From nobody Sat Jul 25 01:52:22 2026 Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CAF5C449B0D for ; Mon, 20 Jul 2026 21:41:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784583672; cv=none; b=dnNxoJ5ZPcldD/BQp4vOrXviqC9jKzcDrfBkBOjm78RhfaUBec0l/K0D7pHNTm4B0JsWKfkVuG5i6Z3JqkcvNqn1TeVGZHZaLwBEsQQ2JbYXlql7K04SdlT+VId5+/V6fFFBJSs2rUlDrGGb+eWqSZ85vPgp4e5Gh1hG3llfNgc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784583672; c=relaxed/simple; bh=ZxOla4PUkwrGsQoJ95HmUogsyOS0//ZL/7wMUGSDSBo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=M9jjcM79wHzbMZBh0+vbLjFzJ76ez2W4TOv6Vt1gVIdxPTS/7nhKG3Ne9V/T4QoGKECJi6f8GqjifpBxM6hZbwoenL+p/y3NnmQbPCILoJKNfH2MSZiiTs4t1fFCo8dlWwk2mEFWPFMHc5HWNw7oOSAShna9yb+pMCspB60Rf5c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=B+uGnqVH; arc=none smtp.client-ip=209.85.210.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="B+uGnqVH" Received: by mail-pf1-f175.google.com with SMTP id d2e1a72fcca58-8485ef63b68so10413079b3a.1 for ; Mon, 20 Jul 2026 14:41:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784583669; x=1785188469; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=dGuueZd+28Z7YCvzKzUVauz3+3ckWEEDBGdYS+SB/Ko=; b=B+uGnqVHmpVhJM6kI/zGlQ/X+BfahmZoa2qaVukPiK9B/d/Jxu8jIOnYRUQIXDiNTH X5KkQS+Nmbza6pWqndaLAqBQYHquuIr66oE3e0v/C6kirs3tAJfu0iPf0/fRRACZ8aGk sMQXVBL/zmm+WMIoGd2ebzk+x6Iszroh1Ueqx6DPyrNKYQihNYCzXYNQiF0tvF0euQ+O JmkKdhLPxFcse6jlu+bgsPrlPmJPDOF0FgVFHHQk20SrbBHLtSVjSE2ftfDGBgxGT20p ev2PjzlLCRuSoXtdoFeAy8ikYa/jZBQwi/COIfijkS9CixATfSrgNa2x5fWqm8dmLaXM CcMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784583669; x=1785188469; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dGuueZd+28Z7YCvzKzUVauz3+3ckWEEDBGdYS+SB/Ko=; b=mdC3nbJv3hhM9ZUHqvWj7kCGFjJ6otsQD1XB9ysl8H6mPEOJKWUlqTLbqDZNpqhUFF g85HNmWBS0AUHTn3pIpG+lKbjt2URjNsZd7uo24IM14EQBoDS8Tf7rLtWk3zkoAfJ085 pQ7AyXyN4DlNx6F7GZjfxY6bVzw38jAmrGr2SZZqaRKZMq1RVITkO+70tO+SOxgfzeuK 5HFFRXmfFoJDaGn5rqcHRKUuq34UnZhaldg7ImKMSAyqxXbKomZC8evslkicD0k7zXmo pnVW4O+o5DMATjp9JRkwTw3KsCQWQt8SjRBwKk3EXpK0LdDOEfhtprELlEKqZn+I7BhR vpCg== X-Forwarded-Encrypted: i=1; AHgh+RrU74bvzpWXRZagKdcqkz0IDnYpW2uJxaHh7WUN9acm3Ce2auYHE+MqzGkXWNI17UpDTNVAU4QtQVGKwrE=@vger.kernel.org X-Gm-Message-State: AOJu0YwRknt7uU+/Y6R0ngoOlJ6NaB6SS36h0ag66MlZSNktyrj/uh2s OcuLzm/5wi3DQf3B5FYdgOtJ3sQf+gprS8hm+j1LMuOdnPTHV9Wa0PH8 X-Gm-Gg: AfdE7cm96TigJjUE7E6epZh/kVps4Buph7luwZaPuT8KgiWRqtNKctSq/ZtYlKv7Nzf Fc6zc3yl6AzryQFygQgA0BWIVncq0FvN3G78yljvIJMAMxNHIEfdQpv8yO+7zbSwsqLVEvr3qRU pRP+n2e1p30j190NVDclZ2ZaXJoeUgtaWRifGT9YowWfUglM4WYA8WtJKsnp9aAssM5o6iV1ckS 5rjlFG9Zu/HIOeS3OST5x2vg8qr6GZwY+7uQPPFUJCMgBC05ETeXYLE1xj6ob6YoJJfhr0K3iLv FNVA1cdSpxImT6pYSV7HR2dVAm3LVRN0XNsuKzZjgUWtmVnMTKbnyPyLko/x/PfIJ1xQ56X3AwD l3RzkTnVv+NfsUGzxRPEz2QiT9hZ11ZvJBthqXQGtcTfTDLjCXZYXKSWeG2j7il++lLdNWZTULY 6Eii4zntkh/7DOQzUC0mB5k3CrCohikfYLggIq6RT9wg+b2YYX3CPbTBrlHramK8P31HAcFEh6T PmQ2SVQiNt2DBFXk82eQhClZPZh X-Received: by 2002:a05:6a00:9509:b0:845:48be:b046 with SMTP id d2e1a72fcca58-84c294d0870mr16342453b3a.36.1784583668999; Mon, 20 Jul 2026 14:41:08 -0700 (PDT) Received: from LAPTOP-83ECOPAB.f7a5e5c3-cab1-4810-bdbb-207cdd06de9e.globalsecureaccess.local ([2001:4898:a800:1012:e4ac:299c:3d12:cc91]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cb519aeb676sm5115423a12.19.2026.07.20.14.41.