Re: [PATCH v2 net] inet: frags: limit the truesize of a reassembly queue

[Wang Zhan <wang.zhan@smartx.com>]

On Fri, 30 Oct 2026 09:12:25 +0100 Eric Dumazet wrote:
> The truesize of fragments in a reassembly queue is only bounded by
> the per netns ipfrag_high_thresh sysctl, which has no upper limit.
>
> inet_frag_reasm_finish() sums the truesize of all fragments in an int.
> If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc
> adjustment of the socket owning the reassembled skb can cancel its own
> reference, leading to a use-after-free of this socket.
>
> This can be triggered from an unprivileged user/network namespace,
> raising ipfrag_high_thresh and using padded TUN packets, which keep
> a large truesize after being trimmed by ip_rcv_core().

Another data point: the described trigger also requires ip_defrag() to run
before skb_orphan(), e.g. via nf_ct_bridge_pre().  In plain TUN local
delivery, ip_rcv_core() orphans the skb first, so inet_frag_reasm_finish()
sees sk == NULL.

> Track the sum of the truesize of fragments in each queue, and refuse
> a fragment that would make it bigger than INT_MAX / 2. Callers kill
> the queue on this error. This bound is far above the needs of
> legitimate traffic.
>
> Fixes: 18685451fc4e ("inet: inet_defrag: prevent sk release while still in use")
> Cc: stable@vger.kernel.org
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Cc: Florian Westphal <fw@strlen.de>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Tested on QEMU TCG x86_64:
Padded fragments traversed tun_get_user() and nf_ct_bridge_pre().

Before this patch:

  [   62.400852] ------------[ cut here ]------------
  [   62.401690] refcount_t: saturated; leaking memory.
  [   62.402231] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x74/0xe0, CPU#0: init/1
  ...
  [   62.416741] Call Trace:
  [   62.417754]  inet_frag_reasm_finish+0x734/0x8c0
  [   62.419460]  ip_defrag+0x149c/0x25d0
  [   62.420502]  nf_ct_bridge_pre+0x95c/0x12a0
  [   62.423684]  br_handle_frame+0x6d9/0xf10
  [   62.425568]  __netif_receive_skb_core.constprop.0+0x576/0x2bd0
  ...
  [   62.430759]  netif_receive_skb+0x7b/0x3c0
  [   62.431822]  tun_get_user+0x1a1e/0x3a90
  [   62.435183]  tun_chr_write_iter+0x138/0x260
  ...
  [   62.455272] ------------[ cut here ]------------
  [   62.455348] refcount_t: underflow; use-after-free.
  [   62.455376] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x9a/0xe0, CPU#0: init/1

After this patch, inet_frag_queue_insert() returns IPFRAG_TOOBIG:

  # tracer: nop
  #
  # entries-in-buffer/entries-written: 8193/8193   #P:1
  ...
            init-1 [000] b..1. 44.803126: frag_ret: (ip_defrag <- inet_frag_queue_insert) ret=4
            init-1 [000] b..1. 44.804161: <stack trace>
   ...
   => ip_defrag
   => nf_ct_bridge_pre
   => br_handle_frame
   => __netif_receive_skb_core.constprop.0
   => __netif_receive_skb_one_core
   => netif_receive_skb
   => tun_get_user
   => tun_chr_write_iter

No refcount warning was observed with v2.

Tested-by: Wang Zhan <wang.zhan@smartx.com>