[PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[Kaho Jiang]

User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
This could lead to division of zero error if not checked properly.

Oops: divide error: 0000 [#1] SMP KASAN NOPTI
Call Trace:
 <IRQ>
 tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
 tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
 tcp_rcv_established (net/ipv4/tcp_input.c:6685)
 tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
 tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
 ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
 ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
 ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
 ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
 __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
 __netif_receive_skb (net/core/dev.c:6410)
 process_backlog (net/core/dev.c:6761)
 __napi_poll.constprop.0 (net/core/dev.c:7830)
 net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
 handle_softirqs (kernel/softirq.c:645)
 __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
 irq_exit_rcu (kernel/softirq.c:775)
 sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)

Fix by checking if user pass in zero as parameter,
if so reject the value zero.

Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
Cc: stable@vger.kernel.org
Reported-by: co+71b6509cb791e531@bugs.sh
Assisted-by: LLM
Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
---
 net/ipv4/metrics.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
index ad40762a8b38..e83a129a25b6 100644
--- a/net/ipv4/metrics.c
+++ b/net/ipv4/metrics.c
@@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
 			NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
 			return -EINVAL;
 		}
+		if (type == RTAX_CWND && val == 0) {
+			NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
+			return -EINVAL;
+		}
 		metrics[type - 1] = val;
 	}
 
-- 
2.43.0

Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[Antoine Tenart]

On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> This could lead to division of zero error if not checked properly.
> 
> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> Call Trace:
>  <IRQ>
>  tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
>  tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
>  tcp_rcv_established (net/ipv4/tcp_input.c:6685)
>  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
>  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
>  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
>  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
>  ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
>  ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
>  __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
>  __netif_receive_skb (net/core/dev.c:6410)
>  process_backlog (net/core/dev.c:6761)
>  __napi_poll.constprop.0 (net/core/dev.c:7830)
>  net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
>  handle_softirqs (kernel/softirq.c:645)
>  __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
>  irq_exit_rcu (kernel/softirq.c:775)
>  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> 
> Fix by checking if user pass in zero as parameter,
> if so reject the value zero.
> 
> Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")

This looks like a refactoring commit only, 814d488c6126 might be more
appropriate but please check.

> Cc: stable@vger.kernel.org
> Reported-by: co+71b6509cb791e531@bugs.sh
> Assisted-by: LLM
> Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> ---
>  net/ipv4/metrics.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> index ad40762a8b38..e83a129a25b6 100644
> --- a/net/ipv4/metrics.c
> +++ b/net/ipv4/metrics.c
> @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
>  			NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
>  			return -EINVAL;
>  		}
> +		if (type == RTAX_CWND && val == 0) {
> +			NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> +			return -EINVAL;
> +		}
>  		metrics[type - 1] = val;
>  	}

My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
0 occurs in tcp_cong_avoid_ai. Have you also considered updating
tcp_snd_cwnd_set to not only warn about invalid values but also reject
them, preventing similar oops?

Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[Jerry Jiang]

I have considered rejecting 0 in tcp_snd_cwnd_set but afaik patching
tcp_snd_cwnd only would just ignore the problem. My current patch
should completely reject the user from creating a socket if 0 is
passed for RTAX_CWND.


On Thu, Oct 15, 2026 at 5:57 AM Antoine Tenart <atenart@kernel.org> wrote:
>
> On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > This could lead to division of zero error if not checked properly.
> >
> > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > Call Trace:
> >  <IRQ>
> >  tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> >  tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> >  tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> >  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> >  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> >  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> >  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> >  ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> >  ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> >  __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> >  __netif_receive_skb (net/core/dev.c:6410)
> >  process_backlog (net/core/dev.c:6761)
> >  __napi_poll.constprop.0 (net/core/dev.c:7830)
> >  net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> >  handle_softirqs (kernel/softirq.c:645)
> >  __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> >  irq_exit_rcu (kernel/softirq.c:775)
> >  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> >
> > Fix by checking if user pass in zero as parameter,
> > if so reject the value zero.
> >
> > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
>
> This looks like a refactoring commit only, 814d488c6126 might be more
> appropriate but please check.
>
> > Cc: stable@vger.kernel.org
> > Reported-by: co+71b6509cb791e531@bugs.sh
> > Assisted-by: LLM
> > Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> > ---
> >  net/ipv4/metrics.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > index ad40762a8b38..e83a129a25b6 100644
> > --- a/net/ipv4/metrics.c
> > +++ b/net/ipv4/metrics.c
> > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> >                       NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> >                       return -EINVAL;
> >               }
> > +             if (type == RTAX_CWND && val == 0) {
> > +                     NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > +                     return -EINVAL;
> > +             }
> >               metrics[type - 1] = val;
> >       }
>
> My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
> 0 occurs in tcp_cong_avoid_ai. Have you also considered updating
> tcp_snd_cwnd_set to not only warn about invalid values but also reject
> them, preventing similar oops?

Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[Jerry Jiang]

You are right to point out the refactoring commit, 814d488c6126 would
be more suitable for this.

v3 has been proposed:
https://lore.kernel.org/all/20261015201549.4023-2-kj2864@nyu.edu/

On Thu, Oct 15, 2026 at 12:57 PM Jerry Jiang <kj2864@nyu.edu> wrote:
>
> I have considered rejecting 0 in tcp_snd_cwnd_set but afaik patching
> tcp_snd_cwnd only would just ignore the problem. My current patch
> should completely reject the user from creating a socket if 0 is
> passed for RTAX_CWND.
>
>
> On Thu, Oct 15, 2026 at 5:57 AM Antoine Tenart <atenart@kernel.org> wrote:
> >
> > On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> > > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > > This could lead to division of zero error if not checked properly.
> > >
> > > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > > Call Trace:
> > >  <IRQ>
> > >  tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> > >  tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> > >  tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> > >  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> > >  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> > >  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> > >  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> > >  ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> > >  ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> > >  __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> > >  __netif_receive_skb (net/core/dev.c:6410)
> > >  process_backlog (net/core/dev.c:6761)
> > >  __napi_poll.constprop.0 (net/core/dev.c:7830)
> > >  net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> > >  handle_softirqs (kernel/softirq.c:645)
> > >  __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> > >  irq_exit_rcu (kernel/softirq.c:775)
> > >  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> > >
> > > Fix by checking if user pass in zero as parameter,
> > > if so reject the value zero.
> > >
> > > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
> >
> > This looks like a refactoring commit only, 814d488c6126 might be more
> > appropriate but please check.
> >
> > > Cc: stable@vger.kernel.org
> > > Reported-by: co+71b6509cb791e531@bugs.sh
> > > Assisted-by: LLM
> > > Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> > > ---
> > >  net/ipv4/metrics.c | 4 ++++
> > >  1 file changed, 4 insertions(+)
> > >
> > > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > > index ad40762a8b38..e83a129a25b6 100644
> > > --- a/net/ipv4/metrics.c
> > > +++ b/net/ipv4/metrics.c
> > > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> > >                       NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> > >                       return -EINVAL;
> > >               }
> > > +             if (type == RTAX_CWND && val == 0) {
> > > +                     NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > > +                     return -EINVAL;
> > > +             }
> > >               metrics[type - 1] = val;
> > >       }
> >
> > My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
> > 0 occurs in tcp_cong_avoid_ai. Have you also considered updating
> > tcp_snd_cwnd_set to not only warn about invalid values but also reject
> > them, preventing similar oops?

Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[Antoine Tenart]

On Thu, Oct 15, 2026 at 12:57:51PM -0400, Jerry Jiang wrote:
> I have considered rejecting 0 in tcp_snd_cwnd_set but afaik patching
> tcp_snd_cwnd only would just ignore the problem. My current patch
> should completely reject the user from creating a socket if 0 is
> passed for RTAX_CWND.

I'm not arguing against the current patch. My point is warning on 0
values in tcp_snd_cwnd_set made sense before but since this is now known
to cause oops there might be something better to do there.

> On Thu, Oct 15, 2026 at 5:57 AM Antoine Tenart <atenart@kernel.org> wrote:
> >
> > On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> > > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > > This could lead to division of zero error if not checked properly.
> > >
> > > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > > Call Trace:
> > >  <IRQ>
> > >  tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> > >  tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> > >  tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> > >  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> > >  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> > >  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> > >  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> > >  ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> > >  ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> > >  __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> > >  __netif_receive_skb (net/core/dev.c:6410)
> > >  process_backlog (net/core/dev.c:6761)
> > >  __napi_poll.constprop.0 (net/core/dev.c:7830)
> > >  net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> > >  handle_softirqs (kernel/softirq.c:645)
> > >  __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> > >  irq_exit_rcu (kernel/softirq.c:775)
> > >  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> > >
> > > Fix by checking if user pass in zero as parameter,
> > > if so reject the value zero.
> > >
> > > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
> >
> > This looks like a refactoring commit only, 814d488c6126 might be more
> > appropriate but please check.
> >
> > > Cc: stable@vger.kernel.org
> > > Reported-by: co+71b6509cb791e531@bugs.sh
> > > Assisted-by: LLM
> > > Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> > > ---
> > >  net/ipv4/metrics.c | 4 ++++
> > >  1 file changed, 4 insertions(+)
> > >
> > > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > > index ad40762a8b38..e83a129a25b6 100644
> > > --- a/net/ipv4/metrics.c
> > > +++ b/net/ipv4/metrics.c
> > > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> > >                       NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> > >                       return -EINVAL;
> > >               }
> > > +             if (type == RTAX_CWND && val == 0) {
> > > +                     NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > > +                     return -EINVAL;
> > > +             }
> > >               metrics[type - 1] = val;
> > >       }
> >
> > My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
> > 0 occurs in tcp_cong_avoid_ai. Have you also considered updating
> > tcp_snd_cwnd_set to not only warn about invalid values but also reject
> > them, preventing similar oops?

Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[Jerry Jiang]

Afaik, I don't think any changes are necessary to tcp_snd_cwnd_set as
users are completely rejected from inputting 0, which could give the
assumption argument passed to tcp_snd_cwnd_set is a number larger than
0.


On Fri, Oct 16, 2026 at 3:29 AM Antoine Tenart <atenart@kernel.org> wrote:
>
> On Thu, Oct 15, 2026 at 12:57:51PM -0400, Jerry Jiang wrote:
> > I have considered rejecting 0 in tcp_snd_cwnd_set but afaik patching
> > tcp_snd_cwnd only would just ignore the problem. My current patch
> > should completely reject the user from creating a socket if 0 is
> > passed for RTAX_CWND.
>
> I'm not arguing against the current patch. My point is warning on 0
> values in tcp_snd_cwnd_set made sense before but since this is now known
> to cause oops there might be something better to do there.
>
> > On Thu, Oct 15, 2026 at 5:57 AM Antoine Tenart <atenart@kernel.org> wrote:
> > >
> > > On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> > > > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > > > This could lead to division of zero error if not checked properly.
> > > >
> > > > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > > > Call Trace:
> > > >  <IRQ>
> > > >  tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> > > >  tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> > > >  tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> > > >  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> > > >  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> > > >  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> > > >  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> > > >  ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> > > >  ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> > > >  __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> > > >  __netif_receive_skb (net/core/dev.c:6410)
> > > >  process_backlog (net/core/dev.c:6761)
> > > >  __napi_poll.constprop.0 (net/core/dev.c:7830)
> > > >  net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> > > >  handle_softirqs (kernel/softirq.c:645)
> > > >  __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> > > >  irq_exit_rcu (kernel/softirq.c:775)
> > > >  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > > > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> > > >
> > > > Fix by checking if user pass in zero as parameter,
> > > > if so reject the value zero.
> > > >
> > > > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
> > >
> > > This looks like a refactoring commit only, 814d488c6126 might be more
> > > appropriate but please check.
> > >
> > > > Cc: stable@vger.kernel.org
> > > > Reported-by: co+71b6509cb791e531@bugs.sh
> > > > Assisted-by: LLM
> > > > Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> > > > ---
> > > >  net/ipv4/metrics.c | 4 ++++
> > > >  1 file changed, 4 insertions(+)
> > > >
> > > > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > > > index ad40762a8b38..e83a129a25b6 100644
> > > > --- a/net/ipv4/metrics.c
> > > > +++ b/net/ipv4/metrics.c
> > > > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> > > >                       NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> > > >                       return -EINVAL;
> > > >               }
> > > > +             if (type == RTAX_CWND && val == 0) {
> > > > +                     NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > > > +                     return -EINVAL;
> > > > +             }
> > > >               metrics[type - 1] = val;
> > > >       }
> > >
> > > My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
> > > 0 occurs in tcp_cong_avoid_ai. Have you also considered updating
> > > tcp_snd_cwnd_set to not only warn about invalid values but also reject
> > > them, preventing similar oops?

Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[Jerry Jiang]

I stand corrected, by not passing any argument to RTAX_CWND, the bug
can still be triggered. Doing fixes on tcp_snd_cwnd_set would be
valuable. One idea I have is that if 0 is passed in tcp_snd_cwnd_set,
a default value of 1 is written instead of writing 0.

v4 has been proposed:
https://lore.kernel.org/all/20261017214845.28769-2-kj2864@nyu.edu/





On Sat, Oct 17, 2026 at 12:12 PM Jerry Jiang <kj2864@nyu.edu> wrote:
>
> Afaik, I don't think any changes are necessary to tcp_snd_cwnd_set as
> users are completely rejected from inputting 0, which could give the
> assumption argument passed to tcp_snd_cwnd_set is a number larger than
> 0.
>
>
> On Fri, Oct 16, 2026 at 3:29 AM Antoine Tenart <atenart@kernel.org> wrote:
> >
> > On Thu, Oct 15, 2026 at 12:57:51PM -0400, Jerry Jiang wrote:
> > > I have considered rejecting 0 in tcp_snd_cwnd_set but afaik patching
> > > tcp_snd_cwnd only would just ignore the problem. My current patch
> > > should completely reject the user from creating a socket if 0 is
> > > passed for RTAX_CWND.
> >
> > I'm not arguing against the current patch. My point is warning on 0
> > values in tcp_snd_cwnd_set made sense before but since this is now known
> > to cause oops there might be something better to do there.
> >
> > > On Thu, Oct 15, 2026 at 5:57 AM Antoine Tenart <atenart@kernel.org> wrote:
> > > >
> > > > On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> > > > > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > > > > This could lead to division of zero error if not checked properly.
> > > > >
> > > > > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > > > > Call Trace:
> > > > >  <IRQ>
> > > > >  tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> > > > >  tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> > > > >  tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> > > > >  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> > > > >  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> > > > >  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> > > > >  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> > > > >  ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> > > > >  ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> > > > >  __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> > > > >  __netif_receive_skb (net/core/dev.c:6410)
> > > > >  process_backlog (net/core/dev.c:6761)
> > > > >  __napi_poll.constprop.0 (net/core/dev.c:7830)
> > > > >  net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> > > > >  handle_softirqs (kernel/softirq.c:645)
> > > > >  __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> > > > >  irq_exit_rcu (kernel/softirq.c:775)
> > > > >  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > > > > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> > > > >
> > > > > Fix by checking if user pass in zero as parameter,
> > > > > if so reject the value zero.
> > > > >
> > > > > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
> > > >
> > > > This looks like a refactoring commit only, 814d488c6126 might be more
> > > > appropriate but please check.
> > > >
> > > > > Cc: stable@vger.kernel.org
> > > > > Reported-by: co+71b6509cb791e531@bugs.sh
> > > > > Assisted-by: LLM
> > > > > Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> > > > > ---
> > > > >  net/ipv4/metrics.c | 4 ++++
> > > > >  1 file changed, 4 insertions(+)
> > > > >
> > > > > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > > > > index ad40762a8b38..e83a129a25b6 100644
> > > > > --- a/net/ipv4/metrics.c
> > > > > +++ b/net/ipv4/metrics.c
> > > > > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> > > > >                       NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> > > > >                       return -EINVAL;
> > > > >               }
> > > > > +             if (type == RTAX_CWND && val == 0) {
> > > > > +                     NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > > > > +                     return -EINVAL;
> > > > > +             }
> > > > >               metrics[type - 1] = val;
> > > > >       }
> > > >
> > > > My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
> > > > 0 occurs in tcp_cong_avoid_ai. Have you also considered updating
> > > > tcp_snd_cwnd_set to not only warn about invalid values but also reject
> > > > them, preventing similar oops?

Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 2 potential
issue(s) to consider.

Critical: 0 · High: 1 · Medium: 0 · Low: 1

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [High] The fix is incomplete, so the divide-by-zero it claims to fix
  can still be triggered.
- [Low] The new check in ip_metrics_convert() (net/ipv4/metrics.c:57)
  returns -EINVAL for RTAX_CWND == 0 whether or not the metric is locked.

--

net: ipv4: add zero check for snd_cwnd_clamp

This commit adds a check in ip_metrics_convert() that rejects an RTAX_CWND
route metric of zero with -EINVAL. It is meant to stop snd_cwnd_clamp from
being set to zero, which causes a divide error in tcp_cong_avoid_ai().

> diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> index ad40762a8b383..e83a129a25b68 100644
> --- a/net/ipv4/metrics.c
> +++ b/net/ipv4/metrics.c
> @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
>  			NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
>  			return -EINVAL;
>  		}
> +		if (type == RTAX_CWND && val == 0) {
> +			NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> +			return -EINVAL;
> +		}

[Severity: High]
Does this fully close the divide by zero? The new check runs only when an
RTAX_CWND attribute is present in the RTA_METRICS nest.

What happens if the nest has only RTAX_LOCK with (1 << RTAX_CWND) set and no
RTAX_CWND attribute at all?

ip_fib_metrics_init() allocates the metrics array zero-filled:

net/ipv4/metrics.c:ip_fib_metrics_init() {
    ...
	fib_metrics = kzalloc_obj(*fib_metrics);
    ...
}

This leaves metrics[RTAX_CWND - 1] at 0 while the CWND lock bit is set.
tcpm_suck_dst() then copies the lock bit and the value separately:

net/ipv4/tcp_metrics.c:tcpm_suck_dst() {
    ...
	if (dst_metric_locked(dst, RTAX_CWND))
		val |= 1 << TCP_METRIC_CWND;
    ...
	tcp_metric_set(tm, TCP_METRIC_CWND,
		       dst_metric_raw(dst, RTAX_CWND));
    ...
}

tcp_init_metrics() checks only the lock bit:

	if (tcp_metric_locked(tm, TCP_METRIC_CWND))
		tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND);

So snd_cwnd_clamp ends up as 0 and tcp_init_cwnd() returns min(cwnd, 0).
Then tcp_reno_cong_avoid()->tcp_cong_avoid_ai() runs this with w == 0:

	u32 delta = tp->snd_cwnd_cnt / w;

That gives the same oops as the one in the commit message.

A dump/restore cycle can also produce this input. rtnetlink_put_metrics()
skips metrics that are zero:

	for (i = 0; i < RTAX_MAX; i++) {
		if (metrics[i]) {

A route with a locked CWND of 0 is therefore dumped as RTAX_LOCK only.
Replaying that dump recreates the same state without hitting the new check.

Both IPv4 and IPv6 RTM_NEWROUTE reach this path through
ip_fib_metrics_init(). The only privilege needed is CAP_NET_ADMIN in a netns
owned by an unprivileged user namespace.

Would it work better to check after the loop that a locked RTAX_CWND has a
non-zero value? Another option is to guard tcp_init_metrics() so that a
locked CWND of zero is never applied to snd_cwnd_clamp.

[Severity: Low]
This rejects RTAX_CWND == 0 whether or not the CWND bit is set in RTAX_LOCK.
Is that intended?

Before this patch, an unlocked CWND of 0 was accepted and had no effect.
tcp_init_metrics() reads the metric only when it is locked, and for unlocked
metrics tcp_update_metrics() overwrites the cached value anyway.

With this change, RTM_NEWROUTE requests that carry an unlocked cwnd of 0 now
fail with -EINVAL. The subject says net: ipv4, but this also affects IPv6
routes, because ip6_route_info_create() calls the same ip_fib_metrics_init()
path.

A lock-aware check after the loop, or a guard in tcp_init_metrics(), would
fix the crash without rejecting this harmless input. Would one of those be
preferable?

>  		metrics[type - 1] = val;
>  	}
>

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261014195640.430824-2-kj2864%40nyu.edu