Re: [PATCH net v2] net: ipv4: add zero check for snd_cwnd_clamp

[Jerry Jiang]

I stand corrected, by not passing any argument to RTAX_CWND, the bug
can still be triggered. Doing fixes on tcp_snd_cwnd_set would be
valuable. One idea I have is that if 0 is passed in tcp_snd_cwnd_set,
a default value of 1 is written instead of writing 0.

v4 has been proposed:
https://lore.kernel.org/all/20261017214845.28769-2-kj2864@xxxxxxx/





On Sat, Oct 17, 2026 at 12:12 PM Jerry Jiang <kj2864@xxxxxxx> wrote:
>
> Afaik, I don't think any changes are necessary to tcp_snd_cwnd_set as
> users are completely rejected from inputting 0, which could give the
> assumption argument passed to tcp_snd_cwnd_set is a number larger than
> 0.
>
>
> On Fri, Oct 16, 2026 at 3:29 AM Antoine Tenart <atenart@xxxxxxxxxx> wrote:
> >
> > On Thu, Oct 15, 2026 at 12:57:51PM -0400, Jerry Jiang wrote:
> > > I have considered rejecting 0 in tcp_snd_cwnd_set but afaik patching
> > > tcp_snd_cwnd only would just ignore the problem. My current patch
> > > should completely reject the user from creating a socket if 0 is
> > > passed for RTAX_CWND.
> >
> > I'm not arguing against the current patch. My point is warning on 0
> > values in tcp_snd_cwnd_set made sense before but since this is now known
> > to cause oops there might be something better to do there.
> >
> > > On Thu, Oct 15, 2026 at 5:57 AM Antoine Tenart <atenart@xxxxxxxxxx> wrote:
> > > >
> > > > On Wed, Oct 14, 2026 at 03:56:41PM -0400, Kaho Jiang wrote:
> > > > > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > > > > This could lead to division of zero error if not checked properly.
> > > > >
> > > > > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > > > > Call Trace:
> > > > >  <IRQ>
> > > > >  tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> > > > >  tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> > > > >  tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> > > > >  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> > > > >  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> > > > >  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> > > > >  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> > > > >  ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> > > > >  ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> > > > >  __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> > > > >  __netif_receive_skb (net/core/dev.c:6410)
> > > > >  process_backlog (net/core/dev.c:6761)
> > > > >  __napi_poll.constprop.0 (net/core/dev.c:7830)
> > > > >  net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> > > > >  handle_softirqs (kernel/softirq.c:645)
> > > > >  __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> > > > >  irq_exit_rcu (kernel/softirq.c:775)
> > > > >  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > > > > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> > > > >
> > > > > Fix by checking if user pass in zero as parameter,
> > > > > if so reject the value zero.
> > > > >
> > > > > Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
> > > >
> > > > This looks like a refactoring commit only, 814d488c6126 might be more
> > > > appropriate but please check.
> > > >
> > > > > Cc: stable@xxxxxxxxxxxxxxx
> > > > > Reported-by: co+71b6509cb791e531@xxxxxxx
> > > > > Assisted-by: LLM
> > > > > Signed-off-by: Kaho Jiang <kj2864@xxxxxxx>
> > > > > ---
> > > > >  net/ipv4/metrics.c | 4 ++++
> > > > >  1 file changed, 4 insertions(+)
> > > > >
> > > > > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > > > > index ad40762a8b38..e83a129a25b6 100644
> > > > > --- a/net/ipv4/metrics.c
> > > > > +++ b/net/ipv4/metrics.c
> > > > > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> > > > >                       NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> > > > >                       return -EINVAL;
> > > > >               }
> > > > > +             if (type == RTAX_CWND && val == 0) {
> > > > > +                     NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > > > > +                     return -EINVAL;
> > > > > +             }
> > > > >               metrics[type - 1] = val;
> > > > >       }
> > > >
> > > > My understanding is tcp_snd_cwnd(tp) can return 0 and then the divide by
> > > > 0 occurs in tcp_cong_avoid_ai. Have you also considered updating
> > > > tcp_snd_cwnd_set to not only warn about invalid values but also reject
> > > > them, preventing similar oops?