[PATCH net v4] tipc: fix u16 MTU truncation in media and bearer MTU validation

[PATCH net v4] tipc: fix u16 MTU truncation in media and bearer MTU validation

[Cen Zhang (Microsoft)]

Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied
MTU values but only enforce a minimum bound, not a maximum. When a user
sets the MTU to a value exceeding U16_MAX (65535), it passes validation
but is silently truncated when assigned to u16 fields l->mtu and
l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
truncate to 0, causing a division by zero in tipc_link_set_queue_limits()
which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing
values (e.g. 65537-131071) produce small incorrect MTU values, resulting
in link malfunction behaviors.

Crash stack (triggered as unprivileged user via user namespace):

  tipc_link_set_queue_limits  net/tipc/link.c:2531
  tipc_link_create            net/tipc/link.c:520
  tipc_node_check_dest        net/tipc/node.c:1279
  tipc_disc_rcv               net/tipc/discover.c:252
  tipc_rcv                    net/tipc/node.c:2129
  tipc_udp_recv               net/tipc/udp_media.c:392

Two independent paths lack the upper bound check:
1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)
2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)

Fix both by rejecting MTU values above U16_MAX.

Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU")
Reported-by: AutonomousCodeSecurity@microsoft.com
Closes: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
---
v4: Add .min check value
v3: Use nla_policy check to limit MTU max value as suggested by Vadim
v2: Solved format issue
Link: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com

 net/tipc/netlink.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 8336a9664703..811438c44542 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -113,12 +113,17 @@ const struct nla_policy tipc_nl_node_policy[TIPC_NLA_NODE_MAX + 1] = {
 };
 
 /* Properties valid for media, bearer and link */
+static const struct netlink_range_validation tipc_nl_mtu_range = {
+	.min = TIPC_MIN_BEARER_MTU,
+	.max = U16_MAX,
+};
+
 const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = {
 	[TIPC_NLA_PROP_UNSPEC]		= { .type = NLA_UNSPEC },
 	[TIPC_NLA_PROP_PRIO]		= { .type = NLA_U32 },
 	[TIPC_NLA_PROP_TOL]		= { .type = NLA_U32 },
 	[TIPC_NLA_PROP_WIN]		= { .type = NLA_U32 },
-	[TIPC_NLA_PROP_MTU]		= { .type = NLA_U32 },
+	[TIPC_NLA_PROP_MTU]		= NLA_POLICY_FULL_RANGE(NLA_U32, &tipc_nl_mtu_range),
 	[TIPC_NLA_PROP_BROADCAST]	= { .type = NLA_U32 },
 	[TIPC_NLA_PROP_BROADCAST_RATIO]	= { .type = NLA_U32 }
 };
-- 
2.53.0

Re: [PATCH net v4] tipc: fix u16 MTU truncation in media and bearer MTU validation

[Vadim Fedorenko]

On 09/07/2026 22:16, Cen Zhang (Microsoft) wrote:
> Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied
> MTU values but only enforce a minimum bound, not a maximum. When a user
> sets the MTU to a value exceeding U16_MAX (65535), it passes validation
> but is silently truncated when assigned to u16 fields l->mtu and
> l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
> truncate to 0, causing a division by zero in tipc_link_set_queue_limits()
> which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing
> values (e.g. 65537-131071) produce small incorrect MTU values, resulting
> in link malfunction behaviors.
> 
> Crash stack (triggered as unprivileged user via user namespace):
> 
>    tipc_link_set_queue_limits  net/tipc/link.c:2531
>    tipc_link_create            net/tipc/link.c:520
>    tipc_node_check_dest        net/tipc/node.c:1279
>    tipc_disc_rcv               net/tipc/discover.c:252
>    tipc_rcv                    net/tipc/node.c:2129
>    tipc_udp_recv               net/tipc/udp_media.c:392
> 
> Two independent paths lack the upper bound check:
> 1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)
> 2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)
> 
> Fix both by rejecting MTU values above U16_MAX.
> 
> Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Closes: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com
> Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
> ---
> v4: Add .min check value
> v3: Use nla_policy check to limit MTU max value as suggested by Vadim
> v2: Solved format issue
> Link: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com
> 
>   net/tipc/netlink.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
> index 8336a9664703..811438c44542 100644
> --- a/net/tipc/netlink.c
> +++ b/net/tipc/netlink.c
> @@ -113,12 +113,17 @@ const struct nla_policy tipc_nl_node_policy[TIPC_NLA_NODE_MAX + 1] = {
>   };
>   
>   /* Properties valid for media, bearer and link */
> +static const struct netlink_range_validation tipc_nl_mtu_range = {
> +	.min = TIPC_MIN_BEARER_MTU,
> +	.max = U16_MAX,
> +};
> +
>   const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = {
>   	[TIPC_NLA_PROP_UNSPEC]		= { .type = NLA_UNSPEC },
>   	[TIPC_NLA_PROP_PRIO]		= { .type = NLA_U32 },
>   	[TIPC_NLA_PROP_TOL]		= { .type = NLA_U32 },
>   	[TIPC_NLA_PROP_WIN]		= { .type = NLA_U32 },
> -	[TIPC_NLA_PROP_MTU]		= { .type = NLA_U32 },
> +	[TIPC_NLA_PROP_MTU]		= NLA_POLICY_FULL_RANGE(NLA_U32, &tipc_nl_mtu_range),
>   	[TIPC_NLA_PROP_BROADCAST]	= { .type = NLA_U32 },
>   	[TIPC_NLA_PROP_BROADCAST_RATIO]	= { .type = NLA_U32 }
>   };

