Message ID | 1485966833.6360.149.camel@edumazet-glaptop3.roam.corp.google.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
On Wed, Feb 1, 2017 at 11:33 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > > From: Eric Dumazet <edumazet@google.com> > > syszkaller fuzzer was able to trigger a divide by zero, when > TCP window scaling is not enabled. > > SO_RCVBUF can be used not only to increase sk_rcvbuf, also > to decrease it below current receive buffers utilization. > > If mss is negative or 0, just return a zero TCP window. > > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Dmitry Vyukov <dvyukov@google.com> > --- Acked-by: Neal Cardwell <ncardwell@google.com> Thanks, Eric! neal
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Wed, 01 Feb 2017 08:33:53 -0800 > From: Eric Dumazet <edumazet@google.com> > > syszkaller fuzzer was able to trigger a divide by zero, when > TCP window scaling is not enabled. > > SO_RCVBUF can be used not only to increase sk_rcvbuf, also > to decrease it below current receive buffers utilization. > > If mss is negative or 0, just return a zero TCP window. > > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Dmitry Vyukov <dvyukov@google.com> > --- > No Fixes: tag, this is a day-0 bug. Applied and queued up for -stable, thanks Eric.
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 1d5331a1b1dc2677316148ba9852c191e7ed0fd4..8ce50dc3ab8cac821b8a2c3e0d31f0aa42f5c9d5 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2518,9 +2518,11 @@ u32 __tcp_select_window(struct sock *sk) int full_space = min_t(int, tp->window_clamp, allowed_space); int window; - if (mss > full_space) + if (unlikely(mss > full_space)) { mss = full_space; - + if (mss <= 0) + return 0; + } if (free_space < (full_space >> 1)) { icsk->icsk_ack.quick = 0;