From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 098343A641E for ; Thu, 26 Mar 2026 18:17:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774549064; cv=none; b=PT9DKukW2jxarA8DSL2fzk/zSzFIbqdkZfsEvnPbywMFcsoqYXzJbqQUFcAT0HkNCQtjr1LEiLGFLfCgSHxY04HsMG3BcmWVD88seSUiKi5HoG2yeqHzLJbARmRM6aUL5v1Y/2b0XzzpZGGPXYiXrrQEoGjxwNMUJ4SwLTH1gZw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774549064; c=relaxed/simple; bh=mArRWUbnReNXeDuPsvJkqLTeL18eozIQGlQ4EBv2OJw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LbFqPMKLXQ3zYXc7Dt+3y/X0oOcUyfoVCoytaFfNdLjB4kJE0fy9zqMNXoXDZZEDHfcInyr9xeTOOphmoFIB1yRdXl92DIJ7pLn7x2l9JacwJbHmIQebU9xNGEn15Ode4zMKJVxmOiyxpsZhIwqzYrW+zr1FGaJwH7ECQ+firBY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=networkplumber.org; spf=pass smtp.mailfrom=networkplumber.org; dkim=pass (2048-bit key) header.d=networkplumber-org.20230601.gappssmtp.com header.i=@networkplumber-org.20230601.gappssmtp.com header.b=Id50Te6J; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=networkplumber.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=networkplumber.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=networkplumber-org.20230601.gappssmtp.com header.i=@networkplumber-org.20230601.gappssmtp.com header.b="Id50Te6J" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2ad4d639db3so6120265ad.0 for ; Thu, 26 Mar 2026 11:17:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20230601.gappssmtp.com; s=20230601; t=1774549061; x=1775153861; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=hL3YJ0V6J4xlK4RXV+20W1VV+9Vfq7bs9W3HHr+lr9M=; b=Id50Te6JZEFMhKv0SuUlli+4wkobJll1WpOtwmcqyzpcCsHHTv2NGWIeYaKbJGfWHs +4zS2VlJiLM8OpRZnQJ+uPFx6krULpdaf/izHhADvYdV+rJ/TcaIQ1VY/+mSYQdfCaTa GlpPZg65fnqp1ITXJxxPlamf57bwIHFzeft+V1ACOSQ8Z2xaSmrXMsjlZlmigsv5yQfR moVbhuWG29JTxjYp8ZvtTen+6Ipob/xCLCsuUrjx1YekX6G4rmepY5e+NmqqsXcgCOcH 71cdeO+RmexVa5RxCzjlrdQRhvlh9uiJCLTF2uEqdnZ0btkpW0Iokqi3Sj6G/prpD2IO RBCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774549061; x=1775153861; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=hL3YJ0V6J4xlK4RXV+20W1VV+9Vfq7bs9W3HHr+lr9M=; b=GjG6JTuGy6G6E48htqDWxHhy0CJ8ZvoE9vrEWbLowCTrhgAGgQrDd1BZUkNJ4k4zus NYuGWv17siAFA3SNXrJOS2zXBOEOiJpm8Ug0y6LBx8harY1aZInHmvxH4nN0FiKoGJuq bfyoDWJRvPVJ03NzA8uWR+ovgwG2y0zRsDnjXtiSjt/KIp8aTorqeMLq+P2Z+1eWHQ0O IxuOmiMmFOfipfKsvnvZkht8E6zvOOjeUi84/xTJI0Qt+Yt2ULTq0dD7kGARrn+nEDFS WCVnPbXk3xQafMNnF7P7OH4NIN0KCwLNicwVNytUoeslZ+aWl0dvIqpY1ebKcW7Y5MNT /bIQ== X-Forwarded-Encrypted: i=1; AJvYcCVpZBzX+cZKJEqKOThk4xjbakR17+rV7e4a5I5+TmQeZNFIuVrkLqSkOj7ddGABZkJ6ArmWXaGia7SExAI=@vger.kernel.org X-Gm-Message-State: AOJu0Yzedc8Q54TvvqHb7iV0fOfq5sCRrTK272yQme8reCwhlIm5v3Yt 72ctb4JmhQ3PoCjylNCZnkiEu1lKCOVn59fXRK9UmaC8h4UTb/YN5TpzXLpAI9t5IBmZ6awpElF S/Pt8 X-Gm-Gg: ATEYQzyth9Ci1+dlikpecOsGLCUE9X1bGDhGjML2mET4jE+Wkcx6Y7PhUyM80wW/n73 tmZRPzeNQeCiBTa0onC15/VjOtn6r0qovVIE+Gelt2aQnSJqlS9Lzqs1AYrAywyfLK4Zt4WBcOK