Re: [PATCH v2 net] inet: frags: bound the wmem charge of the socket completing a reassembly

[Ido Schimmel <idosch@nvidia.com>]

On Wed, Nov 04, 2026 at 01:29:27PM +0100, Eric Dumazet wrote:
> When a socket owned fragment completes a reassembly queue,
> inet_frag_reasm_prepare() and inet_frag_reasm_finish() charge the
> truesize of all other fragments to its sk_wmem_alloc. These fragments
> were orphaned when queued, and might have been sent by someone else,
> for instance padded TUN packets.
> 
> Commit 3ae20e4697eb ("inet: frags: limit the truesize of a reassembly
> queue") bounds this charge to INT_MAX / 2 per queue, but a socket can
> complete several queues while the reassembled skbs are still alive,
> for instance held in a qdisc. sk_wmem_alloc can then go past INT_MAX,
> refcount_add() saturates it with a WARN, and the socket is leaked.
> 
> This is reachable from an unprivileged user/network namespace, by
> raising ipfrag_high_thresh.
> 
> Refuse the reassembly if the charge would push sk_wmem_alloc above
> 2 * sk_sndbuf, the bound ip_append_data() uses, plus 4MB of slack for
> fragments inflated by a refragmentation with a small MTU, and never
> above INT_MAX / 2. The cap matters for tun sockets, which use
> sk_sndbuf = INT_MAX, and whose skbs are still owned when act_ct or
> openvswitch reassemble them at ingress.
> 
> Several queues can complete at the same time on different cpus for
> the same socket, so the charge is reserved with a cmpxchg() loop in
> inet_frag_reasm_prepare(), before it modifies the queue, and settled
> in inet_frag_reasm_finish(). Move the size checks of ip_frag_reasm(),
> ip6_frag_reasm() and nf_ct_frag6_reasm() before
> inet_frag_reasm_prepare(), using the first fragment which becomes the
> head, so that a successful inet_frag_reasm_prepare() is always followed
> by inet_frag_reasm_finish(). All callers already kill the queue when
> inet_frag_reasm_prepare() returns NULL.
> 
> Found by code inspection (AI review), not reproduced.
> 
> Fixes: 18685451fc4e ("inet: inet_defrag: prevent sk release while still in use")
> Reported-by: Paolo Abeni <pabeni@redhat.com>
> Closes: https://lore.kernel.org/netdev/24feda7d-ae49-45af-9596-2cc5f149f28e@redhat.com/
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>