[PATCH mptcp-next v6 03/10] mptcp: widen offset field in mptcp_data_frag to u32

From: Geliang Tang <[email protected]>

The offset field in struct mptcp_data_frag is declared as u16, which
can only represent values up to 65535. On architectures with page
sizes larger than 64KB (such as 256KB on PowerPC and Hexagon), the
offset calculation in mptcp_carve_data_frag() can exceed this limit,
causing the u16 field to wrap around.

When offset wraps, mptcp_sendmsg() calculates the destination address
using the wrapped value:

	offset = dfrag->offset + dfrag->data_len;
	page_address(dfrag->page) + offset

This could cause the function to write new network payload into the
start of the page fragment, potentially overwriting the previously
allocated struct mptcp_data_frag and corrupting kernel memory.

Widen the offset field from u16 to u32 to support page sizes up to
4GB. Also change the corresponding local variable in
mptcp_sendmsg_frag() from int to size_t to prevent overflow when
adding offset and data_len.

This is a correctness fix for architectures with 256KB pages and
has no effect on systems with smaller page sizes.

Signed-off-by: Geliang Tang <[email protected]>
---
 net/mptcp/protocol.c | 2 +-
 net/mptcp/protocol.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 1cab07b1b9b1..3acd61ae6160 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1373,7 +1373,7 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,
 			      struct mptcp_sendmsg_info *info)
 {
 	u64 data_seq = dfrag->data_seq + info->sent;
-	int offset = dfrag->offset + info->sent;
+	size_t offset = dfrag->offset + info->sent;
 	struct mptcp_sock *msk = mptcp_sk(sk);
 	struct tcp_sock *tp = tcp_sk(ssk);
 	bool zero_window_probe = false;
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index da40c6f3705f..7d624cb0fa7d 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -263,7 +263,7 @@ struct mptcp_data_frag {
 	struct list_head list;
 	u64 data_seq;
 	u16 data_len;
-	u16 offset;
+	u32 offset;		/* u16 wraps on 256KB-page kernels */
 	u8 overhead;
 	u8 eor;			/* currently using 1 bit */
 	u16 already_sent;
-- 
2.53.0