[PATCH v2 net] inet: frags: limit the truesize of a reassembly queue

[PATCH v2 net] inet: frags: limit the truesize of a reassembly queue

[Eric Dumazet]

The truesize of fragments in a reassembly queue is only bounded by
the per netns ipfrag_high_thresh sysctl, which has no upper limit.

inet_frag_reasm_finish() sums the truesize of all fragments in an int.
If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc
adjustment of the socket owning the reassembled skb can cancel its own
reference, leading to a use-after-free of this socket.

This can be triggered from an unprivileged user/network namespace,
raising ipfrag_high_thresh and using padded TUN packets, which keep
a large truesize after being trimmed by ip_rcv_core().

Track the sum of the truesize of fragments in each queue, and refuse
a fragment that would make it bigger than INT_MAX / 2. Callers kill
the queue on this error. This bound is far above the needs of
legitimate traffic.

Fixes: 18685451fc4e ("inet: inet_defrag: prevent sk release while still in use")
Cc: stable@vger.kernel.org
Reported-by: Kyle Zeng <kylebot@openai.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
v2: reset q->truesize in inet_frag_queue_flush(), as ip_frag_reinit()
    can keep a queue alive after flushing its fragments (Wang Zhan, Sashiko).
    Document @truesize in struct inet_frag_queue kernel-doc (Sashiko).
v1: https://lore.kernel.org/netdev/20261028182934.2236310-1-edumazet@kernel.org/

Kyle Zeng provided a more complicated patch, I wrote something much simpler.
LLM was used to discover the bug, build a repro, and test the fix.
---
 include/net/inet_frag.h  | 9 +++++++++
 net/ipv4/inet_fragment.c | 5 +++++
 2 files changed, 14 insertions(+)

diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
index b02d2472b003ec6e7b8e391d56115e8f0578ca61..c1fb419a9cf03a346edd0424ca0ba5b06b6a20f0 100644
--- a/include/net/inet_frag.h
+++ b/include/net/inet_frag.h
@@ -79,6 +79,7 @@ struct frag_v6_compare_key {
  * @tstamp_type: stamp has a mono delivery time (EDT)
  * @flags: fragment queue flags
  * @max_size: maximum received fragment size
+ * @truesize: sum of the truesize of queued fragments
  * @fqdir: pointer to struct fqdir
  * @rcu: rcu head for freeing deferall
  */
@@ -100,6 +101,7 @@ struct inet_frag_queue {
 	u8			tstamp_type;
 	__u8			flags;
 	u16			max_size;
+	unsigned int		truesize;
 	struct fqdir		*fqdir;
 	struct rcu_head		rcu;
 };
@@ -172,6 +174,13 @@ extern const u8 ip_frag_ecn_table[16];
 #define IPFRAG_DUP	1
 #define IPFRAG_OVERLAP	2
 #define IPFRAG_MIXED_SECPATH	3
+#define IPFRAG_TOOBIG	4
+
+/* Max sum of the truesize of fragments in a queue. This keeps the sums
+ * done in inet_frag_reasm_prepare() and inet_frag_reasm_finish() well
+ * below INT_MAX. Legitimate traffic stays far below this limit.
+ */
+#define INET_FRAG_MAX_TRUESIZE	(INT_MAX / 2)
 int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
 			   int offset, int end);
 void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index c18da91c1f031ee0b97f9e072837d053380da2f2..0b8d22ffafca69b2bccd98eca3d4bda93ebb816a 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -336,6 +336,7 @@ void inet_frag_queue_flush(struct inet_frag_queue *q,
 	q->rb_fragments = RB_ROOT;
 	q->fragments_tail = NULL;
 	q->last_run_head = NULL;
+	q->truesize = 0;
 }
 EXPORT_SYMBOL(inet_frag_queue_flush);
 
@@ -446,6 +447,9 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
 	if (last && !secpath_equal(last, skb))
 		return IPFRAG_MIXED_SECPATH;
 
+	if (skb->truesize > INET_FRAG_MAX_TRUESIZE - q->truesize)
+		return IPFRAG_TOOBIG;
+
 	/* An IP fragment is never a GSO packet, but an untrusted source
 	 * (virtio_net_hdr) may have attached GSO metadata to it. Do not let
 	 * that reach the reassembled skb, whose head keeps the first
@@ -510,6 +514,7 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
 	if (offset)
 		nf_reset_ct(skb);
 
+	q->truesize += skb->truesize;
 	return IPFRAG_OK;
 }
 EXPORT_SYMBOL(inet_frag_queue_insert);
-- 
2.53.0

