From f09eb97322b16a6f709a47599c95b62f786905f9 Mon Sep 17 00:00:00 2001 From: Jiayuan Chen Date: Thu, 8 Oct 2026 17:26:35 +0800 Subject: [PATCH] tcp_hybla: fix divide by zero on rtt0 == 0 rtt0 is the reference RTT in ms, so 0 makes no sense, and hybla_recalc_param() divides by it right from hybla_init(). Reject values below 1 when the parameter is written. Also cap it at U32_MAX / USEC_PER_MSEC, since rtt0 * USEC_PER_MSEC can wrap to 0 on 32-bit. An rtt0 above that (about 71 minutes) makes no sense anyway. Fixes: 835b3f0c0d7e ("[TCP]: Add TCP Hybla congestion control module.") Fixes: 740b0f1841f6 ("tcp: switch rtt estimations to usec resolution") Reported-by: VEGA Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20261008092641.140777-3-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni --- net/ipv4/tcp_hybla.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c index abd7d91807e5..b9b482180d30 100644 --- a/net/ipv4/tcp_hybla.c +++ b/net/ipv4/tcp_hybla.c @@ -26,8 +26,20 @@ struct hybla { }; /* Hybla reference round trip time (default= 1/40 sec = 25 ms), in ms */ -static int rtt0 = 25; -module_param(rtt0, int, 0644); +static unsigned int rtt0 = 25; + +static int rtt0_set(const char *val, const struct kernel_param *kp) +{ + /* avoid rtt0 * USEC_PER_MSEC overflow */ + return param_set_uint_minmax(val, kp, 1, U32_MAX / USEC_PER_MSEC); +} + +static const struct kernel_param_ops rtt0_ops = { + .set = rtt0_set, + .get = param_get_uint, +}; + +module_param_cb(rtt0, &rtt0_ops, &rtt0, 0644); MODULE_PARM_DESC(rtt0, "reference rout trip time (ms)"); /* This is called to refresh values for hybla parameters */