From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f169.google.com (mail-qk1-f169.google.com [209.85.222.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24AEB3EFD0F for ; Tue, 9 Jun 2026 23:30:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781047817; cv=none; b=dMNo0RsPvTWBBqj6gh6/UIlmO9hk5XszHnTHIjna8G/vHRwOFwA06Yd1NgoN2EQ7VOD77Q40AwzIBRD/uTTFCAQxAEhfY+0jRl6XV1lpYZjFT26qNUAVhWobpe9NqzwduRMCytSLiG5UqZotwU+2WnkWBLdNYIQLPtqFwQRhHTM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781047817; c=relaxed/simple; bh=10rYPeh3lysa5wDtoLmtgj3NBxRuVsL+MD4nPwEsK2U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Fb64vgZ9VvsiO3Ks2T22R7a/ceOS27ZtKhvfzPyJZyRKOMARLlVLdl71rh2UW8TOQHfeZvMowcafoTMu02cqP7QRpOq4pzBjNmXj0RKNol+l6tPLcLw5PqWHsanAzX+l9sHiwlC25A6e9RqALuARMKGr6Awg2k5KeKB9UMZSp84= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=XRcke140; arc=none smtp.client-ip=209.85.222.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="XRcke140" Received: by mail-qk1-f169.google.com with SMTP id af79cd13be357-9157b949fc7so664719085a.3 for ; Tue, 09 Jun 2026 16:30:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1781047815; x=1781652615; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Zj2TTUGE9JGo0G5Kz2j/PUb2+++ltpKUn7Tzej8LBcI=; b=XRcke140TRbAxnVD/y9/6WWBAwMiuDFOBiInkoNu2wFLbEeAf/CeUtrcdclW7jqe2+ Jd9KKVXdGf1qISepTacnj46mptCtiJUrSoZVV5zqo+4nRaoPgHZ8gYYte8VKctKOTByB aYxJG12WXFE5gdXDSvEM3XcGVXvXjANLoqs8HTl70zZCmBiK6cLpQocUQ6pXP+rNuomO HV5MMshPa68c9gBr6+l7Yjy5RBo5WPKthtpsLkHdqfbirYfHXI065CevtlFsnhE7A5y4 IHIDf83eASW6FNIn23sNWCAw30qGYrbVODwVVZ0rWyymVr+108KwzXrGuqFI+aHdkaHS DwgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781047815; x=1781652615; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Zj2TTUGE9JGo0G5Kz2j/PUb2+++ltpKUn7Tzej8LBcI=; b=d1Ld0HNai29gO5UDTfLm3t1vhHFQe8zgGqVFKcm2S9W3+hl7S0+fUw+wAMnnbuCUYc 28KjLxKr0pUm7JuycZrRRha0zuwgQDxR0tXG9FmHAcwlh9d7SeUju6eruGtmTwNE4+UE 6yPC/LGm2pE+c7CO4KTlB3H850OaLhtiHtxKHWkoaz2KR/sJckoyBbFd870faJWKCj7L l6KaZ1hg9NDjp/BT3bUDnqjWYc47/QdUAsde2FteRxYFB6SH5hs3z7Q/uZVXN0PU52Yi 24jS2axfO/paKxcoHPcXgucT/aV+ghaxemTxt+e44KPM6GA81S2cZUEXmjlOhL3Y1Qz/ 7xzQ== X-Forwarded-Encrypted: i=1; AFNElJ+GWpjIdH6bSUGgEicHW7Ol3cjIKBPXdjTK0fVcjnUBzJsIPKgm7u2CnPBnTUweAL9guW/JOb9DTS1lq3k=@vger.kernel.org X-Gm-Message-State: AOJu0Yx3ewN/amK0iznbXEVkGoPPbOv6c1VahTgdal+Xx9K2PAMibHc4 bdaMoab/95fCOpfQf4kcap7gWdFiRR+2f7tRcdPX4lnKAo0fOt2X/BtawDBr5QAmGtA= X-Gm-Gg: Acq92OGa1MjfjyVns/4/X8mnYK9WeARIqu1E6bfLfKC6ezwq6CKuJPRJ+8dd+OleBha AtDiLQ6YOqrqYLBhMkFtHw5B5r9c/N8v5rc0MK04Gmd79VeJFgyzMUBwnRJj1DnKODvQPIZ1uXd iw8nH1JocECtlkQhrHl+YNi1ZE69s2ETayhjCb7Tatka/gCBq3LQfWWJIeoPlEjvvVQXpUj+Cpq dg3o5d4tCiz/YAAEHyEWT7pXyUD82aOZ4M0/4b+QP1yKEcN/wsFjID8K++pp5dWHFA/7/ZXZ1dt v6rnp8DcR9rCi+bZbP0mGsx+gZetXVA3vCgfI+TyqrIPHMWLDxG26TjhwSAIsSyxLjFCMrKHZVs q/a0KuVNvnjyT7uKGG+/wCj+nw1r03uksTpmyugacMr0IkKdqu1QUZqqJASsMrfYA9SOW5wvr+h U2IyahqoI6A4N4gY/AyYjKwH6uwomfoapbISf0Jj4iaNsrwMwQ X-Received: by 2002:a05:620a:649c:b0:915:9f87:eaaa with SMTP id af79cd13be357-915e8316469mr811336685a.42.1781047815198; Tue, 09 Jun 2026 16:30:15 -0700 (PDT) Received: from localhost ([161.35.96.86]) by smtp.gmail.com with UTF8SMTPSA id af79cd13be357-9158a37cae4sm2247735485a.29.2026.06.09.16.30.13 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 09 Jun 2026 16:30:14 -0700 (PDT) From: Samuel Moelius To: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= Cc: Samuel Moelius , Jamal Hadi Salim , Jiri Pirko , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , cake@lists.bufferbloat.net (moderated list:CAKE QDISC), netdev@vger.kernel.org (open list:TC subsystem), linux-kernel@vger.kernel.org (open list) Subject: [PATCH net v2] net/sched: cake: reject overhead values that underflow length Date: Tue, 9 Jun 2026 23:29:36 +0000 Message-ID: <20260609232935.1602659.8545fdb04fbe.cake-overhead-underflow@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit CAKE accepts overhead values that can make adjusted packet length arithmetic underflow. A negative effective length can wrap through unsigned arithmetic and become a large value. Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. Validate overhead settings before using them in adjusted length calculations. Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper") Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius --- Changes in v2: - Add fixes tag net/sched/sch_cake.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index 5862933be8d7..03972e5525b5 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -2308,12 +2308,18 @@ static void cake_reset(struct Qdisc *sch) cake_clear_tin(sch, c); } +static const struct netlink_range_validation_signed cake_overhead_range = { + .min = -64, + .max = 256, +}; + static const struct nla_policy cake_policy[TCA_CAKE_MAX + 1] = { [TCA_CAKE_BASE_RATE64] = { .type = NLA_U64 }, [TCA_CAKE_DIFFSERV_MODE] = { .type = NLA_U32 }, [TCA_CAKE_ATM] = { .type = NLA_U32 }, [TCA_CAKE_FLOW_MODE] = { .type = NLA_U32 }, - [TCA_CAKE_OVERHEAD] = { .type = NLA_S32 }, + [TCA_CAKE_OVERHEAD] = + NLA_POLICY_FULL_RANGE_SIGNED(NLA_S32, &cake_overhead_range), [TCA_CAKE_RTT] = { .type = NLA_U32 }, [TCA_CAKE_TARGET] = { .type = NLA_U32 }, [TCA_CAKE_AUTORATE] = { .type = NLA_U32 }, -- 2.43.0