[v1,net,0/3] udp: Fix two integer overflows when sk->sk_rcvbuf is close to INT_MAX.

Message

Kuniyuki Iwashima March 23, 2025, 11:09 p.m. UTC

I got a report that UDP mem usage in /proc/net/sockstat did not
drop even after an application was terminated.

The issue could happen if sk->sk_rmem_alloc wraps around due
to a large sk->sk_rcvbuf, which was INT_MAX in our case.

The patch 2 fixes the issue, and the patch 1 fixes yet another
overflow I found while investigating the issue.


Kuniyuki Iwashima (3):
  udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
  udp: Fix memory accounting leak.
  selftest: net: Check wraparounds for sk->sk_rmem_alloc.

 net/ipv4/udp.c                          |  18 ++-
 tools/testing/selftests/net/.gitignore  |   1 +
 tools/testing/selftests/net/Makefile    |   2 +-
 tools/testing/selftests/net/so_rcvbuf.c | 178 ++++++++++++++++++++++++
 4 files changed, 188 insertions(+), 11 deletions(-)
 create mode 100644 tools/testing/selftests/net/so_rcvbuf.c