Re: [PATCH net v2 5/5] net: restrict message_cost and message_burst to non-negative values

[Joel Granados <joel.granados@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 6427 bytes --]

On Tue, Oct 27, 2026 at 06:45:33PM +0800, Jiayuan Chen wrote:
> net.core.message_cost and net.core.message_burst feed the interval and
> burst of net_ratelimit_state, but neither rejects negative values:
> message_burst uses plain proc_dointvec, and message_cost uses
> proc_dointvec_jiffies, which happily stores -1 second as -HZ jiffies.
> 
> Since commit a940d145cc38 ("ratelimit: Warn if ->interval or ->burst are
> negative"), ___ratelimit() splats on such values, so the next
> net_ratelimit() caller warns, e.g. a martian source log:
> 
>   Negative interval (-250) or burst (10): Uninitialized ratelimit_state structure?
>   WARNING: lib/ratelimit.c:43 at ___ratelimit+0x56e/0x960, CPU#1: ping/3218
>   RIP: 0010:___ratelimit+0x578/0x960
>   Call Trace:
>    <IRQ>
>    net_ratelimit+0x1c/0x30
>    ip_handle_martian_source+0x1bb/0x340
>    ip_route_input_slow+0x1057/0x3650
>    ip_route_input_noref+0x104/0x260
>    arp_process+0x109b/0x2510
>    arp_rcv+0x381/0x460
>    __netif_receive_skb_one_core+0x173/0x1c0
>    __netif_receive_skb+0x21/0x150
>    process_backlog+0x37e/0x1200
>    __napi_poll.constprop.0+0xa5/0x5e0
>    net_rx_action+0x4c0/0xf70
>    handle_softirqs+0x204/0x9b0
>    __do_softirq+0x10/0x18
>    do_softirq.part.0+0x49/0xd0
>    </IRQ>
> 
> Negative values never meant anything here: 0 already expresses both
> "no limit" (interval) and "suppress everything" (burst).
> 
> Reject them at write time. message_burst can simply use
> proc_dointvec_minmax with extra1 = 0. proc_dointvec_jiffies has no
> minmax variant, so add proc_dointvec_jiffies_minmax(), mirroring
> proc_dointvec_ms_jiffies_minmax(), and use it for message_cost with
> extra1 = 0. Note that like the ms variant, extra1/extra2 are compared
> against the converted jiffies value.
> 
> Fixes: a940d145cc38 ("ratelimit: Warn if ->interval or ->burst are negative")
> Cc: stable@vger.kernel.org
> Suggested-by: Joel Granados <joel.granados@kernel.org>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
>  include/linux/jiffies.h    |  2 ++
>  kernel/time/jiffies.c      | 40 ++++++++++++++++++++++++++++++++++++++
>  net/core/sysctl_net_core.c |  6 ++++--
>  3 files changed, 46 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
> index bbd57061802cd..de12920f8e94b 100644
> --- a/include/linux/jiffies.h
> +++ b/include/linux/jiffies.h
> @@ -646,6 +646,8 @@ extern unsigned long nsecs_to_jiffies(u64 n);
>  struct ctl_table;
>  int proc_dointvec_jiffies(const struct ctl_table *table, int dir, void *buffer,
>  			  size_t *lenp, loff_t *ppos);
> +int proc_dointvec_jiffies_minmax(const struct ctl_table *table, int dir,
> +				 void *buffer, size_t *lenp, loff_t *ppos);
>  int proc_dointvec_ms_jiffies_minmax(const struct ctl_table *table, int dir,
>  				    void *buffer, size_t *lenp, loff_t *ppos);
>  int proc_dointvec_userhz_jiffies(const struct ctl_table *table, int dir,
> diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
> index 9b3487d40cd6a..22a70caa58bc1 100644
> --- a/kernel/time/jiffies.c