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>

RE: [PATCH net v4] tipc: fix u16 MTU truncation in media and bearer MTU validation

[Tung Quang Nguyen]

>Subject: [PATCH net v4] tipc: fix u16 MTU truncation in media and bearer MTU
>validation
>
>Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied
>MTU values but only enforce a minimum bound, not a maximum. When a user
>sets the MTU to a value exceeding U16_MAX (65535), it passes validation but is
>silently truncated when assigned to u16 fields l->mtu and
>l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
>truncate to 0, causing a division by zero in tipc_link_set_queue_limits() which
>computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing values
>(e.g. 65537-131071) produce small incorrect MTU values, resulting in link
>malfunction behaviors.

Yes, this is a bug. I can reproduce the same div-by-zero.

>
>Crash stack (triggered as unprivileged user via user namespace):
>
>  tipc_link_set_queue_limits  net/tipc/link.c:2531
>  tipc_link_create            net/tipc/link.c:520
>  tipc_node_check_dest        net/tipc/node.c:1279
>  tipc_disc_rcv               net/tipc/discover.c:252
>  tipc_rcv                    net/tipc/node.c:2129
>  tipc_udp_recv               net/tipc/udp_media.c:392
>
>Two independent paths lack the upper bound check:
>1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET) 2.
>inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)
>
>Fix both by rejecting MTU values above U16_MAX.
>
>Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU")
>Reported-by: AutonomousCodeSecurity@microsoft.com
>Closes: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-
>CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com
>Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
>---
>v4: Add .min check value
>v3: Use nla_policy check to limit MTU max value as suggested by Vadim
>v2: Solved format issue
>Link: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-
>CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com
>
> net/tipc/netlink.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
>diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c index
>8336a9664703..811438c44542 100644
>--- a/net/tipc/netlink.c
>+++ b/net/tipc/netlink.c
>@@ -113,12 +113,17 @@ const struct nla_policy
>tipc_nl_node_policy[TIPC_NLA_NODE_MAX + 1] = {  };
>
> /* Properties valid for media, bearer and link */
>+static const struct netlink_range_validation tipc_nl_mtu_range = {
>+	.min = TIPC_MIN_BEARER_MTU,

Adding lower threshold checking introduces two issues:
1. Existing function tipc_udp_mtu_bad() can never return "true".
2. Breaking user-space applications looking for error message " Error: MTU value is out-of-range". Look at the error messages before and after your patch:
[Before patch]
node1 ~ # tipc bearer set mtu 15 media udp name UDP0
Error: MTU value is out-of-range.
kernel answers: Invalid argument

[After  patch]
node1 ~ # tipc bearer set mtu 15 media udp name UDP0
kernel answers: Numerical result out of range

>+	.max = U16_MAX,
>+};
>+
> const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = {
> 	[TIPC_NLA_PROP_UNSPEC]		= { .type = NLA_UNSPEC },
> 	[TIPC_NLA_PROP_PRIO]		= { .type = NLA_U32 },
> 	[TIPC_NLA_PROP_TOL]		= { .type = NLA_U32 },
> 	[TIPC_NLA_PROP_WIN]		= { .type = NLA_U32 },
>-	[TIPC_NLA_PROP_MTU]		= { .type = NLA_U32 },
>+	[TIPC_NLA_PROP_MTU]		=
>NLA_POLICY_FULL_RANGE(NLA_U32, &tipc_nl_mtu_range),
> 	[TIPC_NLA_PROP_BROADCAST]	= { .type = NLA_U32 },
> 	[TIPC_NLA_PROP_BROADCAST_RATIO]	= { .type = NLA_U32 }
> };
>--
>2.53.0

Re: [PATCH net v4] tipc: fix u16 MTU truncation in media and bearer MTU validation

[Vadim Fedorenko]

On 10/07/2026 13:57, Tung Quang Nguyen wrote:
>> Subject: [PATCH net v4] tipc: fix u16 MTU truncation in media and bearer MTU
>> validation
>>
>> Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied
>> MTU values but only enforce a minimum bound, not a maximum. When a user
>> sets the MTU to a value exceeding U16_MAX (65535), it passes validation but is
>> silently truncated when assigned to u16 fields l->mtu and
>> l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
>> truncate to 0, causing a division by zero in tipc_link_set_queue_limits() which
>> computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing values
>> (e.g. 65537-131071) produce small incorrect MTU values, resulting in link
>> malfunction behaviors.
> 
> Yes, this is a bug. I can reproduce the same div-by-zero.
> 
>>
>> Crash stack (triggered as unprivileged user via user namespace):
>>
>>   tipc_link_set_queue_limits  net/tipc/link.c:2531
>>   tipc_link_create            net/tipc/link.c:520
>>   tipc_node_check_dest        net/tipc/node.c:1279
>>   tipc_disc_rcv               net/tipc/discover.c:252
>>   tipc_rcv                    net/tipc/node.c:2129
>>   tipc_udp_recv               net/tipc/udp_media.c:392
>>
>> Two independent paths lack the upper bound check:
>> 1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET) 2.
>> inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)
>>
>> Fix both by rejecting MTU values above U16_MAX.
>>
>> Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU")
>> Reported-by: AutonomousCodeSecurity@microsoft.com
>> Closes: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-
>> CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com
>> Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
>> ---
>> v4: Add .min check value
>> v3: Use nla_policy check to limit MTU max value as suggested by Vadim
>> v2: Solved format issue
>> Link: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-
>> CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com
>>
>> net/tipc/netlink.c | 7 ++++++-
>> 1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c index
>> 8336a9664703..811438c44542 100644
>> --- a/net/tipc/netlink.c
>> +++ b/net/tipc/netlink.c
>> @@ -113,12 +113,17 @@ const struct nla_policy
>> tipc_nl_node_policy[TIPC_NLA_NODE_MAX + 1] = {  };
>>
>> /* Properties valid for media, bearer and link */
>> +static const struct netlink_range_validation tipc_nl_mtu_range = {
>> +	.min = TIPC_MIN_BEARER_MTU,
> 
> Adding lower threshold checking introduces two issues:
> 1. Existing function tipc_udp_mtu_bad() can never return "true".

it can. if MTU is in the range [TIPC_MIN_BEARER_MTU, TIPC_MIN_BEARER_MTU 
+ sizeof(iphdr) + sizeof(udphdr)]

> 2. Breaking user-space applications looking for error message " Error: MTU value is out-of-range". Look at the error messages before and after your patch:
> [Before patch]
> node1 ~ # tipc bearer set mtu 15 media udp name UDP0
> Error: MTU value is out-of-range.
> kernel answers: Invalid argument
> 
> [After  patch]
> node1 ~ # tipc bearer set mtu 15 media udp name UDP0
> kernel answers: Numerical result out of range

that's interesting, because this error message belongs to 9p scope...

anyways, we can keep v3 of this patch with .max value set only


> 
>> +	.max = U16_MAX,
>> +};
>> +
>> const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = {
>> 	[TIPC_NLA_PROP_UNSPEC]		= { .type = NLA_UNSPEC },
>> 	[TIPC_NLA_PROP_PRIO]		= { .type = NLA_U32 },
>> 	[TIPC_NLA_PROP_TOL]		= { .type = NLA_U32 },
>> 	[TIPC_NLA_PROP_WIN]		= { .type = NLA_U32 },
>> -	[TIPC_NLA_PROP_MTU]		= { .type = NLA_U32 },
>> +	[TIPC_NLA_PROP_MTU]		=
>> NLA_POLICY_FULL_RANGE(NLA_U32, &tipc_nl_mtu_range),
>> 	[TIPC_NLA_PROP_BROADCAST]	= { .type = NLA_U32 },
>> 	[TIPC_NLA_PROP_BROADCAST_RATIO]	= { .type = NLA_U32 }
>> };
>> --
>> 2.53.0
> 

RE: [PATCH net v4] tipc: fix u16 MTU truncation in media and bearer MTU validation

[Tung Quang Nguyen]

