From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx2-f41.google.com