From: Kuniyuki Iwashima <kuniyu@amazon.com>
To: Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
David Ahern <dsahern@kernel.org>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>,
Kuniyuki Iwashima <kuniyu@amazon.com>,
Kuniyuki Iwashima <kuni1840@gmail.com>, <netdev@vger.kernel.org>
Subject: [PATCH v1 net 0/3] udp: Fix two integer overflows when sk->sk_rcvbuf is close to INT_MAX.
Date: Sun, 23 Mar 2025 16:09:49 -0700 [thread overview]
Message-ID: <20250323231016.74813-1-kuniyu@amazon.com> (raw)
I got a report that UDP mem usage in /proc/net/sockstat did not
drop even after an application was terminated.
The issue could happen if sk->sk_rmem_alloc wraps around due
to a large sk->sk_rcvbuf, which was INT_MAX in our case.
The patch 2 fixes the issue, and the patch 1 fixes yet another
overflow I found while investigating the issue.
Kuniyuki Iwashima (3):
udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
udp: Fix memory accounting leak.
selftest: net: Check wraparounds for sk->sk_rmem_alloc.
net/ipv4/udp.c | 18 ++-
tools/testing/selftests/net/.gitignore | 1 +
tools/testing/selftests/net/Makefile | 2 +-
tools/testing/selftests/net/so_rcvbuf.c | 178 ++++++++++++++++++++++++
4 files changed, 188 insertions(+), 11 deletions(-)
create mode 100644 tools/testing/selftests/net/so_rcvbuf.c
--
2.48.1
next reply other threads:[~2025-03-23 23:10 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-23 23:09 Kuniyuki Iwashima [this message]
2025-03-23 23:09 ` [PATCH v1 net 1/3] udp: Fix multiple wraparounds of sk->sk_rmem_alloc Kuniyuki Iwashima
2025-03-24 10:01 ` Eric Dumazet
2025-03-24 18:00 ` Kuniyuki Iwashima
2025-03-24 14:59 ` Willem de Bruijn
2025-03-24 18:10 ` Kuniyuki Iwashima
2025-03-24 19:44 ` Willem de Bruijn
2025-03-24 20:46 ` Kuniyuki Iwashima
2025-03-25 14:18 ` Willem de Bruijn
2025-03-25 17:53 ` Kuniyuki Iwashima
2025-03-23 23:09 ` [PATCH v1 net 2/3] udp: Fix memory accounting leak Kuniyuki Iwashima
2025-03-23 23:09 ` [PATCH v1 net 3/3] selftest: net: Check wraparounds for sk->sk_rmem_alloc Kuniyuki Iwashima
2025-03-24 15:58 ` Willem de Bruijn
2025-03-24 18:25 ` Kuniyuki Iwashima
2025-03-24 19:31 ` Willem de Bruijn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250323231016.74813-1-kuniyu@amazon.com \
--to=kuniyu@amazon.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=kuni1840@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).