From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2DF4645DF68 for ; Tue, 1 Sep 2026 22:21:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788301301; cv=none; b=NnfT6q05eVhJdI7D/iDpbDlIG8C1Jc457jRp3T6WC7RZZdsyFW/KmsVushAmDUAnztFwm47CmS1K0D9fwH+j4vWyAeu6fcBxhNtFnG9ssmBktu/u8HdhT8x13BtbejOyh4EiTSw3/hmN8qxoclP9HUlsSV8r3uYnZ/Wt42ZmS3E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788301301; c=relaxed/simple; bh=7bGEttE9z3+1RAptKbJd62BOVqrp13jyyRErUsdBHI8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=s8Y5Xn3GrT4xdKlBpYh406/+PVOOok89eKmfZLVZmc40vssMpdBa2t3iMCCpdeKIFGWbnnEJaMQRi5CPpxMMuIHuUwvmS964W8AKgGjz7fh3oBfBGT+nsHUv1cjdtgl1haFCNnECTqUOoV/eEfT3QGyuFaRf8mmy2GQ87M5pF8c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=k2f/o3ca; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="k2f/o3ca" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4DF111F00A3F; Tue, 1 Sep 2026 22:21:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788301300; bh=hRY4scltzBSqm3W4bdJ67P1UCT/bq2eYWLjLpQh3t9w=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=k2f/o3car2bOmsgyhK7MQwgYsLaZO0zGjv0oAVb0QHRC6YmQL65irzk6mLqJMJDwz zMYuTlVjgM2AgabFhvxd8J+DR/KklC8vPI45NK8+wTCaMRdHE2Dqn7mn1Aph4hWNe8 ZT3tZiFDXOfrDaZfkp5+0Ac1TP/xVmI8cWyvm56Iu4yYmqj94O3mxYH3HvQuiIN8Ii sOEpmnLjj+RiA7kB8pJDPJTFHXS3uOzkzw1obno2n3eIButqTE8P4TmXPF0z0/uAR3 2d8EwV4zodKT40JNlnJUwXCP0u9qoLSF71176U8owACkhCBDopyiYzSstGvNes8mx5 Dsf2vHLwbOpqA== From: Sasha Levin To: stable@vger.kernel.org Cc: Yong Wang , Vega , Ren Wei , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15.y 4/4] tcp: clamp route advmss to TCP_MIN_MSS Date: Tue, 1 Sep 2026 18:21:34 -0400 Message-ID: <20260901222134.1700802-4-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260901222134.1700802-1-sashal@kernel.org> References: <2026083106-sterile-daunting-b716@gregkh> <20260901222134.1700802-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Yong Wang [ Upstream commit 870a9e42ecc6fe1b8c25d87af043cb0d9c178fe1 ] tcp_select_initial_window() assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-small explicit RTAX_ADVMSS is one way to get there, but it is not the only one. The same divide-by-zero can also be reached through the "default advmss" path when RTAX_ADVMSS is left at 0 and the effective advmss is later driven down by route MTU and min_adv_mss. Introduce a tcp_dst_advmss() helper that clamps route advmss to TCP_MIN_MSS before TCP consumes it, and use it in the TCP paths that derive advmss from dst metrics. This keeps the effective MSS from dropping to zero before tcp_select_initial_window() rounds the receive window. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Vega Signed-off-by: Yong Wang Signed-off-by: Ren Wei Link: https://patch.msgid.link/251eaf8277fa7c66364c9815c5da01662d269181.1787074852.git.edragain@163.com Signed-off-by: Jakub Kicinski [ discarded upstream ssthresh refactor context and kept existing WRITE_ONCE-free window_clamp assignment style, replacing dst_metric_advmss() with tcp_dst_advmss() ] Signed-off-by: Sasha Levin --- include/net/tcp.h | 5 +++++ net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +++--- net/ipv6/tcp_ipv6.c | 2 +- 5 files changed, 11 insertions(+), 6 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index be91d81d66ab3..48e0a1d363e84 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1436,6 +1436,11 @@ static inline int tcp_full_space(const struct sock *sk) return tcp_win_from_space(sk, READ_ONCE(sk->sk_rcvbuf)); } +static inline u32 tcp_dst_advmss(const struct dst_entry *dst) +{ + return max_t(u32, dst_metric_advmss(dst), TCP_MIN_MSS); +} + void tcp_cleanup_rbuf(struct sock *sk, int copied); /* We provision sk_rcvbuf around 200% of sk_rcvlowat. diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 6f97dfbc5343d..dac9c151f671b 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1614,7 +1614,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, tcp_ca_openreq_child(newsk, dst); tcp_sync_mss(newsk, dst4_mtu(dst)); - newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst)); + newtp->advmss = tcp_mss_clamp(tcp_sk(sk), tcp_dst_advmss(dst)); tcp_initialize_rcv_mss(newsk); diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index 061225d645e6b..e36c466b4b65a 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -369,7 +369,7 @@ void tcp_openreq_init_rwin(struct request_sock *req, u32 rcv_wnd; int mss; - mss = tcp_mss_clamp(tp, dst_metric_advmss(dst)); + mss = tcp_mss_clamp(tp, tcp_dst_advmss(dst)); window_clamp = READ_ONCE(tp->window_clamp); /* Set this up on the first call only */ req->rsk_window_clamp = window_clamp ? : dst_metric(dst, RTAX_WINDOW); diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index a2d5e9f1fe241..462c704cc18a9 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -125,7 +125,7 @@ static __u16 tcp_advertise_mss(struct sock *sk) int mss = tp->advmss; if (dst) { - unsigned int metric = dst_metric_advmss(dst); + unsigned int metric = tcp_dst_advmss(dst); if (metric < mss) { mss = metric; @@ -3597,7 +3597,7 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, } skb_dst_set(skb, dst); - mss = tcp_mss_clamp(tp, dst_metric_advmss(dst)); + mss = tcp_mss_clamp(tp, tcp_dst_advmss(dst)); memset(&opts, 0, sizeof(opts)); now = tcp_clock_ns(); @@ -3713,7 +3713,7 @@ static void tcp_connect_init(struct sock *sk) if (!tp->window_clamp) tp->window_clamp = dst_metric(dst, RTAX_WINDOW); - tp->advmss = tcp_mss_clamp(tp, dst_metric_advmss(dst)); + tp->advmss = tcp_mss_clamp(tp, tcp_dst_advmss(dst)); tcp_initialize_rcv_mss(sk); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 5c6b0d98730d9..7dc0d53c3c249 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1396,7 +1396,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * tcp_ca_openreq_child(newsk, dst); tcp_sync_mss(newsk, dst6_mtu(dst)); - newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst)); + newtp->advmss = tcp_mss_clamp(tcp_sk(sk), tcp_dst_advmss(dst)); tcp_initialize_rcv_mss(newsk); -- 2.53.0