1 files changed, 9 insertions, 2 deletions

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1e4c76d2b827..59792d283ff8 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1084,9 +1084,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
+        struct sockaddr *uaddr = msg->msg_name;
         int err, flags;
 
-        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE))
+        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
+            (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) &&
+             uaddr->sa_family == AF_UNSPEC))
                 return -EOPNOTSUPP;
         if (tp->fastopen_req)
                 return -EALREADY; /* Another Fast Open is in progress */
@@ -1108,7 +1111,7 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
                 }
         }
         flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
-        err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
+        err = __inet_stream_connect(sk->sk_socket, uaddr,
                                     msg->msg_namelen, flags, 1);
         /* fastopen_req could already be freed in __inet_stream_connect
          * if the connection times out or gets rst
@@ -2320,6 +2323,10 @@ int tcp_disconnect(struct sock *sk, int flags)
         tcp_set_ca_state(sk, TCP_CA_Open);
         tcp_clear_retrans(tp);
         inet_csk_delack_init(sk);
+        /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
+         * issue in __tcp_select_window()
+         */
+        icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
         tcp_init_send_head(sk);
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);