Re: [PATCH net-next v2 3/3] tcp_cubic: fix divide by zero and endless loop on bad module params

[Eric Dumazet]

On Thu, Oct 1, 2026 at 1:30 PM Jiayuan Chen <jiayuan.chen@xxxxxxxxx> wrote:
>
> beta_scale and cube_factor are computed once at module init. They need
> 1024 - beta to be positive and bic_scale * 10 to neither be 0 nor
> overflow: beta == 1024 or bic_scale == 0 crash right there, and other
> out of range values give garbage. Negative beta can also make
> beta_scale 0. Reject them.
>
> A small beta also gives a small beta_scale, and (cwnd * beta_scale) >> 3
> truncates to 0 for a tiny cwnd, so the TCP friendliness loop never
> ends. Make sure beta_scale is at least 8 at init, so this is always
> >= 1 with cwnd >= 1 and the fast path is untouched.
> This also caps alpha_cubic at 1 for beta < 512, which only affects
> such unusual settings.
>
> Fixes: df3271f3361b ("[TCP] BIC: CUBIC window growth (2.0)")
> Suggested-by: Eric Dumazet <edumazet@xxxxxxxxxx>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
> ---
> Target net-next since it is not a big problem.
> ---
>  net/ipv4/tcp_cubic.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
> index 119bf8cbb007c..33b383e1307fb 100644
> --- a/net/ipv4/tcp_cubic.c
> +++ b/net/ipv4/tcp_cubic.c
> @@ -504,12 +504,21 @@ static int __init cubictcp_register(void)
>
>         BUILD_BUG_ON(sizeof(struct bictcp) > ICSK_CA_PRIV_SIZE);
>

A READ_ONCE(beta) is needed to close a race when/if TCP_CONG_CUBIC is a module.

This can be done later as a follow up, the window is extremely tiny
and most builds
have CONFIG_TCP_CONG_CUBIC=y (and CONFIG_DEFAULT_CUBIC=y)

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>