> +++ b/kernel/time/jiffies.c
> @@ -165,6 +165,14 @@ static int do_proc_int_conv_jiffies(bool *negp, ulong *u_ptr, int *k_ptr,
>  			     sysctl_u2k_int_conv_hz, sysctl_k2u_int_conv_hz);
>  }
>  
> +static int do_proc_int_conv_jiffies_minmax(bool *negp, ulong *u_ptr,
> +					   int *k_ptr, int dir,
> +					   const struct ctl_table *tbl)
> +{
> +	return proc_int_conv(negp, u_ptr, k_ptr, dir, tbl, true,
> +			     sysctl_u2k_int_conv_hz, sysctl_k2u_int_conv_hz);
> +}
> +
>  static int do_proc_int_conv_userhz_jiffies(bool *negp, ulong *u_ptr,
>  					   int *k_ptr, int dir,
>  					   const struct ctl_table *tbl)
> @@ -213,6 +221,13 @@ static int do_proc_int_conv_jiffies(bool *negp, ulong *u_ptr, int *k_ptr,
>  	return -ENOSYS;
>  }
>  
> +static int do_proc_int_conv_jiffies_minmax(bool *negp, ulong *u_ptr,
> +					   int *k_ptr, int dir,
> +					   const struct ctl_table *tbl)
> +{
> +	return -ENOSYS;
> +}
> +
>  static int do_proc_int_conv_userhz_jiffies(bool *negp, ulong *u_ptr,
>  					   int *k_ptr, int dir,
>  					   const struct ctl_table *tbl)
> @@ -263,6 +278,31 @@ int proc_dointvec_jiffies(const struct ctl_table *table, int dir,
>  }
>  EXPORT_SYMBOL(proc_dointvec_jiffies);
>  
> +/**
> + * proc_dointvec_jiffies_minmax - read a vector of integers as seconds with min/max values
> + * @table: the sysctl table
> + * @dir: %TRUE if this is a write to the sysctl file
> + * @buffer: the user buffer
> + * @lenp: the size of the user buffer
> + * @ppos: file position
> + *
> + * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
> + * values from/to the user buffer, treated as an ASCII string.
> + * The values read are assumed to be in seconds, and are converted into
> + * jiffies. The converted values are checked against the optional
> + * table->extra1 (min) and table->extra2 (max) bounds, in jiffies;
> + * a value outside the range is rejected with -EINVAL.
> + *
> + * Returns 0 on success.
> + */
> +int proc_dointvec_jiffies_minmax(const struct ctl_table *table, int dir,
> +				 void *buffer, size_t *lenp, loff_t *ppos)
> +{
> +	return proc_dointvec_conv(table, dir, buffer, lenp, ppos,
> +				  do_proc_int_conv_jiffies_minmax);
> +}
> +EXPORT_SYMBOL(proc_dointvec_jiffies_minmax);
> +
>  /**
>   * proc_dointvec_userhz_jiffies - read a vector of integers as 1/USER_HZ seconds
>   * @table: the sysctl table
> diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
> index 473c162736d69..9226b96f2e89b 100644
> --- a/net/core/sysctl_net_core.c
> +++ b/net/core/sysctl_net_core.c
> @@ -544,14 +544,16 @@ static struct ctl_table net_core_table[] = {
>  		.data		= &net_ratelimit_state.interval,
>  		.maxlen		= sizeof(int),
>  		.mode		= 0644,
> -		.proc_handler	= proc_dointvec_jiffies,
> +		.proc_handler	= proc_dointvec_jiffies_minmax,
> +		.extra1		= SYSCTL_ZERO,
>  	},
>  	{
>  		.procname	= "message_burst",
>  		.data		= &net_ratelimit_state.burst,
>  		.maxlen		= sizeof(int),
>  		.mode		= 0644,
> -		.proc_handler	= proc_dointvec,
> +		.proc_handler	= proc_dointvec_minmax,
> +		.extra1		= SYSCTL_ZERO,
>  	},
>  #ifdef CONFIG_RPS
>  	{
> -- 
> 2.43.0
> 

This LGTM
Reviewed-by: Joel Granados <joel.granados@kernel.org>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]