PFltsLkLPlEEm0PAGHbHje7cj4JfTHIuj5BzbhvxKp/AHc6M1S2HaQfZ3Pj+i7LZXSILqyeSlVE EnxNDw4pqt44R2CTmkT3BzYTk5mltaZkHat2AX+VSjZxLok0j7SFPs280K0VaFUYGrYd7iOyXMD q0CgKe1oLhzbcgC8pGbZ4b961cEln0HcMzZVrTUUgbeNrFvP+zxdVncisJSQaoLoEClRPpoanX0 6pE1UDBLVll6NWdUBm3xpwV2GpCfIaUaJJvcEFj6PW7VZd5U1GPI6V3uoBDNxR9x9VyxY4OkUlt X4KhAcDCFTx434oUyBo8UGlOgqfRD1wXZl X-Received: by 2002:a17:902:ea0c:b0:2b0:c650:6300 with SMTP id d9443c01a7336-2b0c6507204mr20801815ad.27.1774549060983; Thu, 26 Mar 2026 11:17:40 -0700 (PDT) Received: from phoenix.lan ([104.202.29.139]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b0bc8c4bd3sm38590245ad.63.2026.03.26.11.17.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Mar 2026 11:17:40 -0700 (PDT) From: Stephen Hemminger To: netdev@vger.kernel.org Cc: Jamal Hadi Salim , William Liu , Savino Dicanosa , Victor Nogueira , Stephen Hemminger , Jiri Pirko , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v3 4/7] net/sched: fix packet loop on netem when duplicate is on Date: Thu, 26 Mar 2026 11:01:03 -0700 Message-ID: <20260326181701.308275-5-stephen@networkplumber.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260326181701.308275-1-stephen@networkplumber.org> References: <20260326181701.308275-1-stephen@networkplumber.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Jamal Hadi Salim When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted. The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared across all concurrent enqueue paths and is not safe without additional locking. Use the skb tc_depth field introduced in an earlier patch: - increment it on the duplicate before re-enqueue - skip duplication for any skb whose tc_depth is already non-zero. This marks the packet itself rather than mutating qdisc state, therefore it is safe regardless of tree topology or concurrency. Fixes: 0afb51e72855 ("[PKT_SCHED]: netem: reinsert for duplication") Reported-by: William Liu Reported-by: Savino Dicanosa Closes: https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ Co-developed-by: Victor Nogueira Signed-off-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Reviewed-by: Stephen Hemminger --- net/sched/sch_netem.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index 0ccf74a9cb82..6086700eb1e7 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -461,7 +461,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, skb->prev = NULL; /* Random duplication */ - if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor, &q->prng)) + if (q->duplicate && skb->tc_depth == 0 && + q->duplicate >= get_crandom(&q->dup_cor, &q->prng)) ++count; /* Drop packet? */ @@ -539,11 +540,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, */ if (skb2) { struct Qdisc *rootq = qdisc_root_bh(sch); - u32 dupsave = q->duplicate; /* prevent duplicating a dup... */ - q->duplicate = 0; + skb2->tc_depth++; /* prevent duplicating a dup... */ rootq->enqueue(skb2, rootq, to_free); - q->duplicate = dupsave; skb2 = NULL; } -- 2.53.0