[PATCH v2 net] tcp: cubic: avoid looping in bictcp_update() TCP friendliness code

[Eric Dumazet <edumazet@kernel.org>]

The TCP friendliness part of bictcp_update() does:

	delta = (cwnd * scale) >> 3;
	while (ca->ack_cnt > delta) {
		ca->ack_cnt -= delta;
		ca->tcp_cwnd++;
	}

A BPF congestion control can store any value in tp->snd_cwnd,
tp->snd_ssthresh and icsk_ca_priv, then call the cubictcp_cong_avoid()
kfunc or switch the socket to CUBIC. A zero delta (or a huge ack_cnt)
then hangs the CPU in ACK processing.

Make sure delta is at least 1, and replace the loop with a division,
done only when ack_cnt > delta (at most about once per RTT).

Fixes: 0baf26b0fcd7 ("bpf: tcp: Support tcp_congestion_ops in bpf")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/netdev/179363987528.3131.2987776489427079887@kernel.org/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
v2: fix the loop itself instead of sanitizing snd_cwnd at entry points.
v1: https://lore.kernel.org/netdev/20261106133748.2181133-1-edumazet@kernel.org/

Discovered by an AI code review agent (Sashiko), confirmed by
code inspection only, not triggered.

 net/ipv4/tcp_cubic.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index a88e4bf86150f06eb3c0d3da99761e5d45c8f6a3..e74dabde34324d4d4764afda7022fafcdbcecbfe 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -298,10 +298,16 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd, u32 acked)
 	if (tcp_friendliness) {
 		u32 scale = beta_scale;
 
-		delta = (cwnd * scale) >> 3;
-		while (ca->ack_cnt > delta) {		/* update tcp cwnd */
-			ca->ack_cnt -= delta;
-			ca->tcp_cwnd++;
+		/* BPF congestion controls can call us with any cwnd
+		 * and ack_cnt: cwnd * scale can wrap and give a zero delta,
+		 * and a loop could run up to 2^32 times.
+		 */
+		delta = max((cwnd * scale) >> 3, 1U);
+		if (ca->ack_cnt > delta) {		/* update tcp cwnd */
+			u32 n = (ca->ack_cnt - 1) / delta;
+
+			ca->ack_cnt -= n * delta;
+			ca->tcp_cwnd += n;
 		}
 
 		if (ca->tcp_cwnd > cwnd) {	/* if bic is slower than tcp */
-- 
2.53.0