Re: [PATCH 6.6.y 5/5] tcp: clamp route advmss to TCP_MIN_MSS

[Greg KH <greg@kroah.com>]

On Tue, Sep 01, 2026 at 10:18:04AM -0400, Sasha Levin wrote:
> From: Yong Wang <edragain@163.com>
> 
> [ Upstream commit 870a9e42ecc6fe1b8c25d87af043cb0d9c178fe1 ]
> 
> tcp_select_initial_window() assumes that callers never pass an MSS
> smaller than 1, but route-derived advmss values can violate that
> assumption.
> 
> A too-small explicit RTAX_ADVMSS is one way to get there, but it is not
> the only one. The same divide-by-zero can also be reached through the
> "default advmss" path when RTAX_ADVMSS is left at 0 and the effective
> advmss is later driven down by route MTU and min_adv_mss.
> 
> Introduce a tcp_dst_advmss() helper that clamps route advmss to
> TCP_MIN_MSS before TCP consumes it, and use it in the TCP paths that
> derive advmss from dst metrics. This keeps the effective MSS from
> dropping to zero before tcp_select_initial_window() rounds the receive
> window.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Yong Wang <edragain@163.com>
> Signed-off-by: Ren Wei <weir@nebusec.ai>
> Link: https://patch.msgid.link/251eaf8277fa7c66364c9815c5da01662d269181.1787074852.git.edragain@163.com
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  include/net/tcp.h        | 5 +++++
>  net/ipv4/tcp_ipv4.c      | 2 +-
>  net/ipv4/tcp_minisocks.c | 2 +-
>  net/ipv4/tcp_output.c    | 6 +++---
>  net/ipv6/tcp_ipv6.c      | 2 +-
>  5 files changed, 11 insertions(+), 6 deletions(-)
> 
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 23d830a7a6c82..8f411176b4180 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -1475,6 +1475,11 @@ static inline int tcp_full_space(const struct sock *sk)
>  	return tcp_win_from_space(sk, READ_ONCE(sk->sk_rcvbuf));
>  }
>  
> +static inline u32 tcp_dst_advmss(const struct dst_entry *dst)
> +{
> +	return max_t(u32, dst_metric_advmss(dst), TCP_MIN_MSS);
> +}
> +
>  static inline void __tcp_adjust_rcv_ssthresh(struct sock *sk, u32 new_ssthresh)
>  {
>  	int unused_mem = sk_unused_reserved_mem(sk);
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index 97e3ce3e60f98..446e696fb31e7 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -1624,7 +1624,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
>  	tcp_ca_openreq_child(newsk, dst);
>  
>  	tcp_sync_mss(newsk, dst4_mtu(dst));
> -	newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
> +	newtp->advmss = tcp_mss_clamp(tcp_sk(sk), tcp_dst_advmss(dst));
>  
>  	tcp_initialize_rcv_mss(newsk);
>  
> diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
> index 86f0feb2497f1..c5df72b548955 100644
> --- a/net/ipv4/tcp_minisocks.c
> +++ b/net/ipv4/tcp_minisocks.c
> @@ -403,7 +403,7 @@ void tcp_openreq_init_rwin(struct request_sock *req,
>  	u32 rcv_wnd;
>  	int mss;
>  
> -	mss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
> +	mss = tcp_mss_clamp(tp, tcp_dst_advmss(dst));
>  	window_clamp = READ_ONCE(tp->window_clamp);
>  	/* Set this up on the first call only */
>  	req->rsk_window_clamp = window_clamp ? : dst_metric(dst, RTAX_WINDOW);
> diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
> index 5abad93d3c743..67b88a962079f 100644
> --- a/net/ipv4/tcp_output.c
> +++ b/net/ipv4/tcp_output.c
> @@ -125,7 +125,7 @@ static __u16 tcp_advertise_mss(struct sock *sk)
>  	int mss = tp->advmss;
>  
>  	if (dst) {
> -		unsigned int metric = dst_metric_advmss(dst);
> +		unsigned int metric = tcp_dst_advmss(dst);
>  
>  		if (metric < mss) {
>  			mss = metric;
> @@ -3698,7 +3698,7 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
>  	}
>  	skb_dst_set(skb, dst);
>  
> -	mss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
> +	mss = tcp_mss_clamp(tp, tcp_dst_advmss(dst));
>  
>  	memset(&opts, 0, sizeof(opts));
>  	now = tcp_clock_ns();
> @@ -3810,7 +3810,7 @@ static void tcp_connect_init(struct sock *sk)
>  
>  	if (!tp->window_clamp)
>  		WRITE_ONCE(tp->window_clamp, dst_metric(dst, RTAX_WINDOW));
> -	tp->advmss = tcp_mss_clamp(tp, dst_metric_advmss(dst));
> +	tp->advmss = tcp_mss_clamp(tp, tcp_dst_advmss(dst));
>  
>  	tcp_initialize_rcv_mss(sk);
>  
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index 243d398c35868..4a6a0d95af150 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -1341,7 +1341,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
>  	tcp_ca_openreq_child(newsk, dst);
>  
>  	tcp_sync_mss(newsk, dst6_mtu(dst));
> -	newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
> +	newtp->advmss = tcp_mss_clamp(tcp_sk(sk), tcp_dst_advmss(dst));
>  
>  	tcp_initialize_rcv_mss(newsk);
>  
> -- 
> 2.53.0
> 
> 

did not apply