[PATCH net] tcp: bound snd_cwnd_clamp to TCP_MAX_SND_CWND
flat view
HOTtoday
From: Eric Dumazet <edumazet@kernel.org>
Date: 2026-10-27 13:06:22
Subsystem:
bpf [general] (safe dynamic programs and tools), bpf [networking] (tcx & tc bpf, sock_addr), networking [general], networking [tcp], the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Neal Cardwell, Linus Torvalds
snd_cwnd has no practical upper bound: snd_cwnd_clamp defaults to ~0,
and RTAX_INITCWND, a locked RTAX_CWND metric, TCP_BPF_IW and
TCP_BPF_SNDCWND_CLAMP accept any positive value.
Congestion control modules do u32 arithmetic on cwnd that assumes
much smaller values, and can misbehave if cwnd gets too big.
The paths that can grow cwnd by large amounts (tcp_slow_start(),
tcp_cong_avoid_ai(), bbr_set_cwnd() and tcp_init_cwnd()) already
bound it by snd_cwnd_clamp, so give snd_cwnd_clamp a finite default
of 2^24 packets, and cap the metric and BPF paths that set it or set
cwnd directly.
2^24 packets is more than 24GB in flight with a 1448 byte MSS, well
above what any sk_sndbuf allows.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Chris Mason <mason@kernel.org>
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
include/net/tcp.h | 6 ++++++
net/core/filter.c | 3 ++-
net/ipv4/tcp.c | 2 +-
net/ipv4/tcp_metrics.c | 3 ++-
4 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 0265c27a5fd77df8a86991e364ec7caff3a7ea0d..be1609cd78840cfb1da75517273be0d64f4c3981 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h@@ -1553,6 +1553,12 @@ static inline unsigned int tcp_packets_in_flight(const struct tcp_sock *tp) #define TCP_INFINITE_SSTHRESH 0x7fffffff +/* Default and maximum snd_cwnd_clamp, in packets. + * Far above any usable BDP, but low enough that congestion control + * arithmetic such as 100 * cwnd in CUBIC cannot overflow a u32. + */ +#define TCP_MAX_SND_CWND (1U << 24) + static inline u32 tcp_snd_cwnd(const struct tcp_sock *tp) { return tp->snd_cwnd;
diff --git a/net/core/filter.c b/net/core/filter.c
index 70dc621672f2e9fccd9cf54808e002ff0f82da62..63bb314e8697db81ecef3a0b3dcf4fed85ac79fa 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c@@ -5562,11 +5562,12 @@ static int bpf_sol_tcp_setsockopt(struct sock *sk, int optname, case TCP_BPF_IW: if (val <= 0 || tp->data_segs_out > tp->syn_data) return -EINVAL; - tcp_snd_cwnd_set(tp, val); + tcp_snd_cwnd_set(tp, min_t(u32, val, tp->snd_cwnd_clamp)); break; case TCP_BPF_SNDCWND_CLAMP: if (val <= 0) return -EINVAL; + val = min_t(u32, val, TCP_MAX_SND_CWND); tp->snd_cwnd_clamp = val; WRITE_ONCE(tp->snd_ssthresh, val); break;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 76df69aa01154cddd4c7940f3c3749d04487ae7b..a11c1b06ed5e5591c47f585a3f9e4fba4de30153 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c@@ -456,7 +456,7 @@ void tcp_init_sock(struct sock *sk) * initialization of these values. */ tp->snd_ssthresh = TCP_INFINITE_SSTHRESH; - tp->snd_cwnd_clamp = ~0; + tp->snd_cwnd_clamp = TCP_MAX_SND_CWND; tp->mss_cache = TCP_MSS_DEFAULT; tp->reordering = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reordering);
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index d58f99c67d4dc0877d0e853c9e9faddd80343c22..ae551546422fe7c38b2ac3224f9ea9adbd3679d0 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c@@ -495,7 +495,8 @@ void tcp_init_metrics(struct sock *sk) } if (tcp_metric_locked(tm, TCP_METRIC_CWND)) - tp->snd_cwnd_clamp = tcp_metric_get(tm, TCP_METRIC_CWND); + tp->snd_cwnd_clamp = min(tcp_metric_get(tm, TCP_METRIC_CWND), + TCP_MAX_SND_CWND); val = READ_ONCE(net->ipv4.sysctl_tcp_no_ssthresh_metrics_save) ? 0 : tcp_metric_get(tm, TCP_METRIC_SSTHRESH);
--
2.53.0