Re: [PATCH net v2] tcp: limit tcp_tso_rtt_log to a valid shift count

[Neal Cardwell]

On Fri, Oct 23, 2026 at 10:50 AM Jiayuan Chen <jiayuan.chen@xxxxxxxxx> wrote:
>
>
> On 10/23/26 10:40 PM, Yingjie Wang wrote:
> > tcp_tso_autosize() right-shifts the u32 returned by tcp_min_rtt() by
> > sysctl_tcp_tso_rtt_log. The sysctl uses proc_dou8vec_minmax() without
> > an upper bound, so it accepts values through 255. Values above 31 make
> > the shift undefined.
> >
> > A process with CAP_NET_ADMIN in the target network namespace can set the
> > per-netns sysctl. With CONFIG_UBSAN_SHIFT=y, setting it to 32 and sending
> > TCP data over loopback triggers:
> >
> >    UBSAN: shift-out-of-bounds in net/ipv4/tcp_output.c:2264:30
> >    shift exponent 32 is too large for 32-bit type 'unsigned int'
> >    Call Trace:
> >     __ubsan_handle_shift_out_of_bounds
> >     tcp_tso_segs
> >     tcp_write_xmit
> >     __tcp_push_pending_frames
> >     tcp_push
> >     tcp_sendmsg_locked
> >
> > Limit the sysctl to 31, the largest valid shift count for a u32, and
> > document the accepted range. Writes of larger values now fail with
> > -EINVAL.
> >
> > On a UBSAN/KASAN build of the net tree, values 0 and 31 remained
> > accepted, values 32 and 255 returned -EINVAL, and TCP traffic with the
> > valid boundary values produced no sanitizer diagnostics.
> >
> > Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Yingjie Wang <1075151112@xxxxxx>
>
>
> Reviewed-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>

Reviewed-by: Neal Cardwell <ncardwell@xxxxxxxxxx>

Thanks!
neal