[PATCH net] net: unix: reject negative max_dgram_qlen values

[PATCH net] net: unix: reject negative max_dgram_qlen values

[Yingjie Wang]

net.unix.max_dgram_qlen is documented as the maximum length of an AF_UNIX
datagram socket receive queue. Its sysctl entry accepts a signed integer.
The configured value is copied to sock::sk_max_ack_backlog, which is u32,
when a UNIX socket is created.

As a result, writing -1 is accepted and reads back as -1, but newly created
sockets receive UINT_MAX as their datagram queue limit. A nonblocking
sender can therefore enqueue past the configured finite limit instead of
receiving EAGAIN.

Use proc_dointvec_minmax with a zero lower bound, rejecting negative input
while preserving the existing nonnegative range and the zero-value
behavior.

The issue was reproduced on 6.12.80 and 6.12.105. With
max_dgram_qlen=10, an unprivileged local workload sent 11 of 16 datagrams
before EAGAIN. With max_dgram_qlen=-1, all 16 sends succeeded. After this
change, writing -1 fails with EINVAL, while the 10 and zero-value controls
retain their prior behavior.

Signed-off-by: Yingjie Wang <1075151112@qq.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
---
 net/unix/sysctl_net_unix.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index 47660d5..2782095 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -19,7 +19,8 @@ static const struct ctl_table unix_table[] = {
 		.data		= &init_net.unx.sysctl_max_dgram_qlen,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= SYSCTL_ZERO,
 	},
 };
 
-- 
2.43.0