[PATCH net v3 0/4] Fix UDP length overflow in edge cases

[PATCH net v3 0/4] Fix UDP length overflow in edge cases

[Alice Mikityanska]

From: Alice Mikityanska <alice@isovalent.com>

These are fixes for rare edge cases of 16-bit UDP length field overflow
that might happen on netdevs with MTU >= 64k.

Exposed by the new WARN added to udp_set_len_short, reported by syzbot.

v3 changes: Split IPv4, IPv6 and selftest; limited the clamp to UDP
sockets to support UDP jumbograms over raw sockets; added a selftest for
raw sockets; added the kernel config check to the selftest.

v2: https://lore.kernel.org/netdev/20260813120351.2807829-1-alice.kernel@fastmail.im/

v2 changes: Restored the MTU clamp in ip6_dst_mtu_maybe_forward.

v1: https://lore.kernel.org/netdev/20260805205957.1652619-1-alice.kernel@fastmail.im/

Alice Mikityanska (4):
  net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
  net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
  selftests: net: Test UDP length overflow with PMTU discover and big
    MTU
  net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward

 include/net/ip6_route.h                      |   2 +
 net/ipv4/ip_output.c                         |   1 +
 net/ipv6/ip6_output.c                        |   2 +
 tools/testing/selftests/net/Makefile         |   1 +
 tools/testing/selftests/net/cork_fragsize.py | 130 +++++++++++++++++++
 5 files changed, 136 insertions(+)
 create mode 100755 tools/testing/selftests/net/cork_fragsize.py

-- 
2.55.0

[PATCH net v3 1/4] net: ipv4: Fix UDP length overflow with PMTU discover and big MTU

[Alice Mikityanska]

From: Alice Mikityanska <alice@isovalent.com>

This commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a
possible overflow of UDP length that triggers a WARN in
udp_set_len_short when setsockopt IP_MTU_DISCOVER is set to
IP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an
unusually large MTU.

Steps to reproduce:

1. Set device MTU bigger than IP_MAX_MTU + 20. cork->base.fragsize will
   be set to that MTU in ip_setup_cork.
2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be
   set to device MTU (cork->fragsize) in __ip_append_data, rather than
   to IP_MAX_MTU.
3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of
   IPv4 header). Device MTU allows it (it's only one byte bigger than
   IP_MAX_MTU + IPv4 header, and the device MTU is bigger than that).
4. The UDP length in the built packet is 65536, which overflows the
   16-bit length field and triggers the WARN in udp_set_len_short.

Note: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward
always clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward.

The Fixes tag points at the first commit where I could reproduce the
overflow with IPv4 and IP_PMTUDISC_PROBE.

Fixes: daba287b299e ("ipv4: fix DO and PROBE pmtu mode regarding local fragmentation with UFO/CORK")
Reported-by: syzbot+ce13c07d96d04716eaa2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Assisted-by: Claude:claude-sonnet-4.6
Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
---
 net/ipv4/ip_output.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 74e095b6b7ca..a24cc8ee11d3 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1303,6 +1303,7 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
 
 	cork->fragsize = ip_sk_use_pmtu(sk) ?
 			 dst4_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);
+	cork->fragsize = min(cork->fragsize, IP_MAX_MTU);
 
 	if (!inetdev_valid_mtu(cork->fragsize))
 		return -ENETUNREACH;
-- 
2.55.0

Re: [PATCH net v3 1/4] net: ipv4: Fix UDP length overflow with PMTU discover and big MTU

[Willem de Bruijn]

Alice Mikityanska wrote:
> From: Alice Mikityanska <alice@isovalent.com>
> 
> This commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a
> possible overflow of UDP length that triggers a WARN in
> udp_set_len_short when setsockopt IP_MTU_DISCOVER is set to
> IP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an
> unusually large MTU.
> 
> Steps to reproduce:
> 
> 1. Set device MTU bigger than IP_MAX_MTU + 20. cork->base.fragsize will
>    be set to that MTU in ip_setup_cork.
> 2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be
>    set to device MTU (cork->fragsize) in __ip_append_data, rather than
>    to IP_MAX_MTU.
> 3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of
>    IPv4 header). Device MTU allows it (it's only one byte bigger than
>    IP_MAX_MTU + IPv4 header, and the device MTU is bigger than that).
> 4. The UDP length in the built packet is 65536, which overflows the
>    16-bit length field and triggers the WARN in udp_set_len_short.
> 
> Note: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward
> always clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward.
> 
> The Fixes tag points at the first commit where I could reproduce the
> overflow with IPv4 and IP_PMTUDISC_PROBE.
> 
> Fixes: daba287b299e ("ipv4: fix DO and PROBE pmtu mode regarding local fragmentation with UFO/CORK")
> Reported-by: syzbot+ce13c07d96d04716eaa2@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/
> Signed-off-by: Alice Mikityanska <alice@isovalent.com>
> Assisted-by: Claude:claude-sonnet-4.6
> Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>