Re: [PATCH v2 net] inet: frags: limit the truesize of a reassembly queue

[Ido Schimmel]

On Fri, Oct 30, 2026 at 09:12:25AM +0100, Eric Dumazet wrote:
> The truesize of fragments in a reassembly queue is only bounded by
> the per netns ipfrag_high_thresh sysctl, which has no upper limit.
> 
> inet_frag_reasm_finish() sums the truesize of all fragments in an int.
> If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc
> adjustment of the socket owning the reassembled skb can cancel its own
> reference, leading to a use-after-free of this socket.
> 
> This can be triggered from an unprivileged user/network namespace,
> raising ipfrag_high_thresh and using padded TUN packets, which keep
> a large truesize after being trimmed by ip_rcv_core().
> 
> Track the sum of the truesize of fragments in each queue, and refuse
> a fragment that would make it bigger than INT_MAX / 2. Callers kill
> the queue on this error. This bound is far above the needs of
> legitimate traffic.
> 
> Fixes: 18685451fc4e ("inet: inet_defrag: prevent sk release while still in use")
> Cc: stable@vger.kernel.org
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Cc: Florian Westphal <fw@strlen.de>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Re: [PATCH v2 net] inet: frags: limit the truesize of a reassembly queue

[Paolo Abeni]

On 10/30/26 09:12, Eric Dumazet wrote:
> The truesize of fragments in a reassembly queue is only bounded by
> the per netns ipfrag_high_thresh sysctl, which has no upper limit.
> 
> inet_frag_reasm_finish() sums the truesize of all fragments in an int.
> If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc
> adjustment of the socket owning the reassembled skb can cancel its own
> reference, leading to a use-after-free of this socket.
> 
> This can be triggered from an unprivileged user/network namespace,
> raising ipfrag_high_thresh and using padded TUN packets, which keep
> a large truesize after being trimmed by ip_rcv_core().

Clasiko infers a similar scenario is still reachable using multiple
concurrent frag queues:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261030081225.2575462-1-edumazet@kernel.org

I'm unsure if that should be dealt with separately?!?

Thanks,

Paolo

Re: [PATCH v2 net] inet: frags: limit the truesize of a reassembly queue

[Jiayuan Chen]

On 10/30/26 4:12 PM, Eric Dumazet wrote:
> The truesize of fragments in a reassembly queue is only bounded by
> the per netns ipfrag_high_thresh sysctl, which has no upper limit.
>
> inet_frag_reasm_finish() sums the truesize of all fragments in an int.
> If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc
> adjustment of the socket owning the reassembled skb can cancel its own
> reference, leading to a use-after-free of this socket.
>
> This can be triggered from an unprivileged user/network namespace,
> raising ipfrag_high_thresh and using padded TUN packets, which keep
> a large truesize after being trimmed by ip_rcv_core().
>
> Track the sum of the truesize of fragments in each queue, and refuse
> a fragment that would make it bigger than INT_MAX / 2. Callers kill
> the queue on this error. This bound is far above the needs of
> legitimate traffic.
>
> Fixes: 18685451fc4e ("inet: inet_defrag: prevent sk release while still in use")
> Cc: stable@vger.kernel.org
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Cc: Florian Westphal <fw@strlen.de>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>



Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Re: [PATCH v2 net] inet: frags: limit the truesize of a reassembly queue

[Eric Dumazet]

Le lun. 2 nov. 2026 à 16:04, Paolo Abeni <pabeni@redhat.com> a écrit :
>
> On 10/30/26 09:12, Eric Dumazet wrote:
> > The truesize of fragments in a reassembly queue is only bounded by
> > the per netns ipfrag_high_thresh sysctl, which has no upper limit.
> >
> > inet_frag_reasm_finish() sums the truesize of all fragments in an int.
> > If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc
> > adjustment of the socket owning the reassembled skb can cancel its own
> > reference, leading to a use-after-free of this socket.
> >
> > This can be triggered from an unprivileged user/network namespace,
> > raising ipfrag_high_thresh and using padded TUN packets, which keep
> > a large truesize after being trimmed by ip_rcv_core().
>
> Clasiko infers a similar scenario is still reachable using multiple
> concurrent frag queues:
>
> https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261030081225.2575462-1-edumazet@kernel.org
>
> I'm unsure if that should be dealt with separately?!?

Sashiko is right that this is still reachable, but it's a pre-existing
issue and the consequence differs:
the charge per reassembly is now positive and below INT_MAX/2, so
__refcount_add() saturates (WARN + leaked socket)
instead of wrapping, and the UAF is gone.

