From 1a4e7bc6e3457ad95515a9d2c042452c3161bb2c Mon Sep 17 00:00:00 2001 From: Yingjie Wang <1075151112@qq.com> Date: Fri, 16 Oct 2026 11:02:58 +0800 Subject: [PATCH] net: unix: reject negative max_dgram_qlen values net.unix.max_dgram_qlen is parsed as a signed int and copied to the u32 sock::sk_max_ack_backlog when an AF_UNIX socket is created. Consequently, a negative value such as -1 is accepted and converted to UINT_MAX. Since the receive queue length is also u32, its fullness check cannot become true for that limit. max_dgram_qlen has no documented negative sentinel. Its existing signed interface represents nonnegative values only through INT_MAX; negative bit patterns are not a supported encoding for the upper half of the u32 consumer range. Switch to proc_dointvec_minmax and make the established 0..INT_MAX input range explicit. This rejects negative values without adding new accepted values or changing the default and zero-value behavior. Very large valid values can still make the queue limit impractical to reach; this change corrects the input domain rather than imposing a new resource ceiling. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Yingjie Wang <1075151112@qq.com> Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/tencent_A643419B56079E9A448D97922763FF069F08@qq.com Signed-off-by: Jakub Kicinski --- Documentation/networking/ip-sysctl.rst | 3 ++- net/unix/sysctl_net_unix.c | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst index f7af0286341c..8edd2eb2ac49 100644 --- a/Documentation/networking/ip-sysctl.rst +++ b/Documentation/networking/ip-sysctl.rst @@ -3823,5 +3823,6 @@ l3mdev_accept - BOOLEAN max_dgram_qlen - INTEGER The maximum length of dgram socket receive queue - Default: 10 + Possible values: 0 - INT_MAX + Default: 10 diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c index 47660d5726bb..fa1fbaec3aaf 100644 --- a/net/unix/sysctl_net_unix.c +++ b/net/unix/sysctl_net_unix.c @@ -19,7 +19,9 @@ static const struct ctl_table unix_table[] = { .data = &init_net.unx.sysctl_max_dgram_qlen, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_INT_MAX, }, };