Re: [PATCH net] tcp: ignore locked zero CWND route metric

[Eric Dumazet <edumazet@kernel.org>]

On 10/3/26 17:32, bestswngs@gmail.com wrote:
> From: Weiming Shi <bestswngs@gmail.com>
> 
> A locked RTAX_CWND route metric of zero is copied into the TCP metrics
> cache and then into snd_cwnd_clamp. This sets the initial cwnd to zero.
> With a cached SSTHRESH metric, a later Reno ACK can reach a divide by
> zero in tcp_cong_avoid_ai(). A user with CAP_NET_ADMIN in a user-created
> network namespace can trigger the oops.
> 
> Ignore a zero cached CWND metric when applying the locked clamp, leaving
> the socket's initialized nonzero clamp in place.
> 
>    Oops: divide error: 0000 [#1] SMP KASAN NOPTI
>    RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
>    Call Trace:
>    tcp_ack (net/ipv4/tcp_input.c:4440)
>    tcp_rcv_established (net/ipv4/tcp_input.c:6678)
>    tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
>    tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
>    Kernel panic - not syncing: Fatal exception in interrupt
> 
 > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local 
cache.")> Reported-by: <co+71b6509cb791e531@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
>   net/ipv4/tcp_metrics.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
> index dc0c081fc1f3..ff41804ad086 100644
> --- a/net/ipv4/tcp_metrics.c
> +++ b/net/ipv4/tcp_metrics.c
> @@ -484,8 +484,11 @@ void tcp_init_metrics(struct sock *sk)
>   		goto reset;
>   	}
>   
> -	if (tcp_metric_locked(tm, TCP_METRIC_CWND))
> -		tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND);
> +	if (tcp_metric_locked(tm, TCP_METRIC_CWND)) {
> +		val = tcp_metric_get(tm, TCP_METRIC_CWND);

Please explain how we can come to this situation?

cwnd can never be zero, so how a save metric could contain zero?


> +		if (val)
> +			tp->snd_cwnd_clamp = val;
> +	}
>   
>   	val = READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) ?
>   	      0 : tcp_metric_get(tm, TCP_METRIC_SSTHRESH);