From: Stephen Hemminger <stephen@networkplumber.org>
To: netdev@vger.kernel.org
Subject: Fw: [Bug 220820] New: net: tcp: avoid division by zero in __tcp_select_window
Date: Mon, 1 Dec 2025 08:32:28 -0800 [thread overview]
Message-ID: <20251201083228.70b70181@phoenix.local> (raw)
Begin forwarded message:
Date: Mon, 01 Dec 2025 10:26:14 +0000
From: bugzilla-daemon@kernel.org
To: stephen@networkplumber.org
Subject: [Bug 220820] New: net: tcp: avoid division by zero in __tcp_select_window
https://bugzilla.kernel.org/show_bug.cgi?id=220820
Bug ID: 220820
Summary: net: tcp: avoid division by zero in
__tcp_select_window
Product: Networking
Version: 2.5
Hardware: All
OS: Linux
Status: NEW
Severity: normal
Priority: P3
Component: IPV4
Assignee: stephen@networkplumber.org
Reporter: kitta@linux.alibaba.com
Regression: No
In the following kernel version:
name:linux
url:http://github.com/gregkh/linux.git
branch: master
commit: ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d
bug report:
------------[ cut here ]------------
UBSAN: division-overflow in net/ipv4/tcp_output.c:3333:13
division by zero
CPU: 0 UID: 0 PID: 4151 Comm: syz.0.268 Not tainted 6.18.0-rc7 #1 PREEMPT(none)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x168/0x1f0 lib/dump_stack.c:120
ubsan_epilogue lib/ubsan.c:233 [inline]
__ubsan_handle_divrem_overflow lib/ubsan.c:351 [inline]
__ubsan_handle_divrem_overflow+0x1ae/0x2a0 lib/ubsan.c:333
__tcp_select_window.cold+0x16/0x35 net/ipv4/tcp_output.c:3333
tcp_select_window net/ipv4/tcp_output.c:280 [inline]
__tcp_transmit_skb+0xca3/0x38b0 net/ipv4/tcp_output.c:1565
tcp_transmit_skb net/ipv4/tcp_output.c:1646 [inline]
tcp_send_active_reset+0x422/0x7e0 net/ipv4/tcp_output.c:3828
mptcp_do_fastclose.part.0+0x158/0x1e0 net/mptcp/protocol.c:2792
mptcp_do_fastclose net/mptcp/protocol.c:2779 [inline]
mptcp_disconnect+0x2c6/0x9b0 net/mptcp/protocol.c:3252
inet_shutdown+0x270/0x440 net/ipv4/af_inet.c:937
__sys_shutdown_sock net/socket.c:2470 [inline]
__sys_shutdown_sock net/socket.c:2464 [inline]
__sys_shutdown+0x117/0x1b0 net/socket.c:2486
__do_sys_shutdown net/socket.c:2491 [inline]
__se_sys_shutdown net/socket.c:2489 [inline]
__x64_sys_shutdown+0x54/0x80 net/socket.c:2489
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x6e/0x940 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ff5e46fb4dd
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48
89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01
c3 48 8b 0d 6b 89 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ff5e31f0cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000030
RAX: ffffffffffffffda RBX: 00000000005c5fa0 RCX: 00007ff5e46fb4dd
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000005c5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000005c6038 R14: 0000000000000000 R15: 00007ff5e31f1640
</TASK>
---[ end trace ]---
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 4151 Comm: syz.0.268 Not tainted 6.18.0-rc7 #1 PREEMPT(none)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
RIP: 0010:__tcp_select_window+0x58a/0x1240 net/ipv4/tcp_output.c:3333
Code: e3 0f 8c 8a 02 00 00 e8 34 dc a3 fd 8b 5c 24 0c 31 ff 89 de e8 c7 d5 a3
fd 85 db 0f 84 6c 9d 36 fd e8 1a dc a3 fd 44 89 f0 99 <f7> 7c 24 0c 41 29 d6 45
89 f4 e9 2a ff ff ff e8 02 dc a3 fd 48 89
RSP: 0018:ffff88800b5f7ae0 EFLAGS: 00010283
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90000d11000
RDX: 0000000000000000 RSI: ffffffff83f30a16 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff888028a9f400 R14: 0000000000000000 R15: 0000000000000000
FS: 00007ff5e31f1640(0000) GS:ffff8880e70ab000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f711faa0 CR3: 000000001de2e003 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
PKRU: 80000000
Call Trace:
<TASK>
tcp_select_window net/ipv4/tcp_output.c:280 [inline]
__tcp_transmit_skb+0xca3/0x38b0 net/ipv4/tcp_output.c:1565
tcp_transmit_skb net/ipv4/tcp_output.c:1646 [inline]
tcp_send_active_reset+0x422/0x7e0 net/ipv4/tcp_output.c:3828
mptcp_do_fastclose.part.0+0x158/0x1e0 net/mptcp/protocol.c:2792
mptcp_do_fastclose net/mptcp/protocol.c:2779 [inline]
mptcp_disconnect+0x2c6/0x9b0 net/mptcp/protocol.c:3252
inet_shutdown+0x270/0x440 net/ipv4/af_inet.c:937
__sys_shutdown_sock net/socket.c:2470 [inline]
__sys_shutdown_sock net/socket.c:2464 [inline]
__sys_shutdown+0x117/0x1b0 net/socket.c:2486
__do_sys_shutdown net/socket.c:2491 [inline]
__se_sys_shutdown net/socket.c:2489 [inline]
__x64_sys_shutdown+0x54/0x80 net/socket.c:2489
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x6e/0x940 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ff5e46fb4dd
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48
89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01
c3 48 8b 0d 6b 89 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ff5e31f0cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000030
RAX: ffffffffffffffda RBX: 00000000005c5fa0 RCX: 00007ff5e46fb4dd
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000005c5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000005c6038 R14: 0000000000000000 R15: 00007ff5e31f1640
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__tcp_select_window+0x58a/0x1240 net/ipv4/tcp_output.c:3333
Code: e3 0f 8c 8a 02 00 00 e8 34 dc a3 fd 8b 5c 24 0c 31 ff 89 de e8 c7 d5 a3
fd 85 db 0f 84 6c 9d 36 fd e8 1a dc a3 fd 44 89 f0 99 <f7> 7c 24 0c 41 29 d6 45
89 f4 e9 2a ff ff ff e8 02 dc a3 fd 48 89
RSP: 0018:ffff88800b5f7ae0 EFLAGS: 00010283
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90000d11000
RDX: 0000000000000000 RSI: ffffffff83f30a16 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff888028a9f400 R14: 0000000000000000 R15: 0000000000000000
FS: 00007ff5e31f1640(0000) GS:ffff8880e70ab000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f711faa0 CR3: 000000001de2e003 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
PKRU: 80000000
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 0f 8c 8a 02 00 00 jl 0x290
6: e8 34 dc a3 fd callq 0xfda3dc3f
b: 8b 5c 24 0c mov 0xc(%rsp),%ebx
f: 31 ff xor %edi,%edi
11: 89 de mov %ebx,%esi
13: e8 c7 d5 a3 fd callq 0xfda3d5df
18: 85 db test %ebx,%ebx
1a: 0f 84 6c 9d 36 fd je 0xfd369d8c
20: e8 1a dc a3 fd callq 0xfda3dc3f
25: 44 89 f0 mov %r14d,%eax
28: 99 cltd
* 29: f7 7c 24 0c idivl 0xc(%rsp) <-- trapping instruction
2d: 41 29 d6 sub %edx,%r14d
30: 45 89 f4 mov %r14d,%r12d
33: e9 2a ff ff ff jmpq 0xffffff62
38: e8 02 dc a3 fd callq 0xfda3dc3f
3d: 48 rex.W
3e: 89 .byte 0x89
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
division by zero
CPU: 0 UID: 0 PID: 4151 Comm: syz.0.268 Not tainted 6.18.0-rc7 #1 PREEMPT(none)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x168/0x1f0
__ubsan_handle_divrem_overflow+0x1ae/0x2a0
__tcp_select_window.cold+0x16/0x35
__tcp_transmit_skb+0xca3/0x38b0
tcp_send_active_reset+0x422/0x7e0
mptcp_do_fastclose.part.0+0x158/0x1e0
mptcp_disconnect+0x2c6/0x9b0
inet_shutdown+0x270/0x440
__sys_shutdown+0x117/0x1b0
__x64_sys_shutdown+0x54/0x80
do_syscall_64+0x6e/0x940
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ff5e46fb4dd
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48
89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01
c3 48 8b 0d 6b 89 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ff5e31f0cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000030
RAX: ffffffffffffffda RBX: 00000000005c5fa0 RCX: 00007ff5e46fb4dd
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000005c5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000005c6038 R14: 0000000000000000 R15: 00007ff5e31f1640
</TASK>
---[ end trace ]---
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 4151 Comm: syz.0.268 Not tainted 6.18.0-rc7 #1 PREEMPT(none)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
RIP: 0010:__tcp_select_window+0x58a/0x1240
Code: e3 0f 8c 8a 02 00 00 e8 34 dc a3 fd 8b 5c 24 0c 31 ff 89 de e8 c7 d5 a3
fd 85 db 0f 84 6c 9d 36 fd e8 1a dc a3 fd 44 89 f0 99 <f7> 7c 24 0c 41 29 d6 45
89 f4 e9 2a ff ff ff e8 02 dc a3 fd 48 89
RSP: 0018:ffff88800b5f7ae0 EFLAGS: 00010283
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90000d11000
RDX: 0000000000000000 RSI: ffffffff83f30a16 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff888028a9f400 R14: 0000000000000000 R15: 0000000000000000
FS: 00007ff5e31f1640(0000) GS:ffff8880e70ab000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f711faa0 CR3: 000000001de2e003 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
PKRU: 80000000
Call Trace:
<TASK>
__tcp_transmit_skb+0xca3/0x38b0
tcp_send_active_reset+0x422/0x7e0
mptcp_do_fastclose.part.0+0x158/0x1e0
mptcp_disconnect+0x2c6/0x9b0
inet_shutdown+0x270/0x440
__sys_shutdown+0x117/0x1b0
__x64_sys_shutdown+0x54/0x80
do_syscall_64+0x6e/0x940
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ff5e46fb4dd
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48
89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01
c3 48 8b 0d 6b 89 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ff5e31f0cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000030
RAX: ffffffffffffffda RBX: 00000000005c5fa0 RCX: 00007ff5e46fb4dd
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000005c5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000005c6038 R14: 0000000000000000 R15: 00007ff5e31f1640
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__tcp_select_window+0x58a/0x1240
Code: e3 0f 8c 8a 02 00 00 e8 34 dc a3 fd 8b 5c 24 0c 31 ff 89 de e8 c7 d5 a3
fd 85 db 0f 84 6c 9d 36 fd e8 1a dc a3 fd 44 89 f0 99 <f7> 7c 24 0c 41 29 d6 45
89 f4 e9 2a ff ff ff e8 02 dc a3 fd 48 89
RSP: 0018:ffff88800b5f7ae0 EFLAGS: 00010283
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90000d11000
RDX: 0000000000000000 RSI: ffffffff83f30a16 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff888028a9f400 R14: 0000000000000000 R15: 0000000000000000
FS: 00007ff5e31f1640(0000) GS:ffff8880e70ab000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f711faa0 CR3: 000000001de2e003 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
PKRU: 80000000
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
reply other threads:[~2025-12-01 16:32 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251201083228.70b70181@phoenix.local \
--to=stephen@networkplumber.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.