From: Antoine Tenart <atenart@kernel.org>
To: Kaho Jiang <kj2864@nyu.edu>
Cc: ncardwell@google.com, kuniyu@google.com, davem@davemloft.net,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org,
edumazet@google.com, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, co+71b6509cb791e531@bugs.sh,
stable@vger.kernel.org
Subject: Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp
Date: Thu, 15 Oct 2026 11:57:45 +0200 [thread overview]
Message-ID: <atCf_85Ei_J9CDtd@kwain> (raw)
In-Reply-To: <20261014195640.430824-2-kj2864@nyu.edu>
On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> This could lead to division of zero error if not checked properly.
>
> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> Call Trace:
> <IRQ>
> tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> __netif_receive_skb (net/core/dev.c:6410)
> process_backlog (net/core/dev.c:6761)
> __napi_poll.constprop.0 (net/core/dev.c:7830)
> net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> handle_softirqs (kernel/softirq.c:645)
> __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> irq_exit_rcu (kernel/softirq.c:775)
> sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
>
> Fix by checking if user pass in zero as parameter,
> if so reject the value zero.
>
> Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
This looks like a refactoring commit only, 814d488c6126 might be more
appropriate but please check.
> Cc: stable@vger.kernel.org
> Reported-by: co+71b6509cb791e531@bugs.sh
> Assisted-by: LLM
> Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> ---
> net/ipv4/metrics.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> index ad40762a8b38..e83a129a25b6 100644
> --- a/net/ipv4/metrics.c
> +++ b/net/ipv4/metrics.c
> @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> return -EINVAL;
> }
> + if (type == RTAX_CWND && val == 0) {
> + NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> + return -EINVAL;
> + }
> metrics[type - 1] = val;
> }
My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
0 occurs in tcp_cong_avoid_ai. Have you also considered updating
tcp_snd_cwnd_set to not only warn about invalid values but also reject
them, preventing similar oops?
prev parent reply other threads:[~2026-10-15 9:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-14 19:56 [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp Kaho Jiang
2026-10-15 9:57 ` Antoine Tenart [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=atCf_85Ei_J9CDtd@kwain \
--to=atenart@kernel.org \
--cc=co+71b6509cb791e531@bugs.sh \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kj2864@nyu.edu \
--cc=kuba@kernel.org \
--cc=kuniyu@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=ncardwell@google.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox