DF-3317 / fix.diff
--- tcp_subr.c.orig +++ tcp_subr.c @@ -1587,6 +1587,17 @@ } else { goto out; } + /* + * RFC 8200 5.2: a node MUST discard a Packet Too Big + * message that reports a next-hop MTU below the IPv6 + * minimum link MTU. Without this floor, tcp_mtudisc() + * computes a zero/negative maxopd from the raw icmp6_mtu + * and stores a zero or garbage t_maxseg; t_maxseg == 0 + * later divides tcp_close()'s ssthresh recalculation + * by zero (see the division by tp->t_maxseg there). + */ + if (arg < IPV6_MMTU) + goto out; notify = tcp_mtudisc; } else if (!PRC_IS_REDIRECT(cmd) && ((unsigned)cmd > PRC_NCMDS || inet6ctlerrmap[cmd] == 0)) { |