FAILED: patch "[PATCH] inet: frags: limit the truesize of a reassembly queue" failed to apply to 6.1-stable tree
Subsystems (3)
Sasha Levin
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 3ae20e4697eb969104fe4b1e98a675f0100382b6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '[email protected]' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Thanks,
Sasha
------------------ original commit in Linus's tree ------------------
From 3ae20e4697eb969104fe4b1e98a675f0100382b6 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <[email protected]>
Date: Fri, 30 Oct 2026 09:12:25 +0100
Subject: [PATCH] inet: frags: limit the truesize of a reassembly queue
The truesize of fragments in a reassembly queue is only bounded by the per netns ipfrag_high_thresh sysctl, which has no upper limit.
inet_frag_reasm_finish() sums the truesize of all fragments in an int. If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc adjustment of the socket owning the reassembled skb can cancel its own reference, leading to a use-after-free of this socket.
This can be triggered from an unprivileged user/network namespace, raising ipfrag_high_thresh and using padded TUN packets, which keep a large truesize after being trimmed by ip_rcv_core().
Track the sum of the truesize of fragments in each queue, and refuse a fragment that would make it bigger than INT_MAX / 2. Callers kill the queue on this error. This bound is far above the needs of legitimate traffic.
--- include/net/inet_frag.h | 9 +++++++++ net/ipv4/inet_fragment.c | 5 +++++ 2 files changed, 14 insertions(+)
include/net/inet_frag.h +9 -0
@@ -79,6 +79,7 @@ struct frag_v6_compare_key {* @tstamp_type: stamp has a mono delivery time (EDT) * @flags: fragment queue flags * @max_size: maximum received fragment size +* @truesize: sum of the truesize of queued fragments * @fqdir: pointer to struct fqdir * @rcu: rcu head for freeing deferall */
@@ -100,6 +101,7 @@ struct inet_frag_queue {u8 tstamp_type;__u8 flags;u16 max_size; +unsigned int truesize;struct fqdir *fqdir;struct rcu_head rcu; };
@@ -172,6 +174,13 @@ extern const u8 ip_frag_ecn_table[16];#define IPFRAG_DUP 1#define IPFRAG_OVERLAP 2#define IPFRAG_MIXED_SECPATH 3 +#define IPFRAG_TOOBIG 4 + +/* Max sum of the truesize of fragments in a queue. This keeps the sums +* done in inet_frag_reasm_prepare() and inet_frag_reasm_finish() well +* below INT_MAX. Legitimate traffic stays far below this limit. +*/ +#define INET_FRAG_MAX_TRUESIZE (INT_MAX / 2)int inet_frag_queue_insert (struct inet_frag_queue *q,struct sk_buff *skb,int offset,int end); void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
net/ipv4/inet_fragment.c +5 -0
@@ -336,6 +336,7 @@ void inet_frag_queue_flush(struct inet_frag_queue *q, q->rb_fragments =RB_ROOT ; q->fragments_tail =NULL ; q->last_run_head =NULL ; + q->truesize =0 ; }EXPORT_SYMBOL (inet_frag_queue_flush);
@@ -446,6 +447,9 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,if (last && !secpath_equal (last, skb))return IPFRAG_MIXED_SECPATH ; +if (skb->truesize >INET_FRAG_MAX_TRUESIZE - q->truesize) +return IPFRAG_TOOBIG ; +/* An IP fragment is never a GSO packet, but an untrusted source * (virtio_net_hdr) may have attached GSO metadata to it. Do not let * that reach the reassembled skb, whose head keeps the first
@@ -510,6 +514,7 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,if (offset)nf_reset_ct (skb); + q->truesize += skb->truesize;return IPFRAG_OK ; }EXPORT_SYMBOL (inet_frag_queue_insert);
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 1/1 inet: frags: limit the truesize of a reassembly queue
From: Eric Dumazet <[email protected]>
[ Upstream commit 3ae20e4697eb969104fe4b1e98a675f0100382b6 ]
The truesize of fragments in a reassembly queue is only bounded by the per netns ipfrag_high_thresh sysctl, which has no upper limit.
inet_frag_reasm_finish() sums the truesize of all fragments in an int. If this sum reaches 2^32, it wraps, and the final sk_wmem_alloc adjustment of the socket owning the reassembled skb can cancel its own reference, leading to a use-after-free of this socket.
This can be triggered from an unprivileged user/network namespace, raising ipfrag_high_thresh and using padded TUN packets, which keep a large truesize after being trimmed by ip_rcv_core().
Track the sum of the truesize of fragments in each queue, and refuse a fragment that would make it bigger than INT_MAX / 2. Callers kill the queue on this error. This bound is far above the needs of legitimate traffic.
--- include/net/inet_frag.h | 9 +++++++++ net/ipv4/inet_fragment.c | 4 ++++ net/ipv4/ip_fragment.c | 1 + 3 files changed, 14 insertions(+)
include/net/inet_frag.h +9 -0
@@ -76,6 +76,7 @@ struct frag_v6_compare_key {* @mono_delivery_time: stamp has a mono delivery time (EDT) * @flags: fragment queue flags * @max_size: maximum received fragment size +* @truesize: sum of the truesize of queued fragments * @fqdir: pointer to struct fqdir * @rcu: rcu head for freeing deferall */
@@ -97,6 +98,7 @@ struct inet_frag_queue {u8 mono_delivery_time;__u8 flags;u16 max_size; +unsigned int truesize;struct fqdir *fqdir;struct rcu_head rcu; };
@@ -179,6 +181,13 @@ extern const u8 ip_frag_ecn_table[16];#define IPFRAG_OK 0#define IPFRAG_DUP 1#define IPFRAG_OVERLAP 2 +#define IPFRAG_TOOBIG 4 + +/* Max sum of the truesize of fragments in a queue. This keeps the sums +* done in inet_frag_reasm_prepare() and inet_frag_reasm_finish() well +* below INT_MAX. Legitimate traffic stays far below this limit. +*/ +#define INET_FRAG_MAX_TRUESIZE (INT_MAX / 2)int inet_frag_queue_insert (struct inet_frag_queue *q,struct sk_buff *skb,int offset,int end); void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
net/ipv4/inet_fragment.c +4 -0
@@ -384,6 +384,9 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb, {struct sk_buff *last = q->fragments_tail; +if (skb->truesize >INET_FRAG_MAX_TRUESIZE - q->truesize) +return IPFRAG_TOOBIG ; +/* An IP fragment is never a GSO packet, but an untrusted source * (virtio_net_hdr) may have attached GSO metadata to it. Do not let * that reach the reassembled skb, whose head keeps the first
@@ -446,6 +449,7 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,FRAG_CB (skb)->ip_defrag_offset = offset; + q->truesize += skb->truesize;return IPFRAG_OK ; }EXPORT_SYMBOL (inet_frag_queue_insert);
net/ipv4/ip_fragment.c +1 -0
@@ -268,6 +268,7 @@ static int ip_frag_reinit(struct ipq *qp) qp->q.rb_fragments =RB_ROOT ; qp->q.fragments_tail =NULL ; qp->q.last_run_head =NULL ; + qp->q.truesize =0 ; qp->iif =0 ; qp->ecn =0 ;
Signature · 1 line
2.53.0