[PATCH] tcp: Avoid division by zero with small MSS values

[PATCH] tcp: Avoid division by zero with small MSS values

[Anshu Kumari]

Fuzz testing with AFL++ persistent mode found a crash in
tcp_buf_data_from_sock(), SIGFPE (signal 8) from division
by zero at:

  fill_bufs = DIV_ROUND_UP(wnd_scaled - already_sent, mss);

when we split buffers on MSS boundaries, if the MSS is small
enough (less than four, rounded down to 0).

A guest advertising such a small MSS indicates unusual
behaviour because the minimum usable MSS is
MTU - IP header - TCP header (28 bytes for the minimum
IPv4 MTU of 68). To improve robustness:

  - Fix MSS_SET() to round up when MSS is between 1 and 3,
    storing tap_mss as 1 (recovered as 4 by MSS_GET()).
  - In case of zero MSS, don't send data: tcp_buf_data_from_sock()
    now returns early.

This is not a security issue: the effect of a zero MSS from
a guest input was a clean process termination (SIGFPE), not
memory corruption or data leakage.

Signed-off-by: Anshu Kumari <anskuma@redhat.com>
---
 tcp_buf.c  | 3 +++
 tcp_conn.h | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/tcp_buf.c b/tcp_buf.c
index 72c45412..ee8c7ce8 100644
--- a/tcp_buf.c
+++ b/tcp_buf.c
@@ -335,6 +335,9 @@ int tcp_buf_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn,
 	struct iovec *iov;
 	uint32_t seq;
 
+	if (!mss)
+		return 0;
+
 	/* Set up buffer descriptors we'll fill completely and partially. */
 	fill_bufs = DIV_ROUND_UP(wnd_scaled - already_sent, mss);
 	if (fill_bufs > TCP_FRAMES) {
diff --git a/tcp_conn.h b/tcp_conn.h
index e3c55341..3f5ad28b 100644
--- a/tcp_conn.h
+++ b/tcp_conn.h
@@ -51,7 +51,8 @@ struct tcp_tap_conn {
 
 #define TCP_MSS_BITS			14
 	unsigned int	tap_mss		:TCP_MSS_BITS;
-#define MSS_SET(conn, mss)	(conn->tap_mss = (mss >> (16 - TCP_MSS_BITS)))
+#define MSS_SET(conn, mss)						\
+	(conn->tap_mss = (mss) ? MAX(1, (mss) >> (16 - TCP_MSS_BITS)) : 0)
 #define MSS_GET(conn)		(conn->tap_mss << (16 - TCP_MSS_BITS))
 
 #define RTT_EXP_BITS			4
-- 
2.55.0