Re: [PATCH net 1/1] ipv4: reject RTAX_MTU values below IPV4_MIN_MTU

On Sat, Aug 08, 2026 at 04:01:15PM +0800, Ren Wei wrote:

From: Yong Wang <redacted>

ip_metrics_convert() caps RTAX_MTU at the IPv4 maximum, but it still
accepts undersized non-zero values from userspace.

A route installed with "mtu lock 20" can later reach the IPv4
forwarding fragmentation path. With a normal 20-byte IPv4 header,
ip_do_fragment() reduces the payload MTU to zero. ip_frag_next() then
keeps producing zero-length payload fragments, so the fragmentation
state never makes forward progress and the kernel loops until the
softlockup detector fires.

Reject non-zero RTAX_MTU values smaller than IPV4_MIN_MTU while keeping
the existing "0 means use default MTU" behavior intact.

This fixes the bug at the route metric input point and avoids adding
redundant checks in the fragmentation path.

Sashiko is correct that this is also reproducible without setting an MTU
lock. See [1].

Better to fix it in ip_do_fragment(), in a similar fashion to IPv6.
Something like [2].

Sashiko review:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/ccd14fb1411b8b9c466065582e43f6a6c0743842.1786094799.git.edragain%40163.com

And please note:

"Patch authors are expected to proactively look into the AI-generated
reviews and handle such feedback as any other kind of review: either
debate it or address it. In both cases a reply on the mailing list is
expected."

https://docs.kernel.org/next/process/maintainer-netdev.html#review-timelines

[1]
#!/bin/bash

sysctl -w net.ipv4.ip_forward=1

ip link add name dummy1 up mtu 20 type dummy
ip address add 192.0.2.1/24 dev dummy1

ip link add veth0 type veth peer name veth1
ip addr add 198.51.100.1/24 dev veth0
ip link set veth0 up

ip netns add ns1
ip link set veth1 netns ns1
ip -n ns1 address add 198.51.100.2/24 dev veth1
ip -n ns1 link set veth1 up
ip -n ns1 route add default via 198.51.100.1
ip netns exec ns1 ping -M dont -s 1000 -c 1 192.0.2.2

[2]

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index e6dd1e5b8c32..e6bbae103e4f 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c

@@ -790,6 +790,12 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 	 */
 
 	hlen = iph->ihl * 4;
+
+	if (mtu < hlen + 8) {
+		err = -EMSGSIZE;
+		goto fail;
+	}
+
 	mtu = mtu - hlen;	/* Size of data space */
 	IPCB(skb)->flags |= IPSKB_FRAG_COMPLETE;
 	ll_rs = LL_RESERVED_SPACE(rt->dst.dev);