[PATCH net v3 2/4] net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

[Alice Mikityanska]

From: Alice Mikityanska <alice@isovalent.com>

This commit bounds cork->base.fragsize to IP6_MAX_MTU to avoid a
possible overflow of UDP length that triggers a WARN in
udp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to
IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over
a netdev with an unusually large MTU.

Steps to reproduce (included in the new selftest):

1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be
   set to that MTU in ip6_setup_cork.
2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It
   lets maxnonfragsize be set to device MTU (cork->fragsize) in
   __ip6_append_data, rather than to IP6_MAX_MTU.
3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of
   IPv6 header). Device MTU allows it (it's only one byte bigger than
   IP6_MAX_MTU, and the device MTU is bigger than that).
4. The UDP length in the built packet is 65536, which overflows the
   16-bit length field and triggers the WARN in udp_set_len_short.

The original overflow bug with IPv6 and IPV6_PMTUDISC_DO seems to
predate git history (verified reproduction on 2.6.21), was fixed later,
and then reappeared in commit 427faee167bc ("net: ipv6: introduce
ip6_dst_mtu_maybe_forward"), which is chosen as the Fixes tag here. The
overflow with IPV6_PMTUDISC_PROBE reproduces since its introduction in
commit 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE").

Fixes: 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward")
Reported-by: syzbot+ce13c07d96d04716eaa2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Assisted-by: Codex:gpt-5.6-sol
Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
---
 net/ipv6/ip6_output.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 8fc4766c8da9..550965058991 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1432,6 +1432,8 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 	if (frag_size && frag_size < mtu)
 		mtu = frag_size;
 
+	if (sk_is_udp(sk))
+		mtu = min(mtu, IP6_MAX_MTU);
 	cork->base.fragsize = mtu;
 	cork->base.gso_size = ipc6->gso_size;
 	cork->base.tx_flags = 0;
-- 
2.55.0

Re: [PATCH net v3 2/4] net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

[Willem de Bruijn]

Alice Mikityanska wrote:
> From: Alice Mikityanska <alice@isovalent.com>
> 
> This commit bounds cork->base.fragsize to IP6_MAX_MTU to avoid a

in v3 it only does so for UDP due to IPv6 jumbograms.

> possible overflow of UDP length that triggers a WARN in
> udp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to
> IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over
> a netdev with an unusually large MTU.
> 
> Steps to reproduce (included in the new selftest):
> 
> 1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be
>    set to that MTU in ip6_setup_cork.
> 2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It
>    lets maxnonfragsize be set to device MTU (cork->fragsize) in
>    __ip6_append_data, rather than to IP6_MAX_MTU.
> 3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of
>    IPv6 header). Device MTU allows it (it's only one byte bigger than
>    IP6_MAX_MTU, and the device MTU is bigger than that).
> 4. The UDP length in the built packet is 65536, which overflows the
>    16-bit length field and triggers the WARN in udp_set_len_short.
> 
> The original overflow bug with IPv6 and IPV6_PMTUDISC_DO seems to
> predate git history (verified reproduction on 2.6.21), was fixed later,
> and then reappeared in commit 427faee167bc ("net: ipv6: introduce
> ip6_dst_mtu_maybe_forward"), which is chosen as the Fixes tag here. The
> overflow with IPV6_PMTUDISC_PROBE reproduces since its introduction in
> commit 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE").
> 
> Fixes: 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward")
> Reported-by: syzbot+ce13c07d96d04716eaa2@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/
> Signed-off-by: Alice Mikityanska <alice@isovalent.com>
> Assisted-by: Codex:gpt-5.6-sol
> Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>

[PATCH net v3 3/4] selftests: net: Test UDP length overflow with PMTU discover and big MTU

[Alice Mikityanska]

From: Alice Mikityanska <alice@isovalent.com>

Two previous commits fixed overflow of UDP length when setsockopt
IP(V6)_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IP(V6)_PMTUDISC_PROBE,
and a large packet is sent over a netdev with an unusually large MTU.

