[PATCH net v2] net: unix: reject negative max_dgram_qlen values

[Yingjie Wang]

net.unix.max_dgram_qlen is parsed into a signed int but copied to the
u32 sock::sk_max_ack_backlog when an AF_UNIX socket is created.  As a
result, negative values are accepted and converted to large queue limits;
for example, -1 becomes UINT_MAX.  A nonblocking sender can then continue
enqueueing instead of receiving EAGAIN at a finite limit.

The -1 convention in the listen(2) backlog path is separate from this
sysctl; max_dgram_qlen has no documented sentinel value.  Keep it a
non-negative queue length rather than relying on the signed-to-unsigned
conversion.

Using a signed min/max handler would reject negative values, but would
also restrict the maximum to INT_MAX even though both sk_max_ack_backlog
and sk_buff_head::qlen are u32.

Make the backing value unsigned and use proc_douintvec_minmax.  This
rejects negative input while letting userspace configure the full u32
range directly.  The default, zero, and existing nonnegative values
remain unchanged.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:gpt-5
Signed-off-by: Yingjie Wang <1075151112@xxxxxx>
---
v2:
  - Change the backing value and handler to unsigned, preserving the full
    u32 range (Kuniyuki Iwashima).
  - Update the commit message to explain why a signed minimum would cap the
    interface at INT_MAX.
  - Document the sysctl as unsigned and clarify that the listen(2) -1
    convention is not a documented max_dgram_qlen sentinel.
v1: https://lore.kernel.org/netdev/tencent_4AD5738B48FDD2FC84E21FE59338C8DBAA05@xxxxxx/

 Documentation/networking/ip-sysctl.rst | 5 +++--
 include/net/netns/unix.h               | 2 +-
 net/unix/sysctl_net_unix.c             | 4 ++--
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index 208f469..2fe1ca8 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -3818,8 +3818,9 @@ l3mdev_accept - BOOLEAN
 ``/proc/sys/net/unix/*``
 ========================
 
-max_dgram_qlen - INTEGER
+max_dgram_qlen - UNSIGNED INTEGER
 	The maximum length of dgram socket receive queue
 
-	Default: 10
+	Negative values are rejected.
 
+	Default: 10
diff --git a/include/net/netns/unix.h b/include/net/netns/unix.h
index 9859d13..e233c42 100644
--- a/include/net/netns/unix.h
+++ b/include/net/netns/unix.h
@@ -15,7 +15,7 @@ struct unix_table {
 struct ctl_table_header;
 struct netns_unix {
 	struct unix_table	table;
-	int			sysctl_max_dgram_qlen;
+	unsigned int		sysctl_max_dgram_qlen;
 	struct ctl_table_header	*ctl;
 };
 
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index 47660d5..8f6f065 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -17,9 +17,9 @@ static const struct ctl_table unix_table[] = {
 	{
 		.procname	= "max_dgram_qlen",
 		.data		= &init_net.unx.sysctl_max_dgram_qlen,
-		.maxlen		= sizeof(int),
+		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec
+		.proc_handler	= proc_douintvec_minmax,
 	},
 };
 
-- 
2.43.0