[PATCH net v2] tcp: limit tcp_tso_rtt_log to a valid shift count

[PATCH net v2] tcp: limit tcp_tso_rtt_log to a valid shift count

[Yingjie Wang]

tcp_tso_autosize() right-shifts the u32 returned by tcp_min_rtt() by
sysctl_tcp_tso_rtt_log. The sysctl uses proc_dou8vec_minmax() without
an upper bound, so it accepts values through 255. Values above 31 make
the shift undefined.

A process with CAP_NET_ADMIN in the target network namespace can set the
per-netns sysctl. With CONFIG_UBSAN_SHIFT=y, setting it to 32 and sending
TCP data over loopback triggers:

  UBSAN: shift-out-of-bounds in net/ipv4/tcp_output.c:2264:30
  shift exponent 32 is too large for 32-bit type 'unsigned int'
  Call Trace:
   __ubsan_handle_shift_out_of_bounds
   tcp_tso_segs
   tcp_write_xmit
   __tcp_push_pending_frames
   tcp_push
   tcp_sendmsg_locked

Limit the sysctl to 31, the largest valid shift count for a u32, and
document the accepted range. Writes of larger values now fail with
-EINVAL.

On a UBSAN/KASAN build of the net tree, values 0 and 31 remained
accepted, values 32 and 255 returned -EINVAL, and TCP traffic with the
valid boundary values produced no sanitizer diagnostics.

Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt")
Cc: stable@vger.kernel.org
Signed-off-by: Yingjie Wang <1075151112@qq.com>
---
v2:
- Attach the upper bound to tcp_tso_rtt_log instead of ip_dynaddr, as
  pointed out by Jiayuan Chen and Neal Cardwell.
- Re-run checkpatch and boundary tests on the corrected patch.
- Do not carry Eric Dumazet's Reviewed-by tag because the code changed.

v1: https://lore.kernel.org/netdev/tencent_53CDCF8AA0022B75CF72A294CB9993D2FF07@qq.com/

 Documentation/networking/ip-sysctl.rst | 2 ++
 net/ipv4/sysctl_net_ipv4.c             | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index 8edd2eb2a..66a54c510 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1128,6 +1128,8 @@ tcp_tso_rtt_log - INTEGER
 
 	If you want to use the old autosizing, set this sysctl to 0.
 
+	Possible values are [0, 31], inclusive.
+
 	Default: 9  (2^9 = 512 usec)
 
 tcp_pacing_ss_ratio - INTEGER
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index e3760daa3..bf193e7ec 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -26,6 +26,7 @@ static int ip_local_port_range_max[] = { 65535, 65535 };
 static int tcp_adv_win_scale_min = -31;
 static int tcp_adv_win_scale_max = 31;
 static int tcp_app_win_max = 31;
+static int tcp_tso_rtt_log_max = 31;
 static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS;
 static int tcp_min_snd_mss_max = 65535;
 static int tcp_rto_max_max = TCP_RTO_MAX_SEC * MSEC_PER_SEC;
@@ -1406,6 +1407,7 @@ static const struct ctl_table ipv4_net_table[] = {
 		.maxlen		= sizeof(u8),
 		.mode		= 0644,
 		.proc_handler	= proc_dou8vec_minmax,
+		.extra2		= &tcp_tso_rtt_log_max,
 	},
 	{
 		.procname	= "tcp_min_rtt_wlen",

base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449
-- 
2.43.0

Re: [PATCH net v2] tcp: limit tcp_tso_rtt_log to a valid shift count

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v2] tcp: limit tcp_tso_rtt_log to a valid shift count

[Jiayuan Chen]

On 10/23/26 10:40 PM, Yingjie Wang wrote:
> tcp_tso_autosize() right-shifts the u32 returned by tcp_min_rtt() by
> sysctl_tcp_tso_rtt_log. The sysctl uses proc_dou8vec_minmax() without
> an upper bound, so it accepts values through 255. Values above 31 make
> the shift undefined.
>
> A process with CAP_NET_ADMIN in the target network namespace can set the
> per-netns sysctl. With CONFIG_UBSAN_SHIFT=y, setting it to 32 and sending
> TCP data over loopback triggers:
>
>    UBSAN: shift-out-of-bounds in net/ipv4/tcp_output.c:2264:30
>    shift exponent 32 is too large for 32-bit type 'unsigned int'
>    Call Trace:
>     __ubsan_handle_shift_out_of_bounds
>     tcp_tso_segs
>     tcp_write_xmit
>     __tcp_push_pending_frames
>     tcp_push
>     tcp_sendmsg_locked
>
> Limit the sysctl to 31, the largest valid shift count for a u32, and
> document the accepted range. Writes of larger values now fail with
> -EINVAL.
>
> On a UBSAN/KASAN build of the net tree, values 0 and 31 remained
> accepted, values 32 and 255 returned -EINVAL, and TCP traffic with the
> valid boundary values produced no sanitizer diagnostics.
>
> Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yingjie Wang <1075151112@qq.com>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>


Thanks !