This commit adds the selftests that replicate the described steps to
reproduce for IPv6 and IPv4, and also one more test that ensures that
sending UDP jumbograms over a raw socket is still possible after the
fix.

Signed-off-by: Alice Mikityanska <alice@isovalent.com>
---
 tools/testing/selftests/net/Makefile         |   1 +
 tools/testing/selftests/net/cork_fragsize.py | 130 +++++++++++++++++++
 2 files changed, 131 insertions(+)
 create mode 100755 tools/testing/selftests/net/cork_fragsize.py

diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 0f5c178bc224..c6d332c90a54 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -25,6 +25,7 @@ TEST_PROGS := \
 	cmsg_so_mark.sh \
 	cmsg_so_priority.sh \
 	cmsg_time.sh \
+	cork_fragsize.py \
 	double_udp_encap.sh \
 	drop_monitor_tests.sh \
 	ecmp_rehash.sh \
diff --git a/tools/testing/selftests/net/cork_fragsize.py b/tools/testing/selftests/net/cork_fragsize.py
new file mode 100755
index 000000000000..d89ef9892329
--- /dev/null
+++ b/tools/testing/selftests/net/cork_fragsize.py
@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+
+# Test possible UDP length overflow in udp_send_skb/udp_v6_send_skb.
+
+from lib.py import ksft_run, ksft_exit, ksft_true, KsftSkipEx
+from lib.py import ip, NetNS, NetNSEnter
+import errno
+import gzip
+import os
+import socket
+import struct
+import subprocess
+
+
+IP_MTU_DISCOVER = 10
+IP_PMTUDISC_PROBE = 3
+IPV6_MTU_DISCOVER = 23
+IPV6_PMTUDISC_DO = 2
+IPV6_PMTUDISC_PROBE = 3
+IPV6_TLV_JUMBO = 194
+
+
+def check_kernel_config(option) -> bool | None:
+    for filename, method in [
+        ('/proc/config.gz', gzip.open),
+        (f'/boot/config-{os.uname().release}', open),
+    ]:
+        try:
+            with method(filename, 'rt') as config:
+                for line in config:
+                    if line.rstrip() == f'{option}=y':
+                        return True
+                return False
+        except OSError:
+            continue
+
+
+def assert_debug_kernel() -> None:
+    res = check_kernel_config('CONFIG_DEBUG_NET')
+    if res is None:
+        print("WARN: Can't read kernel config; assuming debug kernel, and running the test")
+    elif not res:
+        raise KsftSkipEx('CONFIG_DEBUG_NET is not set')
+
+
+def check_dmesg_clean(func) -> bool:
+    dmesg = subprocess.Popen(['dmesg'], stdout=subprocess.PIPE)
+    result = subprocess.run(['grep', '-q', f'WARNING:.*{func}'], stdin=dmesg.stdout)
+    dmesg.wait()
+    return result.returncode != 0 and dmesg.returncode == 0
+
+
+def ip_setup(ns: NetNS, mtu: int, ipv6: bool) -> None:
+    ip('link add dummy type dummy', ns=ns)
+    ip(f'link set dummy mtu {mtu}', ns=ns)
+    ip('link set dummy up', ns=ns)
+    flag = '-6' if ipv6 else ''
+    nodad = 'nodad' if ipv6 else ''
+    addr_local = 'fd00::1/64' if ipv6 else '10.0.0.1/24'
+    addr_remote = 'fd00::2' if ipv6 else '10.0.0.2'
+    ip(f'{flag} addr add {addr_local} dev dummy {nodad}', ns=ns)
+    ip(f'{flag} neigh add {addr_remote} lladdr 02:00:00:00:00:02 dev dummy nud permanent', ns=ns)
+
+
+def test_ipv6() -> None:
+    assert_debug_kernel()
+
+    with NetNS() as ns:
+        ip_setup(ns, 65576, True)
+
+        with NetNSEnter(ns):
+            with socket.socket(socket.AF_INET6, socket.SOCK_DGRAM) as fd:
+                fd.setsockopt(socket.IPPROTO_IPV6, IPV6_MTU_DISCOVER, IPV6_PMTUDISC_DO)
+                try:
+                    fd.sendto(b' ' * 65528, ('fd00::2', 1234))
+                except OSError as e:
+                    # Ignore EMSGSIZE: it happens on kernels with the fix.
+                    if e.errno != errno.EMSGSIZE:
+                        raise
+
+        ip('link del dummy', ns=ns)
+
+    ksft_true(check_dmesg_clean('udp_v6_send_skb'), 'WARNING detected in dmesg')
+
+
+def test_ipv4() -> None:
+    assert_debug_kernel()
+
+    with NetNS() as ns:
+        ip_setup(ns, 65556, False)
+
+        with NetNSEnter(ns):
+            with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as fd:
+                fd.setsockopt(socket.IPPROTO_IP, IP_MTU_DISCOVER, IP_PMTUDISC_PROBE)
+                try:
+                    fd.sendto(b' ' * 65528, ('10.0.0.2', 1234))
+                except OSError as e:
+                    # Ignore EMSGSIZE: the check happens after the WARN is printed.
+                    if e.errno != errno.EMSGSIZE:
+                        raise
+
+        ip('link del dummy', ns=ns)
+
+    ksft_true(check_dmesg_clean('udp_send_skb'), 'WARNING detected in dmesg')
+
+
+def test_ipv6_jumbo() -> None:
+    with NetNS() as ns:
+        ip_setup(ns, 65584, True)
+
+        with NetNSEnter(ns):
+            with socket.socket(socket.AF_INET6, socket.SOCK_RAW, socket.IPPROTO_UDP) as fd:
+                hopopts = struct.pack('!BBBBI', 0, 0, IPV6_TLV_JUMBO, 4, 65544)
+                fd.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_HOPOPTS, hopopts)
+                fd.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_CHECKSUM, 6)
+                fd.setsockopt(socket.IPPROTO_IPV6, IPV6_MTU_DISCOVER, IPV6_PMTUDISC_PROBE)
+                udp = struct.pack('!HHHH', 1234, 1234, 0, 0) + b' ' * 65528
+                fd.sendto(udp, ('fd00::2', 0))
+
+        ip('link del dummy', ns=ns)
+
+
+if __name__ == "__main__":
+    ksft_run([
+        test_ipv6,
+        test_ipv4,
+        test_ipv6_jumbo,
+    ])
+    ksft_exit()
-- 
2.55.0

