sock_reserve_memory() adds 'pages << PAGE_SHIFT' (a plain int) to the int sk->sk_forward_alloc. An unprivileged SO_RESERVE_MEM caller can drive the accumulating counter past INT_MAX and wrap it negative, either in one INT_MAX request (0x80000000) or across several smaller ones. The corrupted sk_forward_alloc then trips WARN_ON_ONCE() in inet_sock_destruct() on close (a panic under panic_on_warn/oops=panic). Bound the field that overflows: compute the new sk_forward_alloc in u64 and reject with -EINVAL anything exceeding INT_MAX. Kernel panic - not syncing: kernel: panic_on_warn set ... __warn (kernel/panic.c:1054) ... RIP: 0010:inet_sock_destruct (net/ipv4/af_inet.c:161) __sk_destruct (net/core/sock.c:2357) inet_release (net/ipv4/af_inet.c:442) sock_close (net/socket.c:1501) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1511) do_syscall_64 (arch/x86/entry/syscall_64.c:94) Fixes: 2bb2f5fb21b0 ("net: add new socket option SO_RESERVE_MEM") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Xiang Mei (Microsoft) --- net/core/sock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/sock.c b/net/core/sock.c index 8a59bfaa8096..2ba95bead1ae 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -1042,6 +1042,9 @@ static int sock_reserve_memory(struct sock *sk, int bytes) pages = sk_mem_pages(bytes); + if ((u64)sk->sk_forward_alloc + ((u64)pages << PAGE_SHIFT) > INT_MAX) + return -EINVAL; + /* pre-charge to memcg */ charged = mem_cgroup_sk_charge(sk, pages, GFP_KERNEL | __GFP_RETRY_MAYFAIL); -- 2.43.0