* [PATCH net] tipc: fix u16 MTU truncation in media and bearer MTU validation
@ 2026-07-06 18:57 Cen Zhang
2026-07-07 13:29 ` Tung Quang Nguyen
2026-07-07 15:25 ` [PATCH net] " Vadim Fedorenko
0 siblings, 2 replies; 4+ messages in thread
From: Cen Zhang @ 2026-07-06 18:57 UTC (permalink / raw)
To: jmaloy, davem, edumazet, kuba, pabeni, horms
Cc: netdev, tipc-discussion, linux-kernel, AutonomousCodeSecurity,
tgopinath, kys, Cen Zhang
Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU
values but only enforce a minimum bound, not a maximum. When a user sets
the MTU to a value exceeding U16_MAX (65535), it passes validation but
is silently truncated when assigned to u16 fields l->mtu and
l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
truncate to 0, causing a division by zero in tipc_link_set_queue_limits()
which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing
values (e.g. 65537-131071) produce small incorrect MTU values, resulting
in link malfunction behaviors.
Crash stack (triggered as unprivileged user):
tipc_link_set_queue_limits net/tipc/link.c:2531
tipc_link_create net/tipc/link.c:520
tipc_node_check_dest net/tipc/node.c:1279
tipc_disc_rcv net/tipc/discover.c:252
tipc_rcv net/tipc/node.c:2129
tipc_udp_recv net/tipc/udp_media.c:392
Two independent paths lack the upper bound check:
1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)
2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)
Fix both by rejecting MTU values above U16_MAX.
Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
---
net/tipc/bearer.c | 6 ++++++
net/tipc/udp_media.h | 5 +++++
2 files changed, 11 insertions(+)
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 05dcd2f9e..0926692dd 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -1163,6 +1163,12 @@ int __tipc_nl_bearer_set(struct sk_buff *skb,
struct genl_info *info)
"MTU value is out-of-range");
return -EINVAL;
}
+ if (nla_get_u32(props[TIPC_NLA_PROP_MTU]) >
+ U16_MAX) {
+ NL_SET_ERR_MSG(info->extack,
+ "MTU value is out-of-range");
+ return -EINVAL;
+ }
b->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]);
tipc_node_apply_property(net, b, TIPC_NLA_PROP_MTU);
#endif
diff --git a/net/tipc/udp_media.h b/net/tipc/udp_media.h
index e7455cc73..0d62a57c8 100644
--- a/net/tipc/udp_media.h
+++ b/net/tipc/udp_media.h
@@ -48,6 +48,11 @@ int tipc_udp_nl_dump_remoteip(struct sk_buff *skb,
struct netlink_callback *cb);
/* check if configured MTU is too low for tipc headers */
static inline bool tipc_udp_mtu_bad(u32 mtu)
{
+ if (mtu > U16_MAX) {
+ pr_warn("MTU too large for tipc bearer\n");
+ return true;
+ }
+
if (mtu >= (TIPC_MIN_BEARER_MTU + sizeof(struct iphdr) +
sizeof(struct udphdr)))
return false;
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH net] tipc: fix u16 MTU truncation in media and bearer MTU validation
2026-07-06 18:57 [PATCH net] tipc: fix u16 MTU truncation in media and bearer MTU validation Cen Zhang
@ 2026-07-07 13:29 ` Tung Quang Nguyen
2026-07-07 15:06 ` [PATCH net v2] " Cen Zhang (Microsoft)
2026-07-07 15:25 ` [PATCH net] " Vadim Fedorenko
1 sibling, 1 reply; 4+ messages in thread
From: Tung Quang Nguyen @ 2026-07-07 13:29 UTC (permalink / raw)
To: Cen Zhang
Cc: netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org,
AutonomousCodeSecurity@microsoft.com,
tgopinath@linux.microsoft.com, kys@microsoft.com,
jmaloy@redhat.com, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org
>Subject: [PATCH net] tipc: fix u16 MTU truncation in media and bearer MTU
>validation
>
Your patch cannot be applied cleanly to net tree. I cannot build and run test.
Please rebase you patch before I review it.
>Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied
>MTU values but only enforce a minimum bound, not a maximum. When a user
>sets the MTU to a value exceeding U16_MAX (65535), it passes validation but is
>silently truncated when assigned to u16 fields l->mtu and
>l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
>truncate to 0, causing a division by zero in tipc_link_set_queue_limits() which
>computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing values
>(e.g. 65537-131071) produce small incorrect MTU values, resulting in link
>malfunction behaviors.
