[PATCH net] tcp: ignore locked zero CWND route metric

[bestswngs@gmail.com]

From: Weiming Shi <bestswngs@gmail.com>

A locked RTAX_CWND route metric of zero is copied into the TCP metrics
cache and then into snd_cwnd_clamp. This sets the initial cwnd to zero.
With a cached SSTHRESH metric, a later Reno ACK can reach a divide by
zero in tcp_cong_avoid_ai(). A user with CAP_NET_ADMIN in a user-created
network namespace can trigger the oops.

Ignore a zero cached CWND metric when applying the locked clamp, leaving
the socket's initialized nonzero clamp in place.

  Oops: divide error: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
  Call Trace:
  tcp_ack (net/ipv4/tcp_input.c:4440)
  tcp_rcv_established (net/ipv4/tcp_input.c:6678)
  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
  Kernel panic - not syncing: Fatal exception in interrupt

Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
Reported-by: <co+71b6509cb791e531@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/ipv4/tcp_metrics.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index dc0c081fc1f3..ff41804ad086 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -484,8 +484,11 @@ void tcp_init_metrics(struct sock *sk)
 		goto reset;
 	}
 
-	if (tcp_metric_locked(tm, TCP_METRIC_CWND))
-		tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND);
+	if (tcp_metric_locked(tm, TCP_METRIC_CWND)) {
+		val = tcp_metric_get(tm, TCP_METRIC_CWND);
+		if (val)
+			tp->snd_cwnd_clamp = val;
+	}
 
 	val = READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) ?
 	      0 : tcp_metric_get(tm, TCP_METRIC_SSTHRESH);
-- 
2.55.0