[PATCH] tipc: limit the memory pinned by incomplete fragment chains

[PATCH] tipc: limit the memory pinned by incomplete fragment chains

[Chuyf26]

Fragment chains are reassembled per link and kept in memory until the
last fragment arrives.  There is no limit on how much memory one
in-flight chain may pin: a peer can send first and middle fragments
without ever sending the last one, and every received packet resets
the link silence counter, so the link never times out and the chains
are never freed.  Repeated with many chains this grows kernel memory
unboundedly.

The path is: fragments arriving on a bearer are delivered by tipc_rcv()
to the link, tipc_link_input() recognizes MSG_FRAGMENTER messages and
appends them to the per-link reassembly queue through tipc_buf_append(),
which charges the accumulated size against the head buffer.  The only
symptom is kernel memory growing until the system runs out of it.

A legitimate reassembled message can never exceed MAX_MSG_SIZE, so
drop a chain once its accumulated size exceeds twice that value.

Fixes: 13e9b9972fa0 ("tipc: make tipc_buf_append() more robust")
Reported-by: Abaci <abaci@linux.alibaba.com>
Assisted-by: abaci:qwen3.8-max
Signed-off-by: Chuyf26 <Chuyf26@linux.alibaba.com>
---
 net/tipc/link.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 6c6d8546c578..adbfdc5058cb 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1340,7 +1340,22 @@ static int tipc_link_input(struct tipc_link *l, struct sk_buff *skb,
 		if (tipc_buf_append(reasm_skb, &skb)) {
 			l->stats.recv_fragmented++;
 			tipc_data_input(l, skb, inputq);
-		} else if (!*reasm_skb && !link_is_bc_rcvlink(l)) {
+		} else if (*reasm_skb) {
+			/* A legitimate reassembled message can never exceed
+			 * MAX_MSG_SIZE. Limit the memory one incomplete
+			 * fragment chain can pin, otherwise a peer can grow
+			 * kernel memory unboundedly by streaming fragment
+			 * chains that never complete: received traffic also
+			 * resets the link silence counter, so the link never
+			 * times out and the chains are never freed.
+			 */
+			if ((*reasm_skb)->truesize > 2 * MAX_MSG_SIZE) {
+				pr_warn_ratelimited("Fragment chain larger than %u bytes, dropping\n",
+						    2 * MAX_MSG_SIZE);
+				kfree_skb(*reasm_skb);
+				*reasm_skb = NULL;
+			}
+		} else if (!link_is_bc_rcvlink(l)) {
 			pr_warn_ratelimited("Unable to build fragment list\n");
 			return tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
 		}
-- 
2.43.5

Re: [PATCH] tipc: limit the memory pinned by incomplete fragment chains

[Jakub Kicinski]

On Tue, 18 Aug 2026 16:26:34 +0000 (UTC) Chuyf26 wrote:
> Subject: [PATCH] tipc: limit the memory pinned by incomplete fragment chains

Please don't submit any more patches until all patches you posted to
netdev@ were reviewed.