> ---
> v2:
> - Attach the upper bound to tcp_tso_rtt_log instead of ip_dynaddr, as
>    pointed out by Jiayuan Chen and Neal Cardwell.
> - Re-run checkpatch and boundary tests on the corrected patch.
> - Do not carry Eric Dumazet's Reviewed-by tag because the code changed.
>
> v1: https://lore.kernel.org/netdev/tencent_53CDCF8AA0022B75CF72A294CB9993D2FF07@qq.com/
>
>   Documentation/networking/ip-sysctl.rst | 2 ++
>   net/ipv4/sysctl_net_ipv4.c             | 2 ++
>   2 files changed, 4 insertions(+)
>
> diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
> index 8edd2eb2a..66a54c510 100644
> --- a/Documentation/networking/ip-sysctl.rst
> +++ b/Documentation/networking/ip-sysctl.rst
> @@ -1128,6 +1128,8 @@ tcp_tso_rtt_log - INTEGER
>   
>   	If you want to use the old autosizing, set this sysctl to 0.
>   
> +	Possible values are [0, 31], inclusive.
> +
>   	Default: 9  (2^9 = 512 usec)
>   
>   tcp_pacing_ss_ratio - INTEGER
> diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> index e3760daa3..bf193e7ec 100644
> --- a/net/ipv4/sysctl_net_ipv4.c
> +++ b/net/ipv4/sysctl_net_ipv4.c
> @@ -26,6 +26,7 @@ static int ip_local_port_range_max[] = { 65535, 65535 };
>   static int tcp_adv_win_scale_min = -31;
>   static int tcp_adv_win_scale_max = 31;
>   static int tcp_app_win_max = 31;
> +static int tcp_tso_rtt_log_max = 31;
>   static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS;
>   static int tcp_min_snd_mss_max = 65535;
>   static int tcp_rto_max_max = TCP_RTO_MAX_SEC * MSEC_PER_SEC;
> @@ -1406,6 +1407,7 @@ static const struct ctl_table ipv4_net_table[] = {
>   		.maxlen		= sizeof(u8),
>   		.mode		= 0644,
>   		.proc_handler	= proc_dou8vec_minmax,
> +		.extra2		= &tcp_tso_rtt_log_max,
>   	},
>   	{
>   		.procname	= "tcp_min_rtt_wlen",
>
> base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449

Re: [PATCH net v2] tcp: limit tcp_tso_rtt_log to a valid shift count

[Neal Cardwell]

On Fri, Oct 23, 2026 at 10:50 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
>
> On 10/23/26 10:40 PM, Yingjie Wang wrote:
> > tcp_tso_autosize() right-shifts the u32 returned by tcp_min_rtt() by
> > sysctl_tcp_tso_rtt_log. The sysctl uses proc_dou8vec_minmax() without
> > an upper bound, so it accepts values through 255. Values above 31 make
> > the shift undefined.
> >
> > A process with CAP_NET_ADMIN in the target network namespace can set the
> > per-netns sysctl. With CONFIG_UBSAN_SHIFT=y, setting it to 32 and sending
> > TCP data over loopback triggers:
> >
> >    UBSAN: shift-out-of-bounds in net/ipv4/tcp_output.c:2264:30
> >    shift exponent 32 is too large for 32-bit type 'unsigned int'
> >    Call Trace:
> >     __ubsan_handle_shift_out_of_bounds
> >     tcp_tso_segs
> >     tcp_write_xmit
> >     __tcp_push_pending_frames
> >     tcp_push
> >     tcp_sendmsg_locked
> >
> > Limit the sysctl to 31, the largest valid shift count for a u32, and
> > document the accepted range. Writes of larger values now fail with
> > -EINVAL.
> >
> > On a UBSAN/KASAN build of the net tree, values 0 and 31 remained
> > accepted, values 32 and 255 returned -EINVAL, and TCP traffic with the
> > valid boundary values produced no sanitizer diagnostics.
> >
> > Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Yingjie Wang <1075151112@qq.com>
>
>
> Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Reviewed-by: Neal Cardwell <ncardwell@google.com>

Thanks!
neal

Re: [PATCH net v2] tcp: limit tcp_tso_rtt_log to a valid shift count

[Eric Dumazet]

Le ven. 23 oct. 2026 à 17:06, Neal Cardwell <ncardwell@google.com> a écrit :
>
> On Fri, Oct 23, 2026 at 10:50 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
> >
> >
> > On 10/23/26 10:40 PM, Yingjie Wang wrote:
> > > tcp_tso_autosize() right-shifts the u32 returned by tcp_min_rtt() by
> > > sysctl_tcp_tso_rtt_log. The sysctl uses proc_dou8vec_minmax() without
> > > an upper bound, so it accepts values through 255. Values above 31 make
> > > the shift undefined.
> > >
> > > A process with CAP_NET_ADMIN in the target network namespace can set the
> > > per-netns sysctl. With CONFIG_UBSAN_SHIFT=y, setting it to 32 and sending
> > > TCP data over loopback triggers:
> > >
> > >    UBSAN: shift-out-of-bounds in net/ipv4/tcp_output.c:2264:30
> > >    shift exponent 32 is too large for 32-bit type 'unsigned int'
> > >    Call Trace:
> > >     __ubsan_handle_shift_out_of_bounds
> > >     tcp_tso_segs
> > >     tcp_write_xmit
> > >     __tcp_push_pending_frames
> > >     tcp_push
> > >     tcp_sendmsg_locked
> > >
> > > Limit the sysctl to 31, the largest valid shift count for a u32, and
> > > document the accepted range. Writes of larger values now fail with
> > > -EINVAL.
> > >
> > > On a UBSAN/KASAN build of the net tree, values 0 and 31 remained
> > > accepted, values 32 and 255 returned -EINVAL, and TCP traffic with the
> > > valid boundary values produced no sanitizer diagnostics.
> > >
> > > Fixes: 65466904b015 ("tcp: adjust TSO packet sizes based on min_rtt")
> > > Cc: stable@vger.kernel.org
> > > Signed-off-by: Yingjie Wang <1075151112@qq.com>
> >
> >
> > Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>
> Reviewed-by: Neal Cardwell <ncardwell@google.com>

Reviewed-by: Eric Dumazet <edumazet@kernel.org>