>Subject: Re: [PATCH net v4] tipc: fix u16 MTU truncation in media and bearer
>MTU validation
>
>On 10/07/2026 13:57, Tung Quang Nguyen wrote:
>>> Subject: [PATCH net v4] tipc: fix u16 MTU truncation in media and
>>> bearer MTU validation
>>>
>>> Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied
>>> MTU values but only enforce a minimum bound, not a maximum. When a
>>> user sets the MTU to a value exceeding U16_MAX (65535), it passes
>>> validation but is silently truncated when assigned to u16 fields
>>> l->mtu and
>>> l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
>>> truncate to 0, causing a division by zero in
>>> tipc_link_set_queue_limits() which computes TIPC_MAX_PUBL / (l->mtu /
>>> ITEM_SIZE). Other overflowing values (e.g. 65537-131071) produce
>>> small incorrect MTU values, resulting in link malfunction behaviors.
>>
>> Yes, this is a bug. I can reproduce the same div-by-zero.
>>
>>>
>>> Crash stack (triggered as unprivileged user via user namespace):
>>>
>>>   tipc_link_set_queue_limits  net/tipc/link.c:2531
>>>   tipc_link_create            net/tipc/link.c:520
>>>   tipc_node_check_dest        net/tipc/node.c:1279
>>>   tipc_disc_rcv               net/tipc/discover.c:252
>>>   tipc_rcv                    net/tipc/node.c:2129
>>>   tipc_udp_recv               net/tipc/udp_media.c:392
>>>
>>> Two independent paths lack the upper bound check:
>>> 1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)
>2.
>>> inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)
>>>
>>> Fix both by rejecting MTU values above U16_MAX.
>>>
>>> Fixes: 901271e0403a ("tipc: implement configuration of UDP media
>>> MTU")
>>> Reported-by: AutonomousCodeSecurity@microsoft.com
>>> Closes: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-
>>> CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com
>>> Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
>>> ---
>>> v4: Add .min check value
>>> v3: Use nla_policy check to limit MTU max value as suggested by Vadim
>>> v2: Solved format issue
>>> Link: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-
>>> CKjGXsK6_WDv0=kbYRcC8-noo+amnA@mail.gmail.com
>>>
>>> net/tipc/netlink.c | 7 ++++++-
>>> 1 file changed, 6 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c index
>>> 8336a9664703..811438c44542 100644
>>> --- a/net/tipc/netlink.c
>>> +++ b/net/tipc/netlink.c
>>> @@ -113,12 +113,17 @@ const struct nla_policy
>>> tipc_nl_node_policy[TIPC_NLA_NODE_MAX + 1] = {  };
>>>
>>> /* Properties valid for media, bearer and link */
>>> +static const struct netlink_range_validation tipc_nl_mtu_range = {
>>> +	.min = TIPC_MIN_BEARER_MTU,
>>
>> Adding lower threshold checking introduces two issues:
>> 1. Existing function tipc_udp_mtu_bad() can never return "true".
>
>it can. if MTU is in the range [TIPC_MIN_BEARER_MTU,
>TIPC_MIN_BEARER_MTU
>+ sizeof(iphdr) + sizeof(udphdr)]

The context I was talking about is error path (mtu < min) as shown in examples. This makes adding .min check redundant.
                
>
>> 2. Breaking user-space applications looking for error message " Error: MTU
>value is out-of-range". Look at the error messages before and after your patch:
>> [Before patch]
>> node1 ~ # tipc bearer set mtu 15 media udp name UDP0
>> Error: MTU value is out-of-range.
>> kernel answers: Invalid argument
>>
>> [After  patch]
>> node1 ~ # tipc bearer set mtu 15 media udp name UDP0 kernel answers:
>> Numerical result out of range
>
>that's interesting, because this error message belongs to 9p scope...
>
>anyways, we can keep v3 of this patch with .max value set only
>
>
>>
>>> +	.max = U16_MAX,
>>> +};
>>> +
>>> const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = {
>>> 	[TIPC_NLA_PROP_UNSPEC]		= { .type = NLA_UNSPEC },
>>> 	[TIPC_NLA_PROP_PRIO]		= { .type = NLA_U32 },
>>> 	[TIPC_NLA_PROP_TOL]		= { .type = NLA_U32 },
>>> 	[TIPC_NLA_PROP_WIN]		= { .type = NLA_U32 },
>>> -	[TIPC_NLA_PROP_MTU]		= { .type = NLA_U32 },
>>> +	[TIPC_NLA_PROP_MTU]		=
>>> NLA_POLICY_FULL_RANGE(NLA_U32, &tipc_nl_mtu_range),
>>> 	[TIPC_NLA_PROP_BROADCAST]	= { .type = NLA_U32 },
>>> 	[TIPC_NLA_PROP_BROADCAST_RATIO]	= { .type = NLA_U32 }
>>> };
>>> --
>>> 2.53.0
>>

Re: [PATCH net v4] tipc: fix u16 MTU truncation in media and bearer MTU validation

[Andrew Lunn]

On Thu, Jul 09, 2026 at 05:16:49PM -0400, Cen Zhang (Microsoft) wrote:
> Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied
> MTU values but only enforce a minimum bound, not a maximum.

I don't know the tipc code at all..

Can this be piped through netif_set_mtu()? It will call
dev_validate_mtu() which will validate the MTU against dev->min_mtu
and dev->max_mtu.

    Andrew