Re: [PATCH net v3 3/4] selftests: net: Test UDP length overflow with PMTU discover and big MTU

[Willem de Bruijn]

Alice Mikityanska wrote:
> From: Alice Mikityanska <alice@isovalent.com>
> 
> Two previous commits fixed overflow of UDP length when setsockopt
> IP(V6)_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IP(V6)_PMTUDISC_PROBE,
> and a large packet is sent over a netdev with an unusually large MTU.
> 
> This commit adds the selftests that replicate the described steps to
> reproduce for IPv6 and IPv4, and also one more test that ensures that
> sending UDP jumbograms over a raw socket is still possible after the
> fix.
> 
> Signed-off-by: Alice Mikityanska <alice@isovalent.com>
> ---
>  tools/testing/selftests/net/Makefile         |   1 +
>  tools/testing/selftests/net/cork_fragsize.py | 130 +++++++++++++++++++
>  2 files changed, 131 insertions(+)
>  create mode 100755 tools/testing/selftests/net/cork_fragsize.py
> 
> diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
> index 0f5c178bc224..c6d332c90a54 100644
> --- a/tools/testing/selftests/net/Makefile
> +++ b/tools/testing/selftests/net/Makefile
> @@ -25,6 +25,7 @@ TEST_PROGS := \
>  	cmsg_so_mark.sh \
>  	cmsg_so_priority.sh \
>  	cmsg_time.sh \
> +	cork_fragsize.py \
>  	double_udp_encap.sh \
>  	drop_monitor_tests.sh \
>  	ecmp_rehash.sh \
> diff --git a/tools/testing/selftests/net/cork_fragsize.py b/tools/testing/selftests/net/cork_fragsize.py
> new file mode 100755
> index 000000000000..d89ef9892329
> --- /dev/null
> +++ b/tools/testing/selftests/net/cork_fragsize.py
> @@ -0,0 +1,130 @@
> +#!/usr/bin/env python3
> +# SPDX-License-Identifier: GPL-2.0
> +
> +# Test possible UDP length overflow in udp_send_skb/udp_v6_send_skb.
> +
> +from lib.py import ksft_run, ksft_exit, ksft_true, KsftSkipEx
> +from lib.py import ip, NetNS, NetNSEnter
> +import errno
> +import gzip
> +import os
> +import socket
> +import struct
> +import subprocess

Various pylint and ruff issues, such as ordering imports

> +
> +
> +IP_MTU_DISCOVER = 10
> +IP_PMTUDISC_PROBE = 3
> +IPV6_MTU_DISCOVER = 23
> +IPV6_PMTUDISC_DO = 2
> +IPV6_PMTUDISC_PROBE = 3
> +IPV6_TLV_JUMBO = 194
> +
> +
> +def check_kernel_config(option) -> bool | None:
> +    for filename, method in [
> +        ('/proc/config.gz', gzip.open),
> +        (f'/boot/config-{os.uname().release}', open),
> +    ]:
> +        try:
> +            with method(filename, 'rt') as config:
> +                for line in config:
> +                    if line.rstrip() == f'{option}=y':
> +                        return True
> +                return False
> +        except OSError:
> +            continue
> +
> +
> +def assert_debug_kernel() -> None:
> +    res = check_kernel_config('CONFIG_DEBUG_NET')
> +    if res is None:
> +        print("WARN: Can't read kernel config; assuming debug kernel, and running the test")
> +    elif not res:
> +        raise KsftSkipEx('CONFIG_DEBUG_NET is not set')
> +
> +
> +def check_dmesg_clean(func) -> bool:
> +    dmesg = subprocess.Popen(['dmesg'], stdout=subprocess.PIPE)
> +    result = subprocess.run(['grep', '-q', f'WARNING:.*{func}'], stdin=dmesg.stdout)
> +    dmesg.wait()
> +    return result.returncode != 0 and dmesg.returncode == 0
> +
> +
> +def ip_setup(ns: NetNS, mtu: int, ipv6: bool) -> None:
> +    ip('link add dummy type dummy', ns=ns)
> +    ip(f'link set dummy mtu {mtu}', ns=ns)
> +    ip('link set dummy up', ns=ns)
> +    flag = '-6' if ipv6 else ''
> +    nodad = 'nodad' if ipv6 else ''
> +    addr_local = 'fd00::1/64' if ipv6 else '10.0.0.1/24'
> +    addr_remote = 'fd00::2' if ipv6 else '10.0.0.2'
> +    ip(f'{flag} addr add {addr_local} dev dummy {nodad}', ns=ns)
> +    ip(f'{flag} neigh add {addr_remote} lladdr 02:00:00:00:00:02 dev dummy nud permanent', ns=ns)
> +
> +
> +def test_ipv6() -> None:
> +    assert_debug_kernel()
> +
> +    with NetNS() as ns:
> +        ip_setup(ns, 65576, True)
> +
> +        with NetNSEnter(ns):
> +            with socket.socket(socket.AF_INET6, socket.SOCK_DGRAM) as fd:
> +                fd.setsockopt(socket.IPPROTO_IPV6, IPV6_MTU_DISCOVER, IPV6_PMTUDISC_DO)
> +                try:
> +                    fd.sendto(b' ' * 65528, ('fd00::2', 1234))
> +                except OSError as e:
> +                    # Ignore EMSGSIZE: it happens on kernels with the fix.
> +                    if e.errno != errno.EMSGSIZE:
> +                        raise
> +
> +        ip('link del dummy', ns=ns)
> +
> +    ksft_true(check_dmesg_clean('udp_v6_send_skb'), 'WARNING detected in dmesg')
> +
> +
> +def test_ipv4() -> None:
> +    assert_debug_kernel()
> +
> +    with NetNS() as ns:
> +        ip_setup(ns, 65556, False)
> +
> +        with NetNSEnter(ns):
> +            with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as fd:
> +                fd.setsockopt(socket.IPPROTO_IP, IP_MTU_DISCOVER, IP_PMTUDISC_PROBE)
> +                try:
> +                    fd.sendto(b' ' * 65528, ('10.0.0.2', 1234))
> +                except OSError as e:
> +                    # Ignore EMSGSIZE: the check happens after the WARN is printed.
> +                    if e.errno != errno.EMSGSIZE:
> +                        raise
> +
> +        ip('link del dummy', ns=ns)
> +
> +    ksft_true(check_dmesg_clean('udp_send_skb'), 'WARNING detected in dmesg')

These two are identical apart from 7 constants.

