From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E05BB42DA51; Thu, 16 Jul 2026 14:25:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784211952; cv=none; b=MMRTjMradJUWFGiMrEEy+HzyrXKZ6pklrhGBS9TFF5NNLbXuX2byFssvZRdlmTHaWY0k67WfUlQU8pIhp6Lyo6yTuOk+VHnb1Ic93mQEaoxm4NJsA3xc2fNKSVkgUkrFodJRBPTG64WIddmRa8cPqCfxLoDr5T0PtZFxLcwiFe4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784211952; c=relaxed/simple; bh=tHlxeni1yLO0HuOwaHYcOPKfJxfB6UsGM7HG2/QbhaQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XZtsDtGTc+FSCVWvUL/tfkghsxXNIjyLddv1W69z0vTxiEodnJw0mcDWfawbNV6ye8ZgOZsmEA0Fk3igH/QjBFwtKchQdUsJTUI8crV9gdwgRy5/Ry222+qgbbJ/B5ZLIkpDfY2xY49pSv8FkrJ1HYh/o5V0UQXHiaF/HkIADFo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MaSzhlBt; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="MaSzhlBt" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C8EAA1F000E9; Thu, 16 Jul 2026 14:25:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784211950; bh=WVHe/oEruW/ApM8Rd9MfKPqrCtY5gWssJAkdy1fxkHQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MaSzhlBtbyj2iyzVBI+8iVSh5YThYM5Tmz3QNfQBs3ehN+HzCYj5LcCEJJlfBj2MT XkkipNCAniYfdvHx0ZGFk1PY+uY0B0IKEdcXb/k2BC1bE9WXFUv2fWMK8OCSdxhoWR GRmeyLcMH148DXulOOgX3rjDTBDm7zSCqjYJPFCA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yuan Tan , Zhengchuan Liang , Xin Liu , Eric Dumazet , Wyatt Feng , Ren Wei , Jakub Kicinski Subject: [PATCH 6.12 140/349] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Date: Thu, 16 Jul 2026 15:31:14 +0200 Message-ID: <20260716133036.498307977@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260716133033.287196923@linuxfoundation.org> References: <20260716133033.287196923@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wyatt Feng commit efb8763d7bbb40cff4cc55a6b62c3095a038149c upstream. Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state. The sysctl is stored as an `int` but copied into the `u32` `tp->reordering` field for new sockets, so negative writes wrap to large values. With `tcp_mtu_probing=2`, the wrapped value can overflow the `tcp_mtu_probe()` size calculation and drive the MTU probing path into an out-of-bounds read. Route `tcp_reordering` writes through `proc_dointvec_minmax()` and require it to be at least 1. Also require `tcp_max_reordering` to be at least 1 so the configured maximum cannot become negative either. When registering the table for a non-init network namespace, relocate `extra2` pointers that refer into `init_net.ipv4` so the `tcp_reordering` upper bound follows that namespace's `tcp_max_reordering`. Harden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`. This keeps the send queue and window checks from being bypassed through signed integer overflow. Fixes: 91cc17c0e5e5 ("[TCP]: MTUprobe: receiver window & data available checks fixed") Cc: stable@vger.kernel.org Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Suggested-by: Eric Dumazet Signed-off-by: Wyatt Feng Signed-off-by: Ren Wei Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/1a5b7e1ef4d70fbad8c8ee0b82d8405f3c964a3d.1781395200.git.bronzed_45_vested@icloud.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/ipv4/sysctl_net_ipv4.c | 10 ++++++++-- net/ipv4/tcp_output.c | 4 ++-- 2 files changed, 10 insertions(+), 4 deletions(-) --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -1019,7 +1019,9 @@ static struct ctl_table ipv4_net_table[] .data = &init_net.ipv4.sysctl_tcp_reordering, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, + .extra2 = &init_net.ipv4.sysctl_tcp_max_reordering, }, { .procname = "tcp_retries1", @@ -1245,7 +1247,8 @@ static struct ctl_table ipv4_net_table[] .data = &init_net.ipv4.sysctl_tcp_max_reordering, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, }, { .procname = "tcp_dsack", @@ -1601,6 +1604,9 @@ static __net_init int ipv4_sysctl_init_n */ table[i].mode &= ~0222; } + if (table[i].extra2 >= (void *)&init_net.ipv4 && + table[i].extra2 < (void *)(&init_net.ipv4 + 1)) + table[i].extra2 += (void *)net - (void *)&init_net; } } --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2452,7 +2452,7 @@ static int tcp_mtu_probe(struct sock *sk struct sk_buff *skb, *nskb, *next; struct net *net = sock_net(sk); int probe_size; - int size_needed; + u64 size_needed; int copy, len; int mss_now; int interval; @@ -2476,7 +2476,7 @@ static int tcp_mtu_probe(struct sock *sk mss_now = tcp_current_mss(sk); probe_size = tcp_mtu_to_mss(sk, (icsk->icsk_mtup.search_high + icsk->icsk_mtup.search_low) >> 1); - size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache; + size_needed = probe_size + (tp->reordering + 1) * (u64)tp->mss_cache; interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low; /* When misfortune happens, we are reprobing actively, * and then reprobe timer has expired. We stick with current