* [PATCH net] tcp: ignore locked zero CWND route metric
@ 2026-10-03 15:32 bestswngs
2026-10-03 16:10 ` Eric Dumazet
0 siblings, 1 reply; 4+ messages in thread
From: bestswngs @ 2026-10-03 15:32 UTC (permalink / raw)
To: edumazet, ncardwell, netdev
Cc: kuniyu, davem, horms, xmei5, co+71b6509cb791e531, Weiming Shi
From: Weiming Shi <bestswngs@gmail.com>
A locked RTAX_CWND route metric of zero is copied into the TCP metrics
cache and then into snd_cwnd_clamp. This sets the initial cwnd to zero.
With a cached SSTHRESH metric, a later Reno ACK can reach a divide by
zero in tcp_cong_avoid_ai(). A user with CAP_NET_ADMIN in a user-created
network namespace can trigger the oops.
Ignore a zero cached CWND metric when applying the locked clamp, leaving
the socket's initialized nonzero clamp in place.
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
Call Trace:
tcp_ack (net/ipv4/tcp_input.c:4440)
tcp_rcv_established (net/ipv4/tcp_input.c:6678)
tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
Kernel panic - not syncing: Fatal exception in interrupt
Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
Reported-by: <co+71b6509cb791e531@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
net/ipv4/tcp_metrics.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index dc0c081fc1f3..ff41804ad086 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -484,8 +484,11 @@ void tcp_init_metrics(struct sock *sk)
goto reset;
}
- if (tcp_metric_locked(tm, TCP_METRIC_CWND))
- tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND);
+ if (tcp_metric_locked(tm, TCP_METRIC_CWND)) {
+ val = tcp_metric_get(tm, TCP_METRIC_CWND);
+ if (val)
+ tp->snd_cwnd_clamp = val;
+ }
val = READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) ?
0 : tcp_metric_get(tm, TCP_METRIC_SSTHRESH);
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] tcp: ignore locked zero CWND route metric
2026-10-03 15:32 [PATCH net] tcp: ignore locked zero CWND route metric bestswngs
@ 2026-10-03 16:10 ` Eric Dumazet
2026-10-03 17:09 ` Eric Dumazet
0 siblings, 1 reply; 4+ messages in thread
From: Eric Dumazet @ 2026-10-03 16:10 UTC (permalink / raw)
To: bestswngs, ncardwell, netdev
Cc: kuniyu, davem, horms, xmei5, co+71b6509cb791e531
On 10/3/26 17:32, bestswngs@gmail.com wrote:
> From: Weiming Shi <bestswngs@gmail.com>
>
> A locked RTAX_CWND route metric of zero is copied into the TCP metrics
> cache and then into snd_cwnd_clamp. This sets the initial cwnd to zero.
> With a cached SSTHRESH metric, a later Reno ACK can reach a divide by
> zero in tcp_cong_avoid_ai(). A user with CAP_NET_ADMIN in a user-created
> network namespace can trigger the oops.
>
> Ignore a zero cached CWND metric when applying the locked clamp, leaving
> the socket's initialized nonzero clamp in place.
>
> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> Call Trace:
> tcp_ack (net/ipv4/tcp_input.c:4440)
> tcp_rcv_established (net/ipv4/tcp_input.c:6678)
> tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local
cache.")> Reported-by: <co+71b6509cb791e531@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
> net/ipv4/tcp_metrics.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
> index dc0c081fc1f3..ff41804ad086 100644
> --- a/net/ipv4/tcp_metrics.c
> +++ b/net/ipv4/tcp_metrics.c
> @@ -484,8 +484,11 @@ void tcp_init_metrics(struct sock *sk)
> goto reset;
> }
>
> - if (tcp_metric_locked(tm, TCP_METRIC_CWND))
> - tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND);
> + if (tcp_metric_locked(tm, TCP_METRIC_CWND)) {
> + val = tcp_metric_get(tm, TCP_METRIC_CWND);
Please explain how we can come to this situation?
cwnd can never be zero, so how a save metric could contain zero?
> + if (val)
> + tp->snd_cwnd_clamp = val;
> + }
>
> val = READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) ?
> 0 : tcp_metric_get(tm, TCP_METRIC_SSTHRESH);
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] tcp: ignore locked zero CWND route metric
2026-10-03 16:10 ` Eric Dumazet
@ 2026-10-03 17:09 ` Eric Dumazet
2026-10-04 16:51 ` Weiming Shi
0 siblings, 1 reply; 4+ messages in thread
From: Eric Dumazet @ 2026-10-03 17:09 UTC (permalink / raw)
To: bestswngs, ncardwell, netdev
Cc: kuniyu, davem, horms, xmei5, co+71b6509cb791e531
On 10/3/26 18:10, Eric Dumazet wrote:
>
>
> On 10/3/26 17:32, bestswngs@gmail.com wrote:
>> From: Weiming Shi <bestswngs@gmail.com>
>>
>> A locked RTAX_CWND route metric of zero is copied into the TCP metrics
>> cache and then into snd_cwnd_clamp. This sets the initial cwnd to zero.
>> With a cached SSTHRESH metric, a later Reno ACK can reach a divide by
>> zero in tcp_cong_avoid_ai(). A user with CAP_NET_ADMIN in a user-created
>> network namespace can trigger the oops.
>>
>> Ignore a zero cached CWND metric when applying the locked clamp, leaving
>> the socket's initialized nonzero clamp in place.
>>
>> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
>> RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
>> Call Trace:
>> tcp_ack (net/ipv4/tcp_input.c:4440)
>> tcp_rcv_established (net/ipv4/tcp_input.c:6678)
>> tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
>> tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
>> Kernel panic - not syncing: Fatal exception in interrupt
>>
> > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local
> cache.")> Reported-by: <co+71b6509cb791e531@bugs.sh>
>> Assisted-by: LLM
>> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
>> ---
>> net/ipv4/tcp_metrics.c | 7 +++++--
>> 1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
>> index dc0c081fc1f3..ff41804ad086 100644
>> --- a/net/ipv4/tcp_metrics.c
>> +++ b/net/ipv4/tcp_metrics.c
>> @@ -484,8 +484,11 @@ void tcp_init_metrics(struct sock *sk)
>> goto reset;
>> }
>> - if (tcp_metric_locked(tm, TCP_METRIC_CWND))
>> - tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND);
>> + if (tcp_metric_locked(tm, TCP_METRIC_CWND)) {
>> + val = tcp_metric_get(tm, TCP_METRIC_CWND);
>
> Please explain how we can come to this situation?
>
> cwnd can never be zero, so how a save metric could contain zero?
That is to say :
The right fix is in ip_metrics_convert(), one time instead of at each
TCP session init.
diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
index
ad40762a8b38379e4ccdc505e3885adb8dfff763..50a08e592b207e85ccc2bb6f917379de61af4579
100644
--- a/net/ipv4/metrics.c
+++ b/net/ipv4/metrics.c
@@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
NL_SET_ERR_MSG(extack, "Unknown flag set in
feature mask in metrics attribute");
return -EINVAL;
}
+ if ((type == RTAX_CWND || type == RTAX_INITCWND) && !val) {
+ NL_SET_ERR_MSG(extack, "CWND metric must be
greater than zero");
+ return -EINVAL;
+ }
metrics[type - 1] = val;
}
pw-bot: cr
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] tcp: ignore locked zero CWND route metric
2026-10-03 17:09 ` Eric Dumazet
@ 2026-10-04 16:51 ` Weiming Shi
0 siblings, 0 replies; 4+ messages in thread
From: Weiming Shi @ 2026-10-04 16:51 UTC (permalink / raw)
To: Eric Dumazet
Cc: ncardwell, netdev, kuniyu, davem, horms, xmei5,
co+71b6509cb791e531
Eric Dumazet <edumazet@kernel.org> 于2026年10月4日周日 01:09写道：
>
>
>
> On 10/3/26 18:10, Eric Dumazet wrote:
> >
> >
> > On 10/3/26 17:32, bestswngs@gmail.com wrote:
> >> From: Weiming Shi <bestswngs@gmail.com>
> >>
> >> A locked RTAX_CWND route metric of zero is copied into the TCP metrics
> >> cache and then into snd_cwnd_clamp. This sets the initial cwnd to zero.
> >> With a cached SSTHRESH metric, a later Reno ACK can reach a divide by
> >> zero in tcp_cong_avoid_ai(). A user with CAP_NET_ADMIN in a user-created
> >> network namespace can trigger the oops.
> >>
> >> Ignore a zero cached CWND metric when applying the locked clamp, leaving
> >> the socket's initialized nonzero clamp in place.
> >>
> >> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> >> RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> >> Call Trace:
> >> tcp_ack (net/ipv4/tcp_input.c:4440)
> >> tcp_rcv_established (net/ipv4/tcp_input.c:6678)
> >> tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> >> tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> >> Kernel panic - not syncing: Fatal exception in interrupt
> >>
> > > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local
> > cache.")> Reported-by: <co+71b6509cb791e531@bugs.sh>
> >> Assisted-by: LLM
> >> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> >> ---
> >> net/ipv4/tcp_metrics.c | 7 +++++--
> >> 1 file changed, 5 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
> >> index dc0c081fc1f3..ff41804ad086 100644
> >> --- a/net/ipv4/tcp_metrics.c
> >> +++ b/net/ipv4/tcp_metrics.c
> >> @@ -484,8 +484,11 @@ void tcp_init_metrics(struct sock *sk)
> >> goto reset;
> >> }
> >> - if (tcp_metric_locked(tm, TCP_METRIC_CWND))
> >> - tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND);
> >> + if (tcp_metric_locked(tm, TCP_METRIC_CWND)) {
> >> + val = tcp_metric_get(tm, TCP_METRIC_CWND);
> >
> > Please explain how we can come to this situation?
> >
> > cwnd can never be zero, so how a save metric could contain zero?
>
> That is to say :
>
> The right fix is in ip_metrics_convert(), one time instead of at each
> TCP session init.
>
> diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> index
> ad40762a8b38379e4ccdc505e3885adb8dfff763..50a08e592b207e85ccc2bb6f917379de61af4579
> 100644
> --- a/net/ipv4/metrics.c
> +++ b/net/ipv4/metrics.c
> @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> NL_SET_ERR_MSG(extack, "Unknown flag set in
> feature mask in metrics attribute");
> return -EINVAL;
> }
> + if ((type == RTAX_CWND || type == RTAX_INITCWND) && !val) {
> + NL_SET_ERR_MSG(extack, "CWND metric must be
> greater than zero");
> + return -EINVAL;
> + }
> metrics[type - 1] = val;
> }
>
> pw-bot: cr
>
Thanks for the review. v2 sent.
Best regards,
Weiming Shi
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-04 16:51 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-03 15:32 [PATCH net] tcp: ignore locked zero CWND route metric bestswngs
2026-10-03 16:10 ` Eric Dumazet
2026-10-03 17:09 ` Eric Dumazet
2026-10-04 16:51 ` Weiming Shi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox