From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3C08352027 for ; Wed, 12 Aug 2026 08:02:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786521746; cv=none; b=sCvetehu+oAVRnV0tAGyEIVicfo3+mjp0dHAWXuH9MRqHS3vKOq3Lv/p3oeeRZxexOq79LwhhG2yiDR/5wo9uzfI5iKo6e6KagpL5AbxPD0/+M1GHr0rQscqGMf+IAv0jvUkQdAMvn73u3Y6XYs1FB0Ixd8tDxUpyQsYd5vsWIM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786521746; c=relaxed/simple; bh=5ZFXptKAxo1rTLpbIpgH6vO1joQz/kZ6CYrxrQfA61I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EjjPPfM4sEwKz/raQCnSgkZg7eAAmvdfuRkyW8uj0cUcnRco7jAEIvrveWGpoXBodxhdJmL7QAH6GJatPxO1vEVx3jGq7rn817LmSstRLK05oKV7CP922iXtE20XEiEDfz9GX/75Y4GGPzPy4ckfp9YAh8QiXw6zLOLC+McLjrA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=i3yjBvvo; arc=none smtp.client-ip=209.85.216.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="i3yjBvvo" Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-38dfe910e9dso791373a91.3 for ; Wed, 12 Aug 2026 01:02:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786521745; x=1787126545; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tPoa6C0hj4HZJwKUSXTCx+irT5h4iMOM05qfW4+AIP0=; b=i3yjBvvoZdYfm7zYgKIzQt2ansYD/YAhtp9Gw/FMkFBODSriHyPohBWSZX+xspperH fzDNALcjCW2y+AjTkkES1LTwaEP7rzJcvFsZmUwrlSddMisD9fDi1AWuBA9dAeEz5Fb7 YPB20+OcEHROMRzXvdwvUsQNPXoCew3siz1gT5qtIrYjGOrUTPzWmpd0/NclpWynqudh NrES/eEKVZp/b7dq7pvPRhM/iDNkSB7mLNnMtmLRlpE7uzpqoEefOWa3lhqJMbSX+BUo qhxaiZ7pFpFMI536cvpk8fpLD/flr5uyR171iPcdBYzvbC22RdIttdU6sXWLsJUsORpD ujTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786521745; x=1787126545; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=tPoa6C0hj4HZJwKUSXTCx+irT5h4iMOM05qfW4+AIP0=; b=S0JVEsgtmGlaxilsVLaFc7ghEz4/8W93CBtAffNirP55lBCF+QVds+Aco/n+38PNFM 6ntqobd3fYLRRAaP5L1n36Vucg2FoibZr09azjBDIzuQnK4LfzHpIlL83dRUSXVCMLX8 JP7JIibVWLkeJNtKIFJSUtdnZSDW9xb05y0R9OXG1HD4SzvYD5xz2y80zQRbOWBELfHe R0VIPeO96mthgimJPTdQwvddtaQcNXW8zdPBnBdRfkK618+In/W+/shjdKEKAXoEfXi/ Ke240P9nzRM+b0KxrR7lujh3PV8hMc2s/P8RATuPkOMA4cRX8WCoaFCThYuxs+dr4xvL qgzw== X-Gm-Message-State: AOJu0YxpQJy1fKbC4TktVanalGN+OsOLjqLfXSxW8FPo0Xug+azoAuQF pJA/eof/jm3EBjyfbRGUn/p/WN7OzA2Sa9H6xxqgl1jju/Y/SLsnvgO1 X-Gm-Gg: AR+sD109X9hmSvOXr48zxEUd2X4lcRZX4+Z1trdDWm6+ZToPmjAxDOxWP2bplvLWvBt hRZVcFBcHCCfdRk+WfkDyCv6VXl15ooHu2RTeSpqdfG48xTGWURz4bIgy/gm98EsQ/8+8RY/zOl XfLN/Jo0tdGxC4uEVx9+c5IT1VNnG6EYanIPk92i6hgSDI+XDfYEOw5Mkuwz9CWzwjaeBK2P+Hz dhulCaXzDvDMgjSumIdUUUln31w0WJgdgdnQTBq2Q4qlp63yKDUmb0HWDvTCHFFCoeSWxvjMZ+U 5tgROfrtabK3M9wotaBnsgUeczafVv4ilu2l9WWyDOmzGdMtK12bVSHQr1lTTUszrsL0t5F6ZNV /VafZAoBzToQvNSO6MBcr8vVlgDAihq6AqKRGYMlZnx7uMbNMykxTKhdDmbcJNwa/ZE5zAf+gq1 ViCy5zluaL4OaAhFz+0eHwV8kFj8eMOgIJrkErc4QKnfRRz39nOLrHX9oGtkqh6PiUhGSV05wk X-Received: by 2002:a17:90b:384f:b0:37c:6130:7a5b with SMTP id 98e67ed59e1d1-39301244f91mr2956794a91.8.1786521744856; Wed, 12 Aug 2026 01:02:24 -0700 (PDT) Received: from localhost.localdomain ([82.40.42.115]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392f908a82bsm2629752a91.0.2026.08.12.01.02.20 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 12 Aug 2026 01:02:24 -0700 (PDT) From: Jack Wang <163wangjack@gmail.com> To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Jack