From: Willy Tarreau Date: Thu, 6 Aug 2026 07:45:26 +0000 (+0200) Subject: BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b644541e0f3b7e4bb9b41c0b7c0c24f62f6c61fd;p=thirdparty%2Fhaproxy.git BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval bbr_pacing_inter() divides by the connection's pacing rate without checking it. That rate is recomputed as a truncated integer product of the estimated bandwidth by the pacing gain, and once full bandwidth has been reached the new value is stored unconditionally, even when it truncated down to zero. So a QUIC peer that acknowledges slowly and sparsely enough to drive the bandwidth estimate down to a single byte per second, then lets the connection leave Startup, makes the next pacing computation divide by zero. The resulting SIGFPE is not caught, so it takes down the whole worker along with every connection it was serving, which any remote QUIC client controls the conditions of. Let's floor the divisor at 1, as the default pacing helper effectively does. Must be backported as far as 3.1. Reported-by: Claude (ANT-2026-6B82W4A7) --- diff --git a/src/quic_cc_bbr.c b/src/quic_cc_bbr.c index 235b46bf1..f28149704 100644 --- a/src/quic_cc_bbr.c +++ b/src/quic_cc_bbr.c @@ -1470,7 +1470,8 @@ uint bbr_pacing_inter(const struct quic_cc *cc) struct bbr *bbr = quic_cc_priv(cc); struct quic_cc_path *p = container_of(cc, struct quic_cc_path, cc); - return p->mtu * 1000000000 / bbr->pacing_rate; + /* the rate may be truncated down to zero for very low bandwidths */ + return p->mtu * 1000000000 / (bbr->pacing_rate ? bbr->pacing_rate : 1); } /* Return the pacing burst size in datagrams */