Re: [PATCH net] tcp: ignore locked zero CWND route metric

[Eric Dumazet <edumazet@kernel.org>]

On 10/3/26 18:10, Eric Dumazet wrote:
> 
> 
> On 10/3/26 17:32, bestswngs@gmail.com wrote:
>> From: Weiming Shi <bestswngs@gmail.com>
>>
>> A locked RTAX_CWND route metric of zero is copied into the TCP metrics
>> cache and then into snd_cwnd_clamp. This sets the initial cwnd to zero.
>> With a cached SSTHRESH metric, a later Reno ACK can reach a divide by
>> zero in tcp_cong_avoid_ai(). A user with CAP_NET_ADMIN in a user-created
>> network namespace can trigger the oops.
>>
>> Ignore a zero cached CWND metric when applying the locked clamp, leaving
>> the socket's initialized nonzero clamp in place.
>>
>>    Oops: divide error: 0000 [#1] SMP KASAN NOPTI
>>    RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
>>    Call Trace:
>>    tcp_ack (net/ipv4/tcp_input.c:4440)
>>    tcp_rcv_established (net/ipv4/tcp_input.c:6678)
>>    tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
>>    tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
>>    Kernel panic - not syncing: Fatal exception in interrupt
>>
>  > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local 
> cache.")> Reported-by: <co+71b6509cb791e531@bugs.sh>
>> Assisted-by: LLM
>> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
>> ---
>>   net/ipv4/tcp_metrics.c | 7 +++++--
>>   1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
>> index dc0c081fc1f3..ff41804ad086 100644
>> --- a/net/ipv4/tcp_metrics.c
>> +++ b/net/ipv4/tcp_metrics.c
>> @@ -484,8 +484,11 @@ void tcp_init_metrics(struct sock *sk)
>>           goto reset;
>>       }
>> -    if (tcp_metric_locked(tm, TCP_METRIC_CWND))
>> -        tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND);
>> +    if (tcp_metric_locked(tm, TCP_METRIC_CWND)) {
>> +        val = tcp_metric_get(tm, TCP_METRIC_CWND);
> 
> Please explain how we can come to this situation?
> 
> cwnd can never be zero, so how a save metric could contain zero?

That is to say :

The right fix is in ip_metrics_convert(), one time instead of at each 
TCP session init.

diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
index 
ad40762a8b38379e4ccdc505e3885adb8dfff763..50a08e592b207e85ccc2bb6f917379de61af4579 
100644
--- a/net/ipv4/metrics.c
+++ b/net/ipv4/metrics.c
@@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
                         NL_SET_ERR_MSG(extack, "Unknown flag set in 
feature mask in metrics attribute");
                         return -EINVAL;
                 }
+               if ((type == RTAX_CWND || type == RTAX_INITCWND) && !val) {
+                       NL_SET_ERR_MSG(extack, "CWND metric must be 
greater than zero");
+                       return -EINVAL;
+               }
                 metrics[type - 1] = val;
         }

pw-bot: cr