFC 8200 5.2: a node MUST discard a Packet Too Big
+		 * message that reports a next-hop MTU below the IPv6
+		 * minimum link MTU.  Without this floor, tcp_mtudisc()
+		 * computes a zero/negative maxopd from the raw icmp6_mtu
+		 * and stores a zero or garbage t_maxseg; t_maxseg == 0
+		 * later divides tcp_close()'s ssthresh recalculation
+		 * by zero (see the division by tp->t_maxseg there).
+		 */
+		if (arg < IPV6_MMTU)
+			goto out;
 		notify = tcp_mtudisc;
 	} else if (!PRC_IS_REDIRECT(cmd) &&
 		 ((unsigned)cmd > PRC_NCMDS || inet6ctlerrmap[cmd] == 0)) {