From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 115024252DE; Thu, 16 Jul 2026 13:44:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784209452; cv=none; b=StTiyHs1VmpTaSJN3nuwDfzOYcDXltgFWin3eKO8PdlH6QTv6JLTdNZ1ODEtMzBv6QXy1Ov8/k1mTVI2wBQoo4N0A+6B2jnyjQtuEvi/Yn4LySZZrof5VDRhWAxfL6osCaEGGiklhFrQpZFzpf1k4E2Lc3WMLBW2tEkX49Iw9Qs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784209452; c=relaxed/simple; bh=ZJWKcb9xkv5hr7ndM1DlSDZqYZWOMYUWQj8ULu6k6HE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=o4OF1WR5fupzC0V0Wm7IVtmwuByIR5gfSlK1wbuq2eQ0oT7gvnjtE3goKlzDfM8xjNRkwfgPrPCeirPdVOfzxNwS8SKND3HBBJfxEcishd/vkhfT/JofQNxlbrqzcDYKH5zfZB4zC6+Gz0iiN68BvwXEJ0JtO4ZjxXuXgLfxNxA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lgXKLH8D; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="lgXKLH8D" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 640BD1F00A3D; Thu, 16 Jul 2026 13:44:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784209447; bh=5j4CAuUNTtFQEKyvuDWuu4jh7HoWIyxVWAJ73keXbow=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=lgXKLH8DnYDav3U59sc9QKyjRracHr4UZVYi2nnx0kPVZGVbUk1g4tDxScK9ULAGj bYwfWtT9xHN9tkVBCzeu7/XIhqa5pMZWRPirsEmc52xzRpptXm4UyOgfqyghnQWIbB uc/J+TvXf1qdH2iq5f+ougRJm4sxzev+hNy3iHRQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yuan Tan , Zhengchuan Liang , Xin Liu , Eric Dumazet , Wyatt Feng , Ren Wei , Jakub Kicinski Subject: [PATCH 7.1 189/518] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Date: Thu, 16 Jul 2026 15:27:37 +0200 Message-ID: <20260716133051.968703576@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260716133047.772246337@linuxfoundation.org> References: <20260716133047.772246337@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wyatt Feng commit efb8763d7bbb40cff4cc55a6b62c3095a038149c upstream. Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state. The sysctl is stored as an `int` but copied into the `u32` `tp->reordering` field for new sockets, so negative writes wrap to large values. With `tcp_mtu_probing=2`, the wrapped value can overflow the `tcp_mtu_probe()` size calculation and drive the MTU probing path into an out-of-bounds read. Route `tcp_reordering` writes through `proc_dointvec_minmax()` and require it to be at least 1. Also require `tcp_max_reordering` to be at least 1 so the configured maximum cannot become negative either. When registering the table for a non-init network namespace, relocate `extra2` pointers that refer into `init_net.ipv4` so the `tcp_reordering` upper bound follows that namespace's `tcp_max_reordering`. Harden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`. This keeps the send queue and window checks from being bypassed through signed integer overflow. Fixes: 91cc17c0e5e5 ("[TCP]: MTUprobe: receiver window & data available checks fixed") Cc: stable@vger.kernel.org Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Suggested-by: Eric Dumazet Signed-off-by: Wyatt Feng Signed-off-by: Ren Wei Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/1a5b7e1ef4d70fbad8c8ee0b82d8405f3c964a3d.1781395200.git.bronzed_45_vested@icloud.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/ipv4/sysctl_net_ipv4.c | 10 ++++++++-- net/ipv4/tcp_output.c | 4 ++-- 2 files changed, 10 insertions(+), 4 deletions(-) --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -1058,7 +1058,9 @@ static struct ctl_table ipv4_net_table[] .data = &init_net.ipv4.sysctl_tcp_reordering, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, + .extra2 = &init_net.ipv4.sysctl_tcp_max_reordering, }, { .procname = "tcp_retries1", @@ -1293,7 +1295,8 @@ static struct ctl_table ipv4_net_table[] .data = &init_net.ipv4.sysctl_tcp_max_reordering, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, }, { .procname = "tcp_dsack", @@ -1676,6 +1679,9 @@ static __net_init int ipv4_sysctl_init_n */ table[i].mode &= ~0222; } + if (table[i].extra2 >= (void *)&init_net.ipv4 && + table[i].extra2 < (void *)(&init_net.ipv4 + 1)) + table[i].extra2 += (void *)net - (void *)&init_net; } } --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2687,7 +2687,7 @@ static int tcp_mtu_probe(struct sock *sk struct sk_buff *skb, *nskb, *next; struct net *net = sock_net(sk); int probe_size; - int size_needed; + u64 size_needed; int copy, len; int mss_now; int interval; @@ -2711,7 +2711,7 @@ static int tcp_mtu_probe(struct sock *sk mss_now = tcp_current_mss(sk); probe_size = tcp_mtu_to_mss(sk, (icsk->icsk_mtup.search_high + icsk->icsk_mtup.search_low) >> 1); - size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache; + size_needed = probe_size + (tp->reordering + 1) * (u64)tp->mss_cache; interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low; /* When misfortune happens, we are reprobing actively, * and then reprobe timer has expired. We stick with current