From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E2E02E7BC5; Tue, 15 Jul 2025 13:39:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1752586741; cv=none; b=fFOWtAUCTVZ1B02IdFlsoLFfkM4HBqCH4fQKMHEo6WinxkUvAsEYwXAiU9wmb0dgH1y+Pw2ypRqVgMPRwr9KkIbecq8jXfQEz1g3zwiYETMFEDk/dPZbxp3So6TwTNao7JzWNXSl4e5bTJb+HtUVJ7TLHxD+ujAe3QrKj3EJtjI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1752586741; c=relaxed/simple; bh=Vs1ODGz74E0UuMlUKr0a0v0P/r45/4K3/OJ4R/+hrdE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=F+3RrJVdqkUSQiCFsXmxLAPYqMuVz2cYapifrmmjT4zrO7QEPROX0BS2d3VBV/EjM3AFNIAr2oQzEsJ2NQjPJBDuhYlXNwQr2ToAsGqlx9fDePx0wu+LcPpzVR4mnoIfeZbE05TqwiLwSqsMtUDLJDrkieb9bXk/2cQdg4QR658= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aXyQXlXs; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="aXyQXlXs" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94F0AC4CEE3; Tue, 15 Jul 2025 13:39:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1752586740; bh=Vs1ODGz74E0UuMlUKr0a0v0P/r45/4K3/OJ4R/+hrdE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aXyQXlXsE8SrzUNwf1JdnCRgZxtM0YIsXGHK8wpXMT7gIol6M3bchWaNCFz7NaGLd pAXufwblP/2PEvvVWUMC9cBlI8Y+DpDrCXH4LZfPxqI2HdQgBz2QCjvGzqCbJBsEFF LETpa35QYAKDj39JBzZ4p6sq2TiBCFAkd7kx1Tgs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+de6565462ab540f50e47@syzkaller.appspotmail.com, Jiayuan Chen , Eric Dumazet , David Howells , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.15 031/192] tcp: Correct signedness in skb remaining space calculation Date: Tue, 15 Jul 2025 15:12:06 +0200 Message-ID: <20250715130816.109046373@linuxfoundation.org> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250715130814.854109770@linuxfoundation.org> References: <20250715130814.854109770@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiayuan Chen [ Upstream commit d3a5f2871adc0c61c61869f37f3e697d97f03d8c ] Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow. When we send data, if an skb exists at the tail of the write queue, the kernel will attempt to append the new data to that skb. However, the code that checks for available space in the skb is flawed: ''' copy = size_goal - skb->len ''' The types of the variables involved are: ''' copy: ssize_t (s64 on 64-bit systems) size_goal: int skb->len: unsigned int ''' Due to C's type promotion rules, the signed size_goal is converted to an unsigned int to match skb->len before the subtraction. The result is an unsigned int. When this unsigned int result is then assigned to the s64 copy variable, it is zero-extended, preserving its non-negative value. Consequently, copy is always >= 0. Assume we are sending 2GB of data and size_goal has been adjusted to a value smaller than skb->len. The subtraction will result in copy holding a very large positive integer. In the subsequent logic, this large value is used to update sk->sk_forward_alloc, which can easily cause it to overflow. The syzkaller reproducer uses TCP_REPAIR to reliably create this condition. However, this can also occur in real-world scenarios. The tcp_bound_to_half_wnd() function can also reduce size_goal to a small value. This would cause the subsequent tcp_wmem_schedule() to set sk->sk_forward_alloc to a value close to INT_MAX. Further memory allocation requests would then cause sk_forward_alloc to wrap around and become negative. [1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47 Reported-by: syzbot+de6565462ab540f50e47@syzkaller.appspotmail.com Fixes: 270a1c3de47e ("tcp: Support MSG_SPLICE_PAGES") Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Reviewed-by: David Howells Link: https://patch.msgid.link/20250707054112.101081-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 6edc441b37023..905cf7635f77f 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1154,7 +1154,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) goto do_error; while (msg_data_left(msg)) { - ssize_t copy = 0; + int copy = 0; skb = tcp_write_queue_tail(sk); if (skb) -- 2.39.5