From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=fail (p=quarantine dis=none) header.from=redhat.com Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 694645A0265 for ; Fri, 16 Oct 2026 13:28:20 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792150099; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Jer2rKQGmqKCflRIRXIjxB9IYMmKa09xOW83zfBhENQ=; b=dKSeGMUZojORZs/5kA/6unRJS9ia3h+EqE+gRgjFhPcUpuRzY4du1u655c8GVZ8XEfKw1Q yL6ZY2sGZ3uq4RKxA1QQk2dMJP5hCKuSOyKmoxhPelRFKzwIAMvzzS1lw3sUZ7d9xNPwwJ 3jmsoMcwtg4W2BTzzvy9t2RTyRmOlnQ= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-295-QbnpBp5fOq6dyq24L7JCEA-1; Fri, 16 Oct 2026 11:28:17 +0000 X-MC-Unique: QbnpBp5fOq6dyq24L7JCEA-1 X-Mimecast-MFC-AGG-ID: QbnpBp5fOq6dyq24L7JCEA_1792150097 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 0F43A180067E for ; Fri, 16 Oct 2026 11:28:17 +0000 (UTC) Received: from anskuma-thinkpadp1gen7.bengluru.csb (unknown [10.74.80.97]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 539F8418; Fri, 16 Oct 2026 11:28:14 +0000 (UTC) From: Anshu Kumari To: passt-dev@passt.top, sbrivio@redhat.com Subject: [PATCH] tcp: Avoid division by zero with small MSS values Date: Fri, 16 Oct 2026 16:58:11 +0530 Message-ID: <20261016112811.4176811-1-anskuma@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: GGaV0DMCHaFGwaGT_dBTasY-Lq7dL4nzY36ZAMStspU_1792150097 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit content-type: text/plain; charset="US-ASCII"; x-default=true Message-ID-Hash: C4G2DEBNQ4AVQDCX54LG7CURVQT7RAHX X-Message-ID-Hash: C4G2DEBNQ4AVQDCX54LG7CURVQT7RAHX X-MailFrom: anskuma@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: anskuma@redhat.com X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Fuzz testing with AFL++ persistent mode found a crash in tcp_buf_data_from_sock(), SIGFPE (signal 8) from division by zero at: fill_bufs = DIV_ROUND_UP(wnd_scaled - already_sent, mss); when we split buffers on MSS boundaries, if the MSS is small enough (less than four, rounded down to 0). A guest advertising such a small MSS indicates unusual behaviour because the minimum usable MSS is MTU - IP header - TCP header (28 bytes for the minimum IPv4 MTU of 68). To improve robustness: - Fix MSS_SET() to round up when MSS is between 1 and 3, storing tap_mss as 1 (recovered as 4 by MSS_GET()). - In case of zero MSS, don't send data: tcp_buf_data_from_sock() now returns early. This is not a security issue: the effect of a zero MSS from a guest input was a clean process termination (SIGFPE), not memory corruption or data leakage. Signed-off-by: Anshu Kumari --- tcp_buf.c | 3 +++ tcp_conn.h | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/tcp_buf.c b/tcp_buf.c index 72c45412..ee8c7ce8 100644 --- a/tcp_buf.c +++ b/tcp_buf.c @@ -335,6 +335,9 @@ int tcp_buf_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn, struct iovec *iov; uint32_t seq; + if (!mss) + return 0; + /* Set up buffer descriptors we'll fill completely and partially. */ fill_bufs = DIV_ROUND_UP(wnd_scaled - already_sent, mss); if (fill_bufs > TCP_FRAMES) { diff --git a/tcp_conn.h b/tcp_conn.h index e3c55341..3f5ad28b 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -51,7 +51,8 @@ struct tcp_tap_conn { #define TCP_MSS_BITS 14 unsigned int tap_mss :TCP_MSS_BITS; -#define MSS_SET(conn, mss) (conn->tap_mss = (mss >> (16 - TCP_MSS_BITS))) +#define MSS_SET(conn, mss) \ + (conn->tap_mss = (mss) ? MAX(1, (mss) >> (16 - TCP_MSS_BITS)) : 0) #define MSS_GET(conn) (conn->tap_mss << (16 - TCP_MSS_BITS)) #define RTT_EXP_BITS 4 -- 2.55.0