Dedup and use @ksft_variants decorators?

> +def test_ipv6_jumbo() -> None:
> +    with NetNS() as ns:
> +        ip_setup(ns, 65584, True)
> +
> +        with NetNSEnter(ns):
> +            with socket.socket(socket.AF_INET6, socket.SOCK_RAW, socket.IPPROTO_UDP) as fd:
> +                hopopts = struct.pack('!BBBBI', 0, 0, IPV6_TLV_JUMBO, 4, 65544)
> +                fd.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_HOPOPTS, hopopts)
> +                fd.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_CHECKSUM, 6)
> +                fd.setsockopt(socket.IPPROTO_IPV6, IPV6_MTU_DISCOVER, IPV6_PMTUDISC_PROBE)
> +                udp = struct.pack('!HHHH', 1234, 1234, 0, 0) + b' ' * 65528
> +                fd.sendto(udp, ('fd00::2', 0))
> +
> +        ip('link del dummy', ns=ns)

Should this have some test at the end? check_dmesg_clean or perhaps
a socket receiving the data.

> +
> +
> +if __name__ == "__main__":
> +    ksft_run([
> +        test_ipv6,
> +        test_ipv4,
> +        test_ipv6_jumbo,
> +    ])
> +    ksft_exit()
> -- 
> 2.55.0
> 

Re: [PATCH net v3 3/4] selftests: net: Test UDP length overflow with PMTU discover and big MTU

[Alice Mikityanska]

On Sat, Aug 22, 2026, at 21:50, Willem de Bruijn wrote:
> Alice Mikityanska wrote:
>> From: Alice Mikityanska <alice@isovalent.com>
>> 
>> Two previous commits fixed overflow of UDP length when setsockopt
>> IP(V6)_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IP(V6)_PMTUDISC_PROBE,
>> and a large packet is sent over a netdev with an unusually large MTU.
>> 
>> This commit adds the selftests that replicate the described steps to
>> reproduce for IPv6 and IPv4, and also one more test that ensures that
>> sending UDP jumbograms over a raw socket is still possible after the
>> fix.
>> 
>> Signed-off-by: Alice Mikityanska <alice@isovalent.com>
>> ---
>>  tools/testing/selftests/net/Makefile         |   1 +
>>  tools/testing/selftests/net/cork_fragsize.py | 130 +++++++++++++++++++
>>  2 files changed, 131 insertions(+)
>>  create mode 100755 tools/testing/selftests/net/cork_fragsize.py
>> 
>> diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
>> index 0f5c178bc224..c6d332c90a54 100644
>> --- a/tools/testing/selftests/net/Makefile
>> +++ b/tools/testing/selftests/net/Makefile
>> @@ -25,6 +25,7 @@ TEST_PROGS := \
>>  	cmsg_so_mark.sh \
>>  	cmsg_so_priority.sh \
>>  	cmsg_time.sh \
>> +	cork_fragsize.py \
>>  	double_udp_encap.sh \
>>  	drop_monitor_tests.sh \
>>  	ecmp_rehash.sh \
>> diff --git a/tools/testing/selftests/net/cork_fragsize.py b/tools/testing/selftests/net/cork_fragsize.py
>> new file mode 100755
>> index 000000000000..d89ef9892329
>> --- /dev/null
>> +++ b/tools/testing/selftests/net/cork_fragsize.py
>> @@ -0,0 +1,130 @@
>> +#!/usr/bin/env python3
>> +# SPDX-License-Identifier: GPL-2.0
>> +
>> +# Test possible UDP length overflow in udp_send_skb/udp_v6_send_skb.
>> +
>> +from lib.py import ksft_run, ksft_exit, ksft_true, KsftSkipEx
>> +from lib.py import ip, NetNS, NetNSEnter
>> +import errno
>> +import gzip
>> +import os
>> +import socket
>> +import struct
>> +import subprocess
>
> Various pylint and ruff issues, such as ordering imports

I'll make sure to run pylint and ruff before submitting Python.

