Re: [PATCH net v5] net: ipv4: add zero check for snd_cwnd_clamp

[Jerry Jiang]

My apologies, I didn't fully understand the issue and naively
implemented a fix in tcp_snd_cwnd_set. I've tested the patch you've
given and I believe it should fix the underlying issue, thank you for
the support to help me understand the true issue.

Here is the v6 proposal:
https://lore.kernel.org/all/20261021235732.1313305-2-kj2864@xxxxxxx/



On Tue, Oct 20, 2026 at 6:31 AM Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
>
>
>
> On 10/20/26 00:25, Kaho Jiang wrote:
> > User can pass zero to snd_cwnd_clamp via RTAX_CWND type.
> > This could lead to division of zero error if not checked properly.
> >
> > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > Call Trace:
> >   <IRQ>
> >   tcp_reno_cong_avoid (net/ipv4/tcp_cong.c:510 (discriminator 1))
> >   tcp_ack (net/ipv4/tcp_input.c:3517 net/ipv4/tcp_input.c:3873 net/ipv4/tcp_input.c:4440)
> >   tcp_rcv_established (net/ipv4/tcp_input.c:6685)
> >   tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1854)
> >   tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2248)
> >   ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 1))
> >   ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
> >   ip_local_deliver (./include/linux/netfilter.h:325 ./include/linux/netfilter.h:319 net/ipv4/ip_input.c:262)
> >   ip_rcv (./include/net/dst.h:481 (discriminator 6) net/ipv4/ip_input.c:492 (discriminator 6) ./include/linux/netfilter.h:325 (discriminator 6) ./include/li)
> >   __netif_receive_skb_one_core (net/core/dev.c:6297 (discriminator 4))
> >   __netif_receive_skb (net/core/dev.c:6410)
> >   process_backlog (net/core/dev.c:6761)
> >   __napi_poll.constprop.0 (net/core/dev.c:7830)
> >   net_rx_action (net/core/dev.c:7893 net/core/dev.c:8050)
> >   handle_softirqs (kernel/softirq.c:645)
> >   __irq_exit_rcu (kernel/softirq.c:679 kernel/softirq.c:519 kernel/softirq.c:758)
> >   irq_exit_rcu (kernel/softirq.c:775)
> >   sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 35) arch/x86/kernel/apic/apic.c:1062 (discriminator 35))
> > RIP: 0010:tcp_cong_avoid_ai (net/ipv4/tcp_cong.c:482)
> >
> > Fix by checking if user pass in zero as parameter,
> > if so reject the value zero.
> >
> > Fixes: 814d488c6126 ("tcp: fix the timid additive increase on stretch ACKs")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Reported-by: co+71b6509cb791e531@xxxxxxx
> > Assisted-by: LLM
> > Signed-off-by: Kaho Jiang <kj2864@xxxxxxx>
> > ---
> >   include/net/tcp.h  | 2 +-
> >   net/ipv4/metrics.c | 4 ++++
> >   2 files changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/include/net/tcp.h b/include/net/tcp.h
> > index 4416cdf9bf30..9f605d9ecb35 100644
> > --- a/include/net/tcp.h
> > +++ b/include/net/tcp.h
> > @@ -1522,7 +1522,7 @@ static inline u32 tcp_snd_cwnd(const struct tcp_sock *tp)
> >   static inline void tcp_snd_cwnd_set(struct tcp_sock *tp, u32 val)
> >   {
> >       WARN_ON_ONCE((int)val <= 0);
> > -     WRITE_ONCE(tp->snd_cwnd, val);
> > +     WRITE_ONCE(tp->snd_cwnd, max(val, 1U));
>
> No. Please do not hide bugs.
>
> I repeat : Do not change tcp_snd_cwnd_set()
>
> >   }
> >
> >   static inline bool tcp_in_slow_start(const struct tcp_sock *tp)
> > diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> > index ad40762a8b38..cb36686973e5 100644
> > --- a/net/ipv4/metrics.c
> > +++ b/net/ipv4/metrics.c
> > @@ -54,6 +54,10 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
> >                       NL_SET_ERR_MSG(extack, "Unknown flag set in feature mask in metrics attribute");
> >                       return -EINVAL;
> >               }
> > +             if (type == RTAX_CWND && !val) {
> > +                     NL_SET_ERR_MSG(extack, "RTAX_CWND must be greater than zero");
> > +                     return -EINVAL;
> > +             }
> >               metrics[type - 1] = val;
> >       }
>
> But is it really fixing anything ? I guess this is why you added the
> max() in tcp_snd_cwnd_set() because you did not understand the issue.
>
> An unlocked CWND of zero is harmless.
>
> I think a better fix would be:
>
> diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
> index
> ad40762a8b38379e4ccdc505e3885adb8dfff763..b7f8c47f72f9707adb4ef4dde5558af23b46a502
> 100644
> --- a/net/ipv4/metrics.c
> +++ b/net/ipv4/metrics.c
> @@ -60,6 +60,12 @@ static int ip_metrics_convert(struct nlattr *fc_mx,
>          if (ecn_ca)
>                  metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
>
> +       if ((metrics[RTAX_LOCK - 1] & (1 << RTAX_CWND)) &&
> +           !metrics[RTAX_CWND - 1]) {
> +               NL_SET_ERR_MSG(extack, "Locked cwnd metric must be non
> zero");
> +               return -EINVAL;
> +       }
> +
>          return 0;
>   }
>
>
>
>
> Note that my email address is edumazet@xxxxxxxxxx
>
> Make sure to refresh your git tree, because git should have handled the
> change automatically.
>
> pw-bot: cr
>