net.unix.max_dgram_qlen is documented as the maximum length of an AF_UNIX datagram socket receive queue. Its sysctl entry accepts a signed integer. The configured value is copied to sock::sk_max_ack_backlog, which is u32, when a UNIX socket is created. As a result, writing -1 is accepted and reads back as -1, but newly created sockets receive UINT_MAX as their datagram queue limit. A nonblocking sender can therefore enqueue past the configured finite limit instead of receiving EAGAIN. Use proc_dointvec_minmax with a zero lower bound, rejecting negative input while preserving the existing nonnegative range and the zero-value behavior. The issue was reproduced on 6.12.80 and 6.12.105. With max_dgram_qlen=10, an unprivileged local workload sent 11 of 16 datagrams before EAGAIN. With max_dgram_qlen=-1, all 16 sends succeeded. After this change, writing -1 fails with EINVAL, while the 10 and zero-value controls retain their prior behavior. Signed-off-by: Yingjie Wang <1075151112@qq.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5 --- net/unix/sysctl_net_unix.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c index 47660d5..2782095 100644 --- a/net/unix/sysctl_net_unix.c +++ b/net/unix/sysctl_net_unix.c @@ -19,7 +19,8 @@ static const struct ctl_table unix_table[] = { .data = &init_net.unx.sysctl_max_dgram_qlen, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, }, }; -- 2.43.0