From: Yong Wang ip_metrics_convert() only caps RTAX_ADVMSS at the upper bound and still accepts undersized non-zero values from userspace. A route installed with "advmss 12" can later reach the passive TCP open path. When SYN timestamps are enabled, tcp_openreq_init_rwin() subtracts TCPOLEN_TSTAMP_ALIGNED from the route advmss before calling tcp_select_initial_window(). This can reduce the effective MSS to zero and trigger a divide-by-zero in the rounddown(space, mss) path. Reject non-zero RTAX_ADVMSS values smaller than TCP_MIN_MSS while keeping the existing "0 means use default advmss" behavior intact. This matches the existing TCP_MIN_MSS based validation used for TCP_MAXSEG and fixes the bug at the route metric input point rather than adding a redundant guard deeper in the TCP stack. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: Codex:GPT-5.4 Signed-off-by: Yong Wang Signed-off-by: Ren Wei --- net/ipv4/metrics.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c index ad40762a8b38..b9b97a0a5126 100644 --- a/net/ipv4/metrics.c +++ b/net/ipv4/metrics.c @@ -44,6 +44,12 @@ static int ip_metrics_convert(struct nlattr *fc_mx, } val = nla_get_u32(nla); } + if (type == RTAX_ADVMSS && val && val < TCP_MIN_MSS) { + NL_SET_ERR_MSG_ATTR_FMT(extack, nla, + "Invalid advmss, must be 0 or >= %u", + TCP_MIN_MSS); + return -EINVAL; + } if (type == RTAX_ADVMSS && val > 65535 - 40) val = 65535 - 40; if (type == RTAX_MTU && val > 65535 - 15) -- 2.53.0