I'd like to keep v2 as the minimal stable fix and send a separate
patch bounding the sk_wmem_alloc
charge in inet_frag_reasm_prepare() against the socket's sndbuf.

Thanks.

Re: [PATCH v2 net] inet: frags: limit the truesize of a reassembly queue

[Wang Zhan]

On Fri, 30 Oct 2026 09:12:25 +0100 Eric Dumazet wrote:
> The truesize of fragments in a reassembly queue is only bounded by
> the per netns ipfrag_high_thresh sysctl, which has no upper limit.
>
> inet_frag_reasm_finish() sums the truesize of all fragments in an int.
> If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc
> adjustment of the socket owning the reassembled skb can cancel its own
> reference, leading to a use-after-free of this socket.
>
> This can be triggered from an unprivileged user/network namespace,
> raising ipfrag_high_thresh and using padded TUN packets, which keep
> a large truesize after being trimmed by ip_rcv_core().

Another data point: the described trigger also requires ip_defrag() to run
before skb_orphan(), e.g. via nf_ct_bridge_pre().  In plain TUN local
delivery, ip_rcv_core() orphans the skb first, so inet_frag_reasm_finish()
sees sk == NULL.

> Track the sum of the truesize of fragments in each queue, and refuse
> a fragment that would make it bigger than INT_MAX / 2. Callers kill
> the queue on this error. This bound is far above the needs of
> legitimate traffic.
>
> Fixes: 18685451fc4e ("inet: inet_defrag: prevent sk release while still in use")
> Cc: stable@vger.kernel.org
> Reported-by: Kyle Zeng <kylebot@openai.com>
> Cc: Florian Westphal <fw@strlen.de>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Tested on QEMU TCG x86_64:
Padded fragments traversed tun_get_user() and nf_ct_bridge_pre().

Before this patch:

  [   62.400852] ------------[ cut here ]------------
  [   62.401690] refcount_t: saturated; leaking memory.
  [   62.402231] WARNING: lib/refcount.c:22 at refcount_warn_saturate+0x74/0xe0, CPU#0: init/1
  ...
  [   62.416741] Call Trace:
  [   62.417754]  inet_frag_reasm_finish+0x734/0x8c0
  [   62.419460]  ip_defrag+0x149c/0x25d0
  [   62.420502]  nf_ct_bridge_pre+0x95c/0x12a0
  [   62.423684]  br_handle_frame+0x6d9/0xf10
  [   62.425568]  __netif_receive_skb_core.constprop.0+0x576/0x2bd0
  ...
  [   62.430759]  netif_receive_skb+0x7b/0x3c0
  [   62.431822]  tun_get_user+0x1a1e/0x3a90
  [   62.435183]  tun_chr_write_iter+0x138/0x260
  ...
  [   62.455272] ------------[ cut here ]------------
  [   62.455348] refcount_t: underflow; use-after-free.
  [   62.455376] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x9a/0xe0, CPU#0: init/1

After this patch, inet_frag_queue_insert() returns IPFRAG_TOOBIG:

  # tracer: nop
  #
  # entries-in-buffer/entries-written: 8193/8193   #P:1
  ...
            init-1 [000] b..1. 44.803126: frag_ret: (ip_defrag <- inet_frag_queue_insert) ret=4
            init-1 [000] b..1. 44.804161: <stack trace>
   ...
   => ip_defrag
   => nf_ct_bridge_pre
   => br_handle_frame
   => __netif_receive_skb_core.constprop.0
   => __netif_receive_skb_one_core
   => netif_receive_skb
   => tun_get_user
   => tun_chr_write_iter

No refcount warning was observed with v2.

Tested-by: Wang Zhan <wang.zhan@smartx.com>

Re: [PATCH v2 net] inet: frags: limit the truesize of a reassembly queue

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Fri, 30 Oct 2026 09:12:25 +0100 you wrote:
> The truesize of fragments in a reassembly queue is only bounded by
> the per netns ipfrag_high_thresh sysctl, which has no upper limit.
> 
> inet_frag_reasm_finish() sums the truesize of all fragments in an int.
> If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc
> adjustment of the socket owning the reassembled skb can cancel its own
> reference, leading to a use-after-free of this socket.
> 
> [...]

Here is the summary with links:
  - [v2,net] inet: frags: limit the truesize of a reassembly queue
    https://git.kernel.org/netdev/net/c/3ae20e4697eb

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html