Re: [PATCH net 1/1] ipv4: reject RTAX_MTU values below IPV4_MIN_MTU

On Sat, Aug 08, 2026 at 04:01:15PM +0800, Ren Wei wrote:
> From: Yong Wang <[email protected]>
> 
> ip_metrics_convert() caps RTAX_MTU at the IPv4 maximum, but it still
> accepts undersized non-zero values from userspace.
> 
> A route installed with "mtu lock 20" can later reach the IPv4
> forwarding fragmentation path. With a normal 20-byte IPv4 header,
> ip_do_fragment() reduces the payload MTU to zero. ip_frag_next() then
> keeps producing zero-length payload fragments, so the fragmentation
> state never makes forward progress and the kernel loops until the
> softlockup detector fires.
> 
> Reject non-zero RTAX_MTU values smaller than IPV4_MIN_MTU while keeping
> the existing "0 means use default MTU" behavior intact.
> 
> This fixes the bug at the route metric input point and avoids adding
> redundant checks in the fragmentation path.

Sashiko is correct that this is also reproducible without setting an MTU
lock. See [1].

Better to fix it in ip_do_fragment(), in a similar fashion to IPv6.
Something like [2].

Sashiko review:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/ccd14fb1411b8b9c466065582e43f6a6c0743842.1786094799.git.edragain%40163.com

And please note:

"Patch authors are expected to proactively look into the AI-generated
reviews and handle such feedback as any other kind of review: either
debate it or address it. In both cases a reply on the mailing list is
expected."

https://docs.kernel.org/next/process/maintainer-netdev.html#review-timelines

[1]
#!/bin/bash

sysctl -w net.ipv4.ip_forward=1

ip link add name dummy1 up mtu 20 type dummy
ip address add 192.0.2.1/24 dev dummy1

ip link add veth0 type veth peer name veth1
ip addr add 198.51.100.1/24 dev veth0
ip link set veth0 up

ip netns add ns1
ip link set veth1 netns ns1
ip -n ns1 address add 198.51.100.2/24 dev veth1
ip -n ns1 link set veth1 up
ip -n ns1 route add default via 198.51.100.1
ip netns exec ns1 ping -M dont -s 1000 -c 1 192.0.2.2

[2]
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index e6dd1e5b8c32..e6bbae103e4f 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -790,6 +790,12 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 	 */
 
 	hlen = iph->ihl * 4;
+
+	if (mtu < hlen + 8) {
+		err = -EMSGSIZE;
+		goto fail;
+	}
+
 	mtu = mtu - hlen;	/* Size of data space */
 	IPCB(skb)->flags |= IPSKB_FRAG_COMPLETE;
 	ll_rs = LL_RESERVED_SPACE(rt->dst.dev);