[PATCH net] net: sock: prevent integer overflow in sock_reserve_memory()

[PATCH net] net: sock: prevent integer overflow in sock_reserve_memory()

[Xiang Mei (Microsoft)]

sock_reserve_memory() adds 'pages << PAGE_SHIFT' (a plain int) to the int
sk->sk_forward_alloc. An unprivileged SO_RESERVE_MEM caller can drive the
accumulating counter past INT_MAX and wrap it negative, either in one
INT_MAX request (0x80000000) or across several smaller ones.
The corrupted sk_forward_alloc then trips WARN_ON_ONCE() in
inet_sock_destruct() on close (a panic under panic_on_warn/oops=panic).

Bound the field that overflows: compute the new sk_forward_alloc in u64 and
reject with -EINVAL anything exceeding INT_MAX.

  Kernel panic - not syncing: kernel: panic_on_warn set ...
   __warn (kernel/panic.c:1054)
   ...
  RIP: 0010:inet_sock_destruct (net/ipv4/af_inet.c:161)
   __sk_destruct (net/core/sock.c:2357)
   inet_release (net/ipv4/af_inet.c:442)
   sock_close (net/socket.c:1501)
   __fput (fs/file_table.c:512)
   __x64_sys_close (fs/open.c:1511)
   do_syscall_64 (arch/x86/entry/syscall_64.c:94)

Fixes: 2bb2f5fb21b0 ("net: add new socket option SO_RESERVE_MEM")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
 net/core/sock.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/sock.c b/net/core/sock.c
index 8a59bfaa8096..2ba95bead1ae 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1042,6 +1042,9 @@ static int sock_reserve_memory(struct sock *sk, int bytes)
 
 	pages = sk_mem_pages(bytes);
 
+	if ((u64)sk->sk_forward_alloc + ((u64)pages << PAGE_SHIFT) > INT_MAX)
+		return -EINVAL;
+
 	/* pre-charge to memcg */
 	charged = mem_cgroup_sk_charge(sk, pages,
 				       GFP_KERNEL | __GFP_RETRY_MAYFAIL);
-- 
2.43.0

Re: [PATCH net] net: sock: prevent integer overflow in sock_reserve_memory()

[Kuniyuki Iwashima]

On Fri, Jul 10, 2026 at 6:00 PM Xiang Mei (Microsoft) <xmei5@asu.edu> wrote:
>
> sock_reserve_memory() adds 'pages << PAGE_SHIFT' (a plain int) to the int
> sk->sk_forward_alloc. An unprivileged SO_RESERVE_MEM caller can drive the
> accumulating counter past INT_MAX and wrap it negative, either in one
> INT_MAX request (0x80000000) or across several smaller ones.
> The corrupted sk_forward_alloc then trips WARN_ON_ONCE() in
> inet_sock_destruct() on close (a panic under panic_on_warn/oops=panic).
>
> Bound the field that overflows: compute the new sk_forward_alloc in u64 and
> reject with -EINVAL anything exceeding INT_MAX.
>
>   Kernel panic - not syncing: kernel: panic_on_warn set ...
>    __warn (kernel/panic.c:1054)
>    ...
>   RIP: 0010:inet_sock_destruct (net/ipv4/af_inet.c:161)
>    __sk_destruct (net/core/sock.c:2357)
>    inet_release (net/ipv4/af_inet.c:442)
>    sock_close (net/socket.c:1501)
>    __fput (fs/file_table.c:512)
>    __x64_sys_close (fs/open.c:1511)
>    do_syscall_64 (arch/x86/entry/syscall_64.c:94)
>
> Fixes: 2bb2f5fb21b0 ("net: add new socket option SO_RESERVE_MEM")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>