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 14:41:08 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: jmaloy@redhat.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org Cc: netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, tgopinath@linux.microsoft.com, kys@microsoft.com, blbllhy@gmail.com Subject: [PATCH net] tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() Date: Mon, 20 Jul 2026 17:41:03 -0400 Message-ID: <20260720214103.47732-1-blbllhy@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In tipc_recvmsg(), the copy length is computed as: copy =3D min_t(int, dlen - offset, buflen); buflen is size_t but min_t(int, ...) casts it to int. When buflen exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it wraps negative, wins the comparison, and the negative copy length propagates to simple_copy_to_iter() where int-to-size_t promotion makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the same pattern. Kernel panic - not syncing: kernel: panic_on_warn set ... RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521) Call Trace: __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402) skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534) tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934) io_recvmsg+0x47e/0xda0 Fix by changing min_t(int, ...) to min_t(size_t, ...) in both functions. The result is always <=3D (dlen - offset), which is bounded by TIPC maximum message size (0x1ffff bytes), so the implicit narrowing on assignment to int copy is always safe. Fixes: e9f8b10101c6 ("tipc: refactor function tipc_sk_recvmsg()") Fixes: ec8a09fbbeff ("tipc: refactor function tipc_sk_recv_stream()") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Cen Zhang (Microsoft) --- net/tipc/socket.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index e564341e0216..ff858727344e 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1935,7 +1935,7 @@ static int tipc_recvmsg(struct socket *sock, struct m= sghdr *m, if (likely(!err)) { int offset =3D skb_cb->bytes_read; =20 - copy =3D min_t(int, dlen - offset, buflen); + copy =3D min_t(size_t, dlen - offset, buflen); rc =3D skb_copy_datagram_msg(skb, hlen + offset, m, copy); if (unlikely(rc)) goto exit; @@ -2067,7 +2067,7 @@ static int tipc_recvstream(struct socket *sock, struc= t msghdr *m, /* Copy data if msg ok, otherwise return error/partial data */ if (likely(!err)) { offset =3D skb_cb->bytes_read; - copy =3D min_t(int, dlen - offset, buflen - copied); + copy =3D min_t(size_t, dlen - offset, buflen - copied); rc =3D skb_copy_datagram_msg(skb, hlen + offset, m, copy); if (unlikely(rc)) break; --=20 2.53.0