* [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp
@ 2026-10-14 19:56 Kaho Jiang
2026-10-15 9:57 ` Antoine Tenart
0 siblings, 1 reply; 5+ messages in thread
From: Kaho Jiang @ 2026-10-14 19:56 UTC (permalink / raw)
To: ncardwell, kuniyu, davem, kuba, pabeni, horms, edumazet
Cc: netdev, linux-kernel, co+71b6509cb791e531, Kaho Jiang, stable
User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
This could lead to division of zero error if not checked properly.
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
Call Trace:
<IRQ>
tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
tcp_rcv_established (net/ipv4/tcp_input.c:6685)
tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
__netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
__netif_receive_skb (net/core/dev.c:6410)
process_backlog (net/core/dev.c:6761)
__napi_poll.constprop.0 (net/core/dev.c:7830)
net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
handle_softirqs (kernel/softirq.c:645)
__irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
irq_exit_rcu (kernel/softirq.c:775)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
Fix by checking if user pass in zero as parameter,
if so reject the value zero.
Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
Cc: stable@vger.kernel.org
Reported-by: co+71b6509cb791e531@bugs.sh
Assisted-by: LLM
Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
---
net/ipv4/metrics.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
index ad40762a8b38..e83a129a25b6 100644
--- a/net/ipv4/metrics.c
+++ b/net/ipv4/metrics.c
@@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
return -EINVAL;
}
+ if (type == RTAX_CWND && val == 0) {
+ NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
+ return -EINVAL;
+ }
metrics[type - 1] = val;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp
2026-10-14 19:56 [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp Kaho Jiang
@ 2026-10-15 9:57 ` Antoine Tenart
2026-10-15 16:57 ` Jerry Jiang
0 siblings, 1 reply; 5+ messages in thread
From: Antoine Tenart @ 2026-10-15 9:57 UTC (permalink / raw)
To: Kaho Jiang
Cc: ncardwell, kuniyu, davem, kuba, pabeni, horms, edumazet, netdev,
linux-kernel, co+71b6509cb791e531, stable
On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> This could lead to division of zero error if not checked properly.
>
> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> Call Trace:
> <IRQ>
> tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> __netif_receive_skb (net/core/dev.c:6410)
> process_backlog (net/core/dev.c:6761)
> __napi_poll.constprop.0 (net/core/dev.c:7830)
> net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> handle_softirqs (kernel/softirq.c:645)
> __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> irq_exit_rcu (kernel/softirq.c:775)
> sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
>
> Fix by checking if user pass in zero as parameter,
> if so reject the value zero.
>
> Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
This looks like a refactoring commit only, 814d488c6126 might be more
appropriate but please check.
> Cc: stable@vger.kernel.org
> Reported-by: co+71b6509cb791e531@bugs.sh
> Assisted-by: LLM
> Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> ---
> net/ipv4/metrics.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> index ad40762a8b38..e83a129a25b6 100644
> --- a/net/ipv4/metrics.c
> +++ b/net/ipv4/metrics.c
> @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> return -EINVAL;
> }
> + if (type == RTAX_CWND && val == 0) {
> + NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> + return -EINVAL;
> + }
> metrics[type - 1] = val;
> }
My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
0 occurs in tcp_cong_avoid_ai. Have you also considered updating
tcp_snd_cwnd_set to not only warn about invalid values but also reject
them, preventing similar oops?
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp
2026-10-15 9:57 ` Antoine Tenart
@ 2026-10-15 16:57 ` Jerry Jiang
2026-10-15 20:18 ` Jerry Jiang
2026-10-16 7:29 ` Antoine Tenart
0 siblings, 2 replies; 5+ messages in thread
From: Jerry Jiang @ 2026-10-15 16:57 UTC (permalink / raw)
To: Antoine Tenart
Cc: ncardwell, kuniyu, davem, kuba, pabeni, horms, edumazet, netdev,
linux-kernel, co+71b6509cb791e531, stable
I have considered rejecting 0 in tcp_snd_cwnd_set but afaik patching
tcp_snd_cwnd only would just ignore the problem. My current patch
should completely reject the user from creating a socket if 0 is
passed for RTAX_CWND.
On Thu, Oct 15, 2026 at 5:57 AM Antoine Tenart <atenart@kernel.org> wrote:
>
> On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > This could lead to division of zero error if not checked properly.
> >
> > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > Call Trace:
> > <IRQ>
> > tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> > tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> > tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> > tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> > tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> > ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> > ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> > ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> > ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> > __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> > __netif_receive_skb (net/core/dev.c:6410)
> > process_backlog (net/core/dev.c:6761)
> > __napi_poll.constprop.0 (net/core/dev.c:7830)
> > net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> > handle_softirqs (kernel/softirq.c:645)
> > __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> > irq_exit_rcu (kernel/softirq.c:775)
> > sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> >
> > Fix by checking if user pass in zero as parameter,
> > if so reject the value zero.
> >
> > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
>
> This looks like a refactoring commit only, 814d488c6126 might be more
> appropriate but please check.
>
> > Cc: stable@vger.kernel.org
> > Reported-by: co+71b6509cb791e531@bugs.sh
> > Assisted-by: LLM
> > Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> > ---
> > net/ipv4/metrics.c | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > index ad40762a8b38..e83a129a25b6 100644
> > --- a/net/ipv4/metrics.c
> > +++ b/net/ipv4/metrics.c
> > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> > NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> > return -EINVAL;
> > }
> > + if (type == RTAX_CWND && val == 0) {
> > + NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > + return -EINVAL;
> > + }
> > metrics[type - 1] = val;
> > }
>
> My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
> 0 occurs in tcp_cong_avoid_ai. Have you also considered updating
> tcp_snd_cwnd_set to not only warn about invalid values but also reject
> them, preventing similar oops?
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp
2026-10-15 16:57 ` Jerry Jiang
@ 2026-10-15 20:18 ` Jerry Jiang
2026-10-16 7:29 ` Antoine Tenart
1 sibling, 0 replies; 5+ messages in thread
From: Jerry Jiang @ 2026-10-15 20:18 UTC (permalink / raw)
To: Antoine Tenart
Cc: ncardwell, kuniyu, davem, kuba, pabeni, horms, edumazet, netdev,
linux-kernel, co+71b6509cb791e531, stable
You are right to point out the refactoring commit, 814d488c6126 would
be more suitable for this.
v3 has been proposed:
https://lore.kernel.org/all/20261015201549.4023-2-kj2864@nyu.edu/
On Thu, Oct 15, 2026 at 12:57 PM Jerry Jiang <kj2864@nyu.edu> wrote:
>
> I have considered rejecting 0 in tcp_snd_cwnd_set but afaik patching
> tcp_snd_cwnd only would just ignore the problem. My current patch
> should completely reject the user from creating a socket if 0 is
> passed for RTAX_CWND.
>
>
> On Thu, Oct 15, 2026 at 5:57 AM Antoine Tenart <atenart@kernel.org> wrote:
> >
> > On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> > > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > > This could lead to division of zero error if not checked properly.
> > >
> > > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > > Call Trace:
> > > <IRQ>
> > > tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> > > tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> > > tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> > > tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> > > tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> > > ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> > > ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> > > ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> > > ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> > > __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> > > __netif_receive_skb (net/core/dev.c:6410)
> > > process_backlog (net/core/dev.c:6761)
> > > __napi_poll.constprop.0 (net/core/dev.c:7830)
> > > net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> > > handle_softirqs (kernel/softirq.c:645)
> > > __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> > > irq_exit_rcu (kernel/softirq.c:775)
> > > sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> > >
> > > Fix by checking if user pass in zero as parameter,
> > > if so reject the value zero.
> > >
> > > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
> >
> > This looks like a refactoring commit only, 814d488c6126 might be more
> > appropriate but please check.
