Re: [PATCH net] tcp: do not let tcp_rmem be set below 4096

[Simon Horman <horms@kernel.org>]

On Sat, Sep 12, 2026 at 02:48:48PM +0000, Eric Dumazet wrote:
> We can hit a division by zero crash in tcp_rcvbuf_grow()
> and tcp_rcv_space_adjust():
> 
> divide error: 0000 [#1] PREEMPT SMP
> RIP: 0010:tcp_rcvbuf_grow+0x187/0x450 net/ipv4/tcp_input.c:939
> ...
> grow = div_u64(((u64)rcvwin << 1) * (newval - oldval), oldval);
> 
> The division uses oldval = tp->rcvq_space.space as divisor.
> When tp->rcvq_space.space is zero, this leads to a divide-by-zero
> exception.
> 
> tp->rcvq_space.space is initialized in tcp_init_buffer_space():
>     tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd,
>                                 (u32)TCP_INIT_CWND * tp->advmss);
> 
> If tcp_rmem[1] is configured to very small values (such as 1),
> sk->sk_rcvbuf is initialized to 1. Then tcp_full_space(sk), which
> computes (sk->sk_rcvbuf * scaling_ratio) >> 8, truncates to 0.
> This sets tp->window_clamp = 0, tp->rcv_ssthresh = 0, and
> tp->rcvq_space.space = 0. Later, when data arrives and DRS is invoked,
> tcp_rcvbuf_grow() divides by oldval == 0.
> 
> Back in 2015, commit b1cb59cf2efe ("net: sysctl_net_core: check SNDBUF
> and RCVBUF for min length") ensured that net.core.rmem_default and
> net.core.rmem_max cannot be set below SOCK_MIN_RCVBUF. Similarly,
> SO_RCVBUF setsockopt enforces max_t(int, val * 2, SOCK_MIN_RCVBUF).
> 
> However, net.ipv4.tcp_rmem still had .extra1 = SYSCTL_ONE, allowing
> arbitrarily small values.
> 
> Because SOCK_MIN_RCVBUF depends on sizeof(struct sk_buff) and cacheline
> alignment, its value varies across architectures and configuration options.
> Using a fixed constant of 4096 ensures a predictable, architecture-
> independent lower bound that is safely above SOCK_MIN_RCVBUF everywhere
> and matches the documented 4K default.
> 
> Fix this by setting tcp_rmem.extra1 to 4096 and updating the documentation.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Simon Horman <horms@kernel.org>