For the imports: I'll reorder them as needed, but ruff also suggests to
squash all lib.py imports into a single line. I see that other
selftests also separate lib.py imports into meaningful groups that I'm
planning to keep.

For the missing docstrings: I see that other selftests don't have
them either.

I'll fix the rest (and probably use context manager for the dummy
device).

>> +
>> +
>> +IP_MTU_DISCOVER = 10
>> +IP_PMTUDISC_PROBE = 3
>> +IPV6_MTU_DISCOVER = 23
>> +IPV6_PMTUDISC_DO = 2
>> +IPV6_PMTUDISC_PROBE = 3
>> +IPV6_TLV_JUMBO = 194
>> +
>> +
>> +def check_kernel_config(option) -> bool | None:
>> +    for filename, method in [
>> +        ('/proc/config.gz', gzip.open),
>> +        (f'/boot/config-{os.uname().release}', open),
>> +    ]:
>> +        try:
>> +            with method(filename, 'rt') as config:
>> +                for line in config:
>> +                    if line.rstrip() == f'{option}=y':
>> +                        return True
>> +                return False
>> +        except OSError:
>> +            continue
>> +
>> +
>> +def assert_debug_kernel() -> None:
>> +    res = check_kernel_config('CONFIG_DEBUG_NET')
>> +    if res is None:
>> +        print("WARN: Can't read kernel config; assuming debug kernel, and running the test")
>> +    elif not res:
>> +        raise KsftSkipEx('CONFIG_DEBUG_NET is not set')
>> +
>> +
>> +def check_dmesg_clean(func) -> bool:
>> +    dmesg = subprocess.Popen(['dmesg'], stdout=subprocess.PIPE)
>> +    result = subprocess.run(['grep', '-q', f'WARNING:.*{func}'], stdin=dmesg.stdout)
>> +    dmesg.wait()
>> +    return result.returncode != 0 and dmesg.returncode == 0
>> +
>> +
>> +def ip_setup(ns: NetNS, mtu: int, ipv6: bool) -> None:
>> +    ip('link add dummy type dummy', ns=ns)
>> +    ip(f'link set dummy mtu {mtu}', ns=ns)
>> +    ip('link set dummy up', ns=ns)
>> +    flag = '-6' if ipv6 else ''
>> +    nodad = 'nodad' if ipv6 else ''
>> +    addr_local = 'fd00::1/64' if ipv6 else '10.0.0.1/24'
>> +    addr_remote = 'fd00::2' if ipv6 else '10.0.0.2'
>> +    ip(f'{flag} addr add {addr_local} dev dummy {nodad}', ns=ns)
>> +    ip(f'{flag} neigh add {addr_remote} lladdr 02:00:00:00:00:02 dev dummy nud permanent', ns=ns)
>> +
>> +
>> +def test_ipv6() -> None:
>> +    assert_debug_kernel()
>> +
>> +    with NetNS() as ns:
>> +        ip_setup(ns, 65576, True)
>> +
>> +        with NetNSEnter(ns):
>> +            with socket.socket(socket.AF_INET6, socket.SOCK_DGRAM) as fd:
>> +                fd.setsockopt(socket.IPPROTO_IPV6, IPV6_MTU_DISCOVER, IPV6_PMTUDISC_DO)
>> +                try:
>> +                    fd.sendto(b' ' * 65528, ('fd00::2', 1234))
>> +                except OSError as e:
>> +                    # Ignore EMSGSIZE: it happens on kernels with the fix.
>> +                    if e.errno != errno.EMSGSIZE:
>> +                        raise
>> +
>> +        ip('link del dummy', ns=ns)
>> +
>> +    ksft_true(check_dmesg_clean('udp_v6_send_skb'), 'WARNING detected in dmesg')
>> +
>> +
>> +def test_ipv4() -> None:
>> +    assert_debug_kernel()
>> +
>> +    with NetNS() as ns:
>> +        ip_setup(ns, 65556, False)
>> +
>> +        with NetNSEnter(ns):
>> +            with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as fd:
>> +                fd.setsockopt(socket.IPPROTO_IP, IP_MTU_DISCOVER, IP_PMTUDISC_PROBE)
>> +                try:
>> +                    fd.sendto(b' ' * 65528, ('10.0.0.2', 1234))
>> +                except OSError as e:
>> +                    # Ignore EMSGSIZE: the check happens after the WARN is printed.
>> +                    if e.errno != errno.EMSGSIZE:
>> +                        raise
>> +
>> +        ip('link del dummy', ns=ns)
>> +
>> +    ksft_true(check_dmesg_clean('udp_send_skb'), 'WARNING detected in dmesg')
>
> These two are identical apart from 7 constants.
>
> Dedup and use @ksft_variants decorators?

