Commit 6c5a9baa15de for kernel

commit 6c5a9baa15de240e747263aba435a0951da8d8d2
Author: Mehul Rao <mehulrao@gmail.com>
Date:   Tue Mar 10 13:07:30 2026 -0400

    tipc: fix divide-by-zero in tipc_sk_filter_connect()

    A user can set conn_timeout to any value via
    setsockopt(TIPC_CONN_TIMEOUT), including values less than 4.  When a
    SYN is rejected with TIPC_ERR_OVERLOAD and the retry path in
    tipc_sk_filter_connect() executes:

        delay %= (tsk->conn_timeout / 4);

    If conn_timeout is in the range [0, 3], the integer division yields 0,
    and the modulo operation triggers a divide-by-zero exception, causing a
    kernel oops/panic.

    Fix this by clamping conn_timeout to a minimum of 4 at the point of use
    in tipc_sk_filter_connect().

    Oops: divide error: 0000 [#1] SMP KASAN NOPTI
    CPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+
    RIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362)
    Call Trace:
     tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406)
     __release_sock (include/net/sock.h:1185 net/core/sock.c:3213)
     release_sock (net/core/sock.c:3797)
     tipc_connect (net/tipc/socket.c:2570)
     __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)

    Fixes: 6787927475e5 ("tipc: buffer overflow handling in listener socket")
    Cc: stable@vger.kernel.org
    Signed-off-by: Mehul Rao <mehulrao@gmail.com>
    Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
    Link: https://patch.msgid.link/20260310170730.28841-1-mehulrao@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 4c618c2b871d..9329919fb07f 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2233,6 +2233,8 @@ static bool tipc_sk_filter_connect(struct tipc_sock *tsk, struct sk_buff *skb,
 		if (skb_queue_empty(&sk->sk_write_queue))
 			break;
 		get_random_bytes(&delay, 2);
+		if (tsk->conn_timeout < 4)
+			tsk->conn_timeout = 4;
 		delay %= (tsk->conn_timeout / 4);
 		delay = msecs_to_jiffies(delay + 100);
 		sk_reset_timer(sk, &sk->sk_timer, jiffies + delay);