linux-kernel - Re: [PATCH net-next v4] tcp: Correct signedness in skb remaining space calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250708073017.27ab068f@kernel.org>
Date: Tue, 8 Jul 2025 07:30:17 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Jiayuan Chen <jiayuan.chen@...ux.dev>
Cc: netdev@...r.kernel.org, mrpre@....com,
 syzbot+de6565462ab540f50e47@...kaller.appspotmail.com, Eric Dumazet
 <edumazet@...gle.com>, Neal Cardwell <ncardwell@...gle.com>, Kuniyuki
 Iwashima <kuniyu@...gle.com>, "David S. Miller" <davem@...emloft.net>,
 David Ahern <dsahern@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon
 Horman <horms@...nel.org>, David Howells <dhowells@...hat.com>,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH net-next v4] tcp: Correct signedness in skb remaining
 space calculation

On Mon,  7 Jul 2025 13:41:11 +0800 Jiayuan Chen wrote:
> Reported-by: syzbot+de6565462ab540f50e47@...kaller.appspotmail.com
> Fixes: 270a1c3de47e ("tcp: Support MSG_SPLICE_PAGES")
> Signed-off-by: Jiayuan Chen <jiayuan.chen@...ux.dev>

> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index 8a3c99246d2e..803a419f4ea0 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -1176,7 +1176,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
>  		goto do_error;
>  
>  	while (msg_data_left(msg)) {
> -		ssize_t copy = 0;
> +		int copy = 0;

nice! FWIW I think we started hitting something like this in prod, 
not sure what the actual repro is but recently some workloads here
moved to 6.9 kernels and I see spikes in warnings in copy from iter
that the size is > INT_MAX:

WARNING: CPU: 26 PID: 3504902 at include/linux/thread_info.h:249 tcp_sendmsg+0xefd/0x1450
RIP: 0010:tcp_sendmsg (./include/linux/thread_info.h:249 ./include/linux/uio.h:203 ./include/linux/uio.h:221 ./include/net/sock.h:2176 ./include/net/sock.h:2202 net/ipv4/tcp.c:1219 net/ipv4/tcp.c:1355)

I'll take this fix via net.