> >
> > > Cc: stable@vger.kernel.org
> > > Reported-by: co+71b6509cb791e531@bugs.sh
> > > Assisted-by: LLM
> > > Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> > > ---
> > > net/ipv4/metrics.c | 4 ++++
> > > 1 file changed, 4 insertions(+)
> > >
> > > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > > index ad40762a8b38..e83a129a25b6 100644
> > > --- a/net/ipv4/metrics.c
> > > +++ b/net/ipv4/metrics.c
> > > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> > > NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> > > return -EINVAL;
> > > }
> > > + if (type == RTAX_CWND && val == 0) {
> > > + NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > > + return -EINVAL;
> > > + }
> > > metrics[type - 1] = val;
> > > }
> >
> > My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
> > 0 occurs in tcp_cong_avoid_ai. Have you also considered updating
> > tcp_snd_cwnd_set to not only warn about invalid values but also reject
> > them, preventing similar oops?
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp
2026-10-15 16:57 ` Jerry Jiang
2026-10-15 20:18 ` Jerry Jiang
@ 2026-10-16 7:29 ` Antoine Tenart
1 sibling, 0 replies; 5+ messages in thread
From: Antoine Tenart @ 2026-10-16 7:29 UTC (permalink / raw)
To: Jerry Jiang
Cc: ncardwell, kuniyu, davem, kuba, pabeni, horms, edumazet, netdev,
linux-kernel, co+71b6509cb791e531, stable
On Thu, Oct 15, 2026 at 12:57:51PM -0400, Jerry Jiang wrote:
> I have considered rejecting 0 in tcp_snd_cwnd_set but afaik patching
> tcp_snd_cwnd only would just ignore the problem. My current patch
> should completely reject the user from creating a socket if 0 is
> passed for RTAX_CWND.
I'm not arguing against the current patch. My point is warning on 0
values in tcp_snd_cwnd_set made sense before but since this is now known
to cause oops there might be something better to do there.
> On Thu, Oct 15, 2026 at 5:57 AM Antoine Tenart <atenart@kernel.org> wrote:
> >
> > On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> > > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > > This could lead to division of zero error if not checked properly.
> > >
> > > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > > Call Trace:
> > > <IRQ>
> > > tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> > > tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> > > tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> > > tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> > > tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> > > ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> > > ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> > > ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> > > ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> > > __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> > > __netif_receive_skb (net/core/dev.c:6410)
> > > process_backlog (net/core/dev.c:6761)
> > > __napi_poll.constprop.0 (net/core/dev.c:7830)
> > > net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> > > handle_softirqs (kernel/softirq.c:645)
> > > __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> > > irq_exit_rcu (kernel/softirq.c:775)
> > > sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> > >
> > > Fix by checking if user pass in zero as parameter,
> > > if so reject the value zero.
> > >
> > > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
> >
> > This looks like a refactoring commit only, 814d488c6126 might be more
> > appropriate but please check.
> >
> > > Cc: stable@vger.kernel.org
> > > Reported-by: co+71b6509cb791e531@bugs.sh
> > > Assisted-by: LLM
> > > Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
> > > ---
> > > net/ipv4/metrics.c | 4 ++++
> > > 1 file changed, 4 insertions(+)
> > >
> > > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > > index ad40762a8b38..e83a129a25b6 100644
> > > --- a/net/ipv4/metrics.c
> > > +++ b/net/ipv4/metrics.c
> > > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> > > NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> > > return -EINVAL;
> > > }
> > > + if (type == RTAX_CWND && val == 0) {
> > > + NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > > + return -EINVAL;
> > > + }
> > > metrics[type - 1] = val;
> > > }
> >
> > My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
> > 0 occurs in tcp_cong_avoid_ai. Have you also considered updating
> > tcp_snd_cwnd_set to not only warn about invalid values but also reject
> > them, preventing similar oops?
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-16 7:29 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-14 19:56 [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp Kaho Jiang
2026-10-15 9:57 ` Antoine Tenart
2026-10-15 16:57 ` Jerry Jiang
2026-10-15 20:18 ` Jerry Jiang
2026-10-16 7:29 ` Antoine Tenart
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox