tcp: fix 0 divide in __tcp_select_window()
authorEric Dumazet <edumazet@google.com>
Wed, 1 Feb 2017 16:33:53 +0000 (08:33 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 18 Feb 2017 15:39:26 +0000 (16:39 +0100)
commitf3ece3b38437fd06b60a74cd640d95f8d32f5b96
treeb3db8741fa60501fe94b8bf3bc3cacb134571c67
parent3f5b5134ec7c9418415e4e660adebe6c6ec112fd
tcp: fix 0 divide in __tcp_select_window()

[ Upstream commit 06425c308b92eaf60767bc71d359f4cbc7a561f8 ]

syszkaller fuzzer was able to trigger a divide by zero, when
TCP window scaling is not enabled.

SO_RCVBUF can be used not only to increase sk_rcvbuf, also
to decrease it below current receive buffers utilization.

If mss is negative or 0, just return a zero TCP window.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/ipv4/tcp_output.c