Tried to balance readability vs deduplication when introducing
ip_setup... But OK, I can go all the way. Thanks for the suggestion of
@ksft_variants!

>> +def test_ipv6_jumbo() -> None:
>> +    with NetNS() as ns:
>> +        ip_setup(ns, 65584, True)
>> +
>> +        with NetNSEnter(ns):
>> +            with socket.socket(socket.AF_INET6, socket.SOCK_RAW, socket.IPPROTO_UDP) as fd:
>> +                hopopts = struct.pack('!BBBBI', 0, 0, IPV6_TLV_JUMBO, 4, 65544)
>> +                fd.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_HOPOPTS, hopopts)
>> +                fd.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_CHECKSUM, 6)
>> +                fd.setsockopt(socket.IPPROTO_IPV6, IPV6_MTU_DISCOVER, IPV6_PMTUDISC_PROBE)
>> +                udp = struct.pack('!HHHH', 1234, 1234, 0, 0) + b' ' * 65528
>> +                fd.sendto(udp, ('fd00::2', 0))
>> +
>> +        ip('link del dummy', ns=ns)
>
> Should this have some test at the end? check_dmesg_clean or perhaps
> a socket receiving the data.

No — when the test fails, sendto() raises an exception with EMSGSIZE.
There is nothing in dmesg on failure (hence no assert_debug_kernel
either). The successful return from sendto is the criterion.

Thanks for the review!

>> +
>> +
>> +if __name__ == "__main__":
>> +    ksft_run([
>> +        test_ipv6,
>> +        test_ipv4,
>> +        test_ipv6_jumbo,
>> +    ])
>> +    ksft_exit()
>> -- 
>> 2.55.0
>>

[PATCH net v3 4/4] net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward

[Alice Mikityanska]

From: Alice Mikityanska <alice@isovalent.com>

Commit 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward")
dropped the IP6_MAX_MTU clamp that used to be present in ip6_mtu(). A
similar IPv4 commit ac6627a28dbf ("net: ipv4: Consolidate ipv4_mtu and
ip_dst_mtu_maybe_forward") preserves the IP_MAX_MTU clamp.

Restore the upper bound in the IPv6 flow to avoid potential 16-bit
overflows in forwarding paths.

Fixes: 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward")
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Suggested-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
---
 include/net/ip6_route.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index c69f1c871922..b9e8d2b759e9 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -384,6 +384,8 @@ static inline unsigned int ip6_dst_mtu_maybe_forward(const struct dst_entry *dst
 	rcu_read_unlock();
 
 out:
+	mtu = min_t(unsigned int, mtu, IP6_MAX_MTU);
+
 	return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
 }
 
-- 
2.55.0

Re: [PATCH net v3 4/4] net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward

[Willem de Bruijn]

Alice Mikityanska wrote:
> From: Alice Mikityanska <alice@isovalent.com>
> 
> Commit 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward")
> dropped the IP6_MAX_MTU clamp that used to be present in ip6_mtu(). A
> similar IPv4 commit ac6627a28dbf ("net: ipv4: Consolidate ipv4_mtu and
> ip_dst_mtu_maybe_forward") preserves the IP_MAX_MTU clamp.
> 
> Restore the upper bound in the IPv6 flow to avoid potential 16-bit
> overflows in forwarding paths.
> 
> Fixes: 427faee167bc ("net: ipv6: introduce ip6_dst_mtu_maybe_forward")
> Signed-off-by: Alice Mikityanska <alice@isovalent.com>
> Suggested-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>