* [PATCH net v5] net: ipv4: add zero check for snd_cwnd_clamp
@ 2026-10-19 22:25 Kaho Jiang
2026-10-20 7:15 ` Jiayuan Chen
2026-10-20 10:31 ` Eric Dumazet
0 siblings, 2 replies; 3+ messages in thread
From: Kaho Jiang @ 2026-10-19 22:25 UTC (permalink / raw)
To: ncardwell, kuniyu, davem, kuba, pabeni, horms, edumazet
Cc: netdev, linux-kernel, co+71b6509cb791e531, Kaho Jiang, stable
User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
This could lead to division of zero error if not checked properly.
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
Call Trace:
<IRQ>
tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
tcp_rcv_established (net/ipv4/tcp_input.c:6685)
tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
__netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
__netif_receive_skb (net/core/dev.c:6410)
process_backlog (net/core/dev.c:6761)
__napi_poll.constprop.0 (net/core/dev.c:7830)
net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
handle_softirqs (kernel/softirq.c:645)
__irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
irq_exit_rcu (kernel/softirq.c:775)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
Fix by checking if user pass in zero as parameter,
if so reject the value zero.
Fixes: 814d488c6126 ("tcp: fix the timid additive increase on stretch ACKs")
Cc: stable@vger.kernel.org
Reported-by: co+71b6509cb791e531@bugs.sh
Assisted-by: LLM
Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
---
include/net/tcp.h | 2 +-
net/ipv4/metrics.c | 4 ++++
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 4416cdf9bf30..9f605d9ecb35 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1522,7 +1522,7 @@ static inline u32 tcp_snd_cwnd(const struct tcp_sock *tp)
static inline void tcp_snd_cwnd_set(struct tcp_sock *tp, u32 val)
{
WARN_ON_ONCE((int)val <= 0);
- WRITE_ONCE(tp->snd_cwnd, val);
+ WRITE_ONCE(tp->snd_cwnd, max(val, 1U));
}
static inline bool tcp_in_slow_start(const struct tcp_sock *tp)
diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
index ad40762a8b38..cb36686973e5 100644
--- a/net/ipv4/metrics.c
+++ b/net/ipv4/metrics.c
@@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
return -EINVAL;
}
+ if (type == RTAX_CWND && !val) {
+ NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
+ return -EINVAL;
+ }
metrics[type - 1] = val;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net v5] net: ipv4: add zero check for snd_cwnd_clamp
2026-10-19 22:25 [PATCH net v5] net: ipv4: add zero check for snd_cwnd_clamp Kaho Jiang
@ 2026-10-20 7:15 ` Jiayuan Chen
2026-10-20 10:31 ` Eric Dumazet
1 sibling, 0 replies; 3+ messages in thread
From: Jiayuan Chen @ 2026-10-20 7:15 UTC (permalink / raw)
To: netdev
On 10/20/26 6:25 AM, Kaho Jiang wrote:
> User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> This could lead to division of zero error if not checked properly.
>
> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> Call Trace:
> <IRQ>
> tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> __netif_receive_skb (net/core/dev.c:6410)
> process_backlog (net/core/dev.c:6761)
> __napi_poll.constprop.0 (net/core/dev.c:7830)
> net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> handle_softirqs (kernel/softirq.c:645)
> __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> irq_exit_rcu (kernel/softirq.c:775)
> sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
>
> Fix by checking if user pass in zero as parameter,
> if so reject the value zero.
>
> Fixes: 814d488c6126 ("tcp: fix the timid additive increase on stretch ACKs")
> Cc: stable@vger.kernel.org
> Reported-by: co+71b6509cb791e531@bugs.sh
> Assisted-by: LLM
> Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> ---
> include/net/tcp.h | 2 +-
> net/ipv4/metrics.c | 4 ++++
> 2 files changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 4416cdf9bf30..9f605d9ecb35 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -1522,7 +1522,7 @@ static inline u32 tcp_snd_cwnd(const struct tcp_sock *tp)
> static inline void tcp_snd_cwnd_set(struct tcp_sock *tp, u32 val)
> {
> WARN_ON_ONCE((int)val <= 0);
> - WRITE_ONCE(tp->snd_cwnd, val);
> + WRITE_ONCE(tp->snd_cwnd, max(val, 1U));
> }
>
> static inline bool tcp_in_slow_start(const struct tcp_sock *tp)
> diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> index ad40762a8b38..cb36686973e5 100644
> --- a/net/ipv4/metrics.c
> +++ b/net/ipv4/metrics.c
> @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> return -EINVAL;
> }
> + if (type == RTAX_CWND && !val) {
> + NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> + return -EINVAL;
> + }
> metrics[type - 1] = val;
> }
>
Have you checked the sashiko report listed in you previous version ?