Wang <163wangjack@gmail.com>, Vinicius Costa Gomes , Jamal Hadi Salim , Jiri Pirko , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Jesus Sanchez-Palencia , Elena Salomatkina Subject: [PATCH net v2] net/sched: cbs: perform rate conversions in signed 64-bit arithmetic Date: Wed, 12 Aug 2026 16:02:04 +0800 Message-ID: <20260812080204.32373-1-163wangjack@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260806155253.50252-1-163wangjack@gmail.com> References: <20260806155253.50252-1-163wangjack@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit cbs_set_port_rate() and cbs_change() multiply link rates and slope values by BYTES_PER_KBIT, an unsigned long constant. On 32-bit architectures, the multiplications therefore take place in 32-bit unsigned arithmetic before the results are assigned to s64 fields. For port rates above approximately 34.36 Gbit/s this wraps port_rate. The same conversion turns a negative sendslope into a large positive value, reversing the CBS credit adjustment. This affects software CBS; port_rate is also refreshed on NETDEV_UP and NETDEV_CHANGE notifications. Cast the first operand of each multiplication to s64 so all intermediate operations use signed 64-bit arithmetic and preserve the value's sign on every architecture Also reject a non-positive idleslope. A negative idleslope can arm the watchdog in the past and busy-loop. Fixes: 585d763af09c ("net/sched: Introduce Credit Based Shaper (CBS) qdisc") Fixes: 397006ba5d918 ("net/sched: cbs: Fix integer overflow in cbs_set_port_rate()") Signed-off-by: Jack Wang <163wangjack@gmail.com> --- v2: - Reject a non-positive idleslope to prevent scheduling the watchdog in the past. - Leave the pre-existing timediff_to_credits() overflow for a separate follow-up. v1: https://lore.kernel.org/netdev/20260806155253.50252-1-163wangjack@gmail.com/ net/sched/sch_cbs.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c index 1c93469c56e3..e960c8e01ef4 100644 --- a/net/sched/sch_cbs.c +++ b/net/sched/sch_cbs.c @@ -335,7 +335,7 @@ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q) speed = ecmd.base.speed; skip: - port_rate = speed * 1000 * BYTES_PER_KBIT; + port_rate = (s64)speed * 1000 * BYTES_PER_KBIT; atomic64_set(&q->port_rate, port_rate); netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n", @@ -392,6 +392,10 @@ static int cbs_change(struct Qdisc *sch, struct nlattr *opt, } qopt = nla_data(tb[TCA_CBS_PARMS]); + if (qopt->idleslope <= 0) { + NL_SET_ERR_MSG(extack, "Idleslope must be greater than zero"); + return -EINVAL; + } if (!qopt->offload) { cbs_set_port_rate(dev, q); @@ -405,8 +409,8 @@ static int cbs_change(struct Qdisc *sch, struct nlattr *opt, /* Everything went OK, save the parameters used. */ WRITE_ONCE(q->hicredit, qopt->hicredit); WRITE_ONCE(q->locredit, qopt->locredit); - WRITE_ONCE(q->idleslope, qopt->idleslope * BYTES_PER_KBIT); - WRITE_ONCE(q->sendslope, qopt->sendslope * BYTES_PER_KBIT); + WRITE_ONCE(q->idleslope, (s64)qopt->idleslope * BYTES_PER_KBIT); + WRITE_ONCE(q->sendslope, (s64)qopt->sendslope * BYTES_PER_KBIT); WRITE_ONCE(q->offload, qopt->offload); return 0; base-commit: 7b53449540502cb21b32bca62a6258e22cd97bbe -- 2.53.0