>
>Crash stack (triggered as unprivileged user):
>
> tipc_link_set_queue_limits net/tipc/link.c:2531
> tipc_link_create net/tipc/link.c:520
> tipc_node_check_dest net/tipc/node.c:1279
> tipc_disc_rcv net/tipc/discover.c:252
> tipc_rcv net/tipc/node.c:2129
> tipc_udp_recv net/tipc/udp_media.c:392
>
>Two independent paths lack the upper bound check:
>1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET) 2.
>inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)
>
>Fix both by rejecting MTU values above U16_MAX.
>
>Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU")
>Reported-by: AutonomousCodeSecurity@microsoft.com
>Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
>---
> net/tipc/bearer.c | 6 ++++++
> net/tipc/udp_media.h | 5 +++++
> 2 files changed, 11 insertions(+)
>
>diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c index 05dcd2f9e..0926692dd
>100644
>--- a/net/tipc/bearer.c
>+++ b/net/tipc/bearer.c
>@@ -1163,6 +1163,12 @@ int __tipc_nl_bearer_set(struct sk_buff *skb, struct
>genl_info *info)
> "MTU value is out-of-range");
> return -EINVAL;
> }
>+ if (nla_get_u32(props[TIPC_NLA_PROP_MTU]) >
>+ U16_MAX) {
>+ NL_SET_ERR_MSG(info->extack,
>+ "MTU value is out-of-range");
>+ return -EINVAL;
>+ }
> b->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]);
> tipc_node_apply_property(net, b, TIPC_NLA_PROP_MTU); #endif
>diff --git a/net/tipc/udp_media.h b/net/tipc/udp_media.h index
>e7455cc73..0d62a57c8 100644
>--- a/net/tipc/udp_media.h
>+++ b/net/tipc/udp_media.h
>@@ -48,6 +48,11 @@ int tipc_udp_nl_dump_remoteip(struct sk_buff *skb,
>struct netlink_callback *cb);
> /* check if configured MTU is too low for tipc headers */ static inline bool
>tipc_udp_mtu_bad(u32 mtu) {
>+ if (mtu > U16_MAX) {
>+ pr_warn("MTU too large for tipc bearer\n");
>+ return true;
>+ }
>+
> if (mtu >= (TIPC_MIN_BEARER_MTU + sizeof(struct iphdr) +
> sizeof(struct udphdr)))
> return false;
>--
>2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH net v2] tipc: fix u16 MTU truncation in media and bearer MTU validation
2026-07-07 13:29 ` Tung Quang Nguyen
@ 2026-07-07 15:06 ` Cen Zhang (Microsoft)
0 siblings, 0 replies; 4+ messages in thread
From: Cen Zhang (Microsoft) @ 2026-07-07 15:06 UTC (permalink / raw)
To: tung.quang.nguyen, jmaloy, davem, edumazet, kuba, pabeni, horms
Cc: netdev, tipc-discussion, linux-kernel, AutonomousCodeSecurity,
tgopinath, kys, blbllhy
Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU
values but only enforce a minimum bound, not a maximum. When a user sets
the MTU to a value exceeding U16_MAX (65535), it passes validation but
is silently truncated when assigned to u16 fields l->mtu and
l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
truncate to 0, causing a division by zero in tipc_link_set_queue_limits()
which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing
values (e.g. 65537-131071) produce small incorrect MTU values, resulting
in link malfunction behaviors.
Crash stack (triggered as unprivileged user via user namespace):
tipc_link_set_queue_limits net/tipc/link.c:2531
tipc_link_create net/tipc/link.c:520
tipc_node_check_dest net/tipc/node.c:1279
tipc_disc_rcv net/tipc/discover.c:252
tipc_rcv net/tipc/node.c:2129
tipc_udp_recv net/tipc/udp_media.c:392
Two independent paths lack the upper bound check:
1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)
2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)
Fix both by rejecting MTU values above U16_MAX.
Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
---
v2: Solved format issue
net/tipc/bearer.c | 6 ++++++
net/tipc/udp_media.h | 5 +++++
2 files changed, 11 insertions(+)
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 05dcd2f9e..0926692dd 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -1163,6 +1163,12 @@ int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
"MTU value is out-of-range");
return -EINVAL;
}
+ if (nla_get_u32(props[TIPC_NLA_PROP_MTU]) >
+ U16_MAX) {
+ NL_SET_ERR_MSG(info->extack,
+ "MTU value is out-of-range");
+ return -EINVAL;
+ }
b->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]);
tipc_node_apply_property(net, b, TIPC_NLA_PROP_MTU);
#endif
diff --git a/net/tipc/udp_media.h b/net/tipc/udp_media.h
index e7455cc73..0d62a57c8 100644
--- a/net/tipc/udp_media.h
+++ b/net/tipc/udp_media.h
@@ -48,6 +48,11 @@ int tipc_udp_nl_dump_remoteip(struct sk_buff *skb, struct netlink_callback *cb);
/* check if configured MTU is too low for tipc headers */
static inline bool tipc_udp_mtu_bad(u32 mtu)
{
+ if (mtu > U16_MAX) {
+ pr_warn("MTU too large for tipc bearer\n");
+ return true;
+ }
+
if (mtu >= (TIPC_MIN_BEARER_MTU + sizeof(struct iphdr) +
sizeof(struct udphdr)))
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] tipc: fix u16 MTU truncation in media and bearer MTU validation
2026-07-06 18:57 [PATCH net] tipc: fix u16 MTU truncation in media and bearer MTU validation Cen Zhang
2026-07-07 13:29 ` Tung Quang Nguyen
@ 2026-07-07 15:25 ` Vadim Fedorenko
1 sibling, 0 replies; 4+ messages in thread
From: Vadim Fedorenko @ 2026-07-07 15:25 UTC (permalink / raw)
To: Cen Zhang, jmaloy, davem, edumazet, kuba, pabeni, horms
Cc: netdev, tipc-discussion, linux-kernel, AutonomousCodeSecurity,
tgopinath, kys
On 06/07/2026 19:57, Cen Zhang wrote:
> Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU
> values but only enforce a minimum bound, not a maximum. When a user sets
> the MTU to a value exceeding U16_MAX (65535), it passes validation but
> is silently truncated when assigned to u16 fields l->mtu and
> l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
> truncate to 0, causing a division by zero in tipc_link_set_queue_limits()
> which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing
> values (e.g. 65537-131071) produce small incorrect MTU values, resulting
> in link malfunction behaviors.
>
> Crash stack (triggered as unprivileged user):
>
> tipc_link_set_queue_limits net/tipc/link.c:2531
> tipc_link_create net/tipc/link.c:520
> tipc_node_check_dest net/tipc/node.c:1279
> tipc_disc_rcv net/tipc/discover.c:252
> tipc_rcv net/tipc/node.c:2129
> tipc_udp_recv net/tipc/udp_media.c:392
>
> Two independent paths lack the upper bound check:
> 1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)
> 2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)
>
> Fix both by rejecting MTU values above U16_MAX.
>
> Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
> ---
> net/tipc/bearer.c | 6 ++++++
> net/tipc/udp_media.h | 5 +++++
> 2 files changed, 11 insertions(+)
>
> diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
> index 05dcd2f9e..0926692dd 100644
> --- a/net/tipc/bearer.c
> +++ b/net/tipc/bearer.c
> @@ -1163,6 +1163,12 @@ int __tipc_nl_bearer_set(struct sk_buff *skb,
> struct genl_info *info)
> "MTU value is out-of-range");
> return -EINVAL;
> }
> + if (nla_get_u32(props[TIPC_NLA_PROP_MTU]) >
> + U16_MAX) {
> + NL_SET_ERR_MSG(info->extack,
> + "MTU value is out-of-range");
> + return -EINVAL;
> + }
> b->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]);
> tipc_node_apply_property(net, b, TIPC_NLA_PROP_MTU);
> #endif
Just wonder if this can be done with NLA_POLICY_RANGE/MAX/etc...
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-07 15:25 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-06 18:57 [PATCH net] tipc: fix u16 MTU truncation in media and bearer MTU validation Cen Zhang
2026-07-07 13:29 ` Tung Quang Nguyen
2026-07-07 15:06 ` [PATCH net v2] " Cen Zhang (Microsoft)
2026-07-07 15:25 ` [PATCH net] " Vadim Fedorenko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox