]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
tcp: fix 0 divide in __tcp_select_window()
authorEric Dumazet <edumazet@google.com>
Wed, 1 Feb 2017 16:33:53 +0000 (08:33 -0800)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 16 Mar 2017 02:27:24 +0000 (02:27 +0000)
commitf8efa7a216b2c666727cc395b670575efeb33ef3
tree21bdcabbba92f6c82680a38d9e77f214dd3f015a
parente89ecd2cab25cfe85784b61b2e38a3686bc7ce09
tcp: fix 0 divide in __tcp_select_window()

[ Upstream commit 06425c308b92eaf60767bc71d359f4cbc7a561f8 ]

syszkaller fuzzer was able to trigger a divide by zero, when
TCP window scaling is not enabled.

SO_RCVBUF can be used not only to increase sk_rcvbuf, also
to decrease it below current receive buffers utilization.

If mss is negative or 0, just return a zero TCP window.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
net/ipv4/tcp_output.c