https://lore.kernel.org/netdev/179236266579.3135.14593132945174653104@kernel.org/
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net v5] net: ipv4: add zero check for snd_cwnd_clamp
2026-10-19 22:25 [PATCH net v5] net: ipv4: add zero check for snd_cwnd_clamp Kaho Jiang
2026-10-20 7:15 ` Jiayuan Chen
@ 2026-10-20 10:31 ` Eric Dumazet
1 sibling, 0 replies; 3+ messages in thread
From: Eric Dumazet @ 2026-10-20 10:31 UTC (permalink / raw)
To: Kaho Jiang, ncardwell, kuniyu, davem, kuba, pabeni, horms,
edumazet
Cc: netdev, linux-kernel, co+71b6509cb791e531
On 10/20/26 00:25, Kaho Jiang wrote:
> User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> This could lead to division of zero error if not checked properly.
>
> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> Call Trace:
> <IRQ>
> tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> __netif_receive_skb (net/core/dev.c:6410)
> process_backlog (net/core/dev.c:6761)
> __napi_poll.constprop.0 (net/core/dev.c:7830)
> net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> handle_softirqs (kernel/softirq.c:645)
> __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> irq_exit_rcu (kernel/softirq.c:775)
> sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
>
> Fix by checking if user pass in zero as parameter,
> if so reject the value zero.
>
> Fixes: 814d488c6126 ("tcp: fix the timid additive increase on stretch ACKs")
> Cc: stable@vger.kernel.org
> Reported-by: co+71b6509cb791e531@bugs.sh
> Assisted-by: LLM
> Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> ---
> include/net/tcp.h | 2 +-
> net/ipv4/metrics.c | 4 ++++
> 2 files changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 4416cdf9bf30..9f605d9ecb35 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -1522,7 +1522,7 @@ static inline u32 tcp_snd_cwnd(const struct tcp_sock *tp)
> static inline void tcp_snd_cwnd_set(struct tcp_sock *tp, u32 val)
> {
> WARN_ON_ONCE((int)val <= 0);
> - WRITE_ONCE(tp->snd_cwnd, val);
> + WRITE_ONCE(tp->snd_cwnd, max(val, 1U));
No. Please do not hide bugs.
I repeat : Do not change tcp_snd_cwnd_set()
> }
>
> static inline bool tcp_in_slow_start(const struct tcp_sock *tp)
> diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> index ad40762a8b38..cb36686973e5 100644
> --- a/net/ipv4/metrics.c
> +++ b/net/ipv4/metrics.c
> @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> return -EINVAL;
> }
> + if (type == RTAX_CWND && !val) {
> + NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> + return -EINVAL;
> + }
> metrics[type - 1] = val;
> }
But is it really fixing anything ? I guess this is why you added the
max() in tcp_snd_cwnd_set() because you did not understand the issue.
An unlocked CWND of zero is harmless.
I think a better fix would be:
diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
index
ad40762a8b38379e4ccdc505e3885adb8dfff763..b7f8c47f72f9707adb4ef4dde5558af23b46a502
100644
--- a/net/ipv4/metrics.c
+++ b/net/ipv4/metrics.c
@@ -60,6 +60,12 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
if (ecn_ca)
metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
+ if ((metrics[RTAX_LOCK - 1] & (1 << RTAX_CWND)) &&
+ !metrics[RTAX_CWND - 1]) {
+ NL_SET_ERR_MSG(extack, "Locked cwnd metric must be non
zero");
+ return -EINVAL;
+ }
+
return 0;
}
Note that my email address is edumazet@kernel.org
Make sure to refresh your git tree, because git should have handled the
change automatically.
pw-bot: cr
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-20 10:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-19 22:25 [PATCH net v5] net: ipv4: add zero check for snd_cwnd_clamp Kaho Jiang
2026-10-20 7:15 ` Jiayuan Chen
2026-10-20 10:31 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox