Re: [PATCH net v5] tipc: fix u16 MTU truncation in media and bearer MTU validation

[Simon Horman]

On Tue, Jul 14, 2026 at 12:15:41AM -0400, Cen Zhang (Microsoft) wrote:
> Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied
> MTU values but only enforce a minimum bound, not a maximum. When a user
> sets the MTU to a value exceeding U16_MAX (65535), it passes validation
> but is silently truncated when assigned to u16 fields l->mtu and
> l->advertised_mtu in tipc_link_create(). Values like 65536 (0x10000)
> truncate to 0, causing a division by zero in tipc_link_set_queue_limits()
> which computes TIPC_MAX_PUBL / (l->mtu / ITEM_SIZE). Other overflowing
> values (e.g. 65537-131071) produce small incorrect MTU values, resulting
> in link malfunction behaviors.
> 
> Crash stack (triggered as unprivileged user via user namespace):
> 
>   tipc_link_set_queue_limits  net/tipc/link.c:2531
>   tipc_link_create            net/tipc/link.c:520
>   tipc_node_check_dest        net/tipc/node.c:1279
>   tipc_disc_rcv               net/tipc/discover.c:252
>   tipc_rcv                    net/tipc/node.c:2129
>   tipc_udp_recv               net/tipc/udp_media.c:392
> 
> Two independent paths lack the upper bound check:
> 1. tipc_udp_mtu_bad() -- called from __tipc_nl_media_set() (MEDIA_SET)
> 2. inline check in __tipc_nl_bearer_set() at bearer.c:1160 (BEARER_SET)
> 
> Fix both by rejecting MTU values above U16_MAX.
> 
> Fixes: 901271e0403a ("tipc: implement configuration of UDP media MTU")
> Reported-by: AutonomousCodeSecurity@xxxxxxxxxxxxx
> Closes: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-CKjGXsK6_WDv0=kbYRcC8-noo+amnA@xxxxxxxxxxxxxx
> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@xxxxxxxxx>
> Signed-off-by: Cen Zhang (Microsoft) <blbllhy@xxxxxxxxx>
> ---
> v5: Drop .min from range struct (min check already in handler)
> v4: Add .min check value
> v3: Use nla_policy check to limit MTU max value as suggested by Vadim
> v2: Solved format issue
> Link: https://lore.kernel.org/all/CAB8m9WgETt0AjmFwE=F-CKjGXsK6_WDv0=kbYRcC8-noo+amnA@xxxxxxxxxxxxxx

Thanks,

I believe that v5 covers all the bases wrt review of earlier versions.

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>