Linux caps IP fragment truesize to stop unprivileged socket UAF

A use-after-free in the Linux kernel's IPv4 and IPv6 fragment reassembly path is closed by a fix from Eric Dumazet that bounds how much memory a single reassembly queue may charge.

The queue's total fragment footprint was effectively limited only by the per-namespace ipfrag_high_thresh sysctl, which has no hard upper bound. Reassembly finished by summing those footprints in a signed 32-bit integer. Once the sum overflowed, the final adjustment to the owning socket's write-memory counter could drop the socket's own reference, freeing it while it was still in use.

An unprivileged process inside a user or network namespace could raise the threshold and feed padded TUN packets that retain a large truesize after trimming on receive, driving the sum past 2^32. Legitimate traffic does not need anything near that size; the patch therefore tracks the running truesize total per queue and rejects any fragment that would push it above INT_MAX/2, tearing the queue down on that error.

Kyle Zeng reported the bug. Reviewers accepted the change as a minimal stable fix. Paolo Abeni noted that concurrent reassembly queues could still accumulate large charges overall; Dumazet agreed that path remains a separate, pre-existing issue whose failure mode is now a saturated reference count and a leaked socket rather than a use-after-free, and said he would follow up with a bound against the socket send buffer. Wang Zhan observed that the original trigger also depends on defragmentation running before the skb is orphaned, for example through conntrack bridge handling.

The fix is marked for stable backports.