[PATCH net] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

[PATCH net] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

[Eric Dumazet]

When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).
This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.

However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.
If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will
be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer
dereference because local TCP packets do not use frag_list.

Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from
ip6_default_advmss() when MTU is large.

Also update the stale comment in ip6_default_advmss() which suggested
that IPV6_MAXPLEN is returned to mean "any MSS".

Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes")
Reported-by: syzbot+ebdb22d461c904fc3cb2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a2c3193.8812e0fc.3c3fa4.0001.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Cc: Xin Long <lucien.xin@gmail.com>
---
 net/ipv6/route.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 636f0120d7e38d6d7f07b43ee6673c56e77471aa..3c97ba01297aa85da64f797096bc35abb0a00ac8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3275,11 +3275,11 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
 	/*
 	 * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
 	 * corresponding MSS is IPV6_MAXPLEN - tcp_header_size.
-	 * IPV6_MAXPLEN is also valid and means: "any MSS,
-	 * rely only on pmtu discovery"
+	 * Limit the default MSS to GSO_BY_FRAGS - 1 to avoid
+	 * collision with the GSO_BY_FRAGS magic value (0xFFFF).
 	 */
 	if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
-		mtu = IPV6_MAXPLEN;
+		mtu = min_t(unsigned int, IPV6_MAXPLEN, GSO_BY_FRAGS - 1);
 	return mtu;
 }
 
-- 
2.54.0.1136.gdb2ca164c4-goog

Re: [PATCH net] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

[Kuniyuki Iwashima]

On Fri, Jun 12, 2026 at 9:25 AM Eric Dumazet <edumazet@google.com> wrote:
>
> When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).
> This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.
>
> However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.
> If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will
> be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer
> dereference because local TCP packets do not use frag_list.
>
> Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from
> ip6_default_advmss() when MTU is large.
>
> Also update the stale comment in ip6_default_advmss() which suggested
> that IPV6_MAXPLEN is returned to mean "any MSS".
>
> Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes")
> Reported-by: syzbot+ebdb22d461c904fc3cb2@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a2c3193.8812e0fc.3c3fa4.0001.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Interesting !

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Re: [PATCH net] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 12 Jun 2026 16:25:17 +0000 you wrote:
> When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).
> This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.
> 
> However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.
> If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will
> be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer
> dereference because local TCP packets do not use frag_list.
> 
> [...]

Here is the summary with links:
  - [net] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
    https://git.kernel.org/netdev/net/c/2bf43d0e2e6a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html