Re: [PATCH net] net: ipv4: add zero check for snd_cwnd_clamp

[Kuniyuki Iwashima]

On Mon, Oct 12, 2026 at 6:03 PM Kaho Jiang <kj2864@xxxxxxx> wrote:
>
> User can pass zero to snd_cwnd_clamp via RTAX_CWND type.

We should reject it then instead of ignoring it later.


> This could lead to division of zero error if not checked properly.
>
> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> Call Trace:
>  <IRQ>
>  tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
>  tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
>  tcp_rcv_established (net/ipv4/tcp_input.c:6685)
>  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
>  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
>  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
>  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
>  ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
>  ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
>  __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
>  __netif_receive_skb (net/core/dev.c:6410)
>  process_backlog (net/core/dev.c:6761)
>  __napi_poll.constprop.0 (net/core/dev.c:7830)
>  net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
>  handle_softirqs (kernel/softirq.c:645)
>  __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
>  irq_exit_rcu (kernel/softirq.c:775)
>  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
>
> Fix by checking if user pass in zero as parameter,
> if so use the default value of snd_cwnd_clamp.
>
> Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: co+71b6509cb791e531@xxxxxxx
> Assisted-by: LLM
> Signed-off-by: Kaho Jiang <kj2864@xxxxxxx>
> ---
>  net/ipv4/tcp_metrics.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
> index dc0c081fc1f3..ff41804ad086 100644
> --- a/net/ipv4/tcp_metrics.c
> +++ b/net/ipv4/tcp_metrics.c
> @@ -484,8 +484,11 @@ void tcp_init_metrics(struct sock *sk)
>                 goto reset;
>         }
>
> -       if (tcp_metric_locked(tm, TCP_METRIC_CWND))
> -               tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND);
> +       if (tcp_metric_locked(tm, TCP_METRIC_CWND)) {
> +               val = tcp_metric_get(tm, TCP_METRIC_CWND);
> +               if (val)
> +                       tp->snd_cwnd_clamp = val;
> +       }
>
>         val = READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) ?
>               0 : tcp_metric_get(tm, TCP_METRIC_SSTHRESH);
> --
> 2.43.0
>