Re: [PATCH net] tcp: limit tcp_tso_rtt_log to a valid shift count

[Eric Dumazet]

Le jeu. 22 oct. 2026 à 14:28, Yingjie Wang <1075151112@xxxxxx> a écrit :
>
> tcp_tso_autosize() right-shifts the u32 returned by tcp_min_rtt() by
> sysctl_tcp_tso_rtt_log. The sysctl uses proc_dou8vec_minmax() without
> an upper bound, so it accepts values through 255. Values above 31 make
> the shift undefined.
>
> A process with CAP_NET_ADMIN in the target network namespace can set the
> per-netns sysctl. With CONFIG_UBSAN_SHIFT=y, setting it to 32 and sending
> TCP data over loopback triggers:
>
>   UBSAN: shift-out-of-bounds in net/ipv4/tcp_output.c:2264:30
>   shift exponent 32 is too large for 32-bit type 'unsigned int'
>   Call Trace:
>    __ubsan_handle_shift_out_of_bounds
>    tcp_tso_segs
>    tcp_write_xmit
>    __tcp_push_pending_frames
>    tcp_push
>    tcp_sendmsg_locked
>
> Limit the sysctl to 31, the largest valid shift count for a u32, and
> document the accepted range. Writes of larger values now fail with
> -EINVAL.
>
> On a UBSAN/KASAN build of the net tree, values 0 and 31 remained
> accepted, values 32 and 255 returned -EINVAL, and TCP traffic with the
> valid boundary values produced no sanitizer diagnostics.
>
> Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yingjie Wang <1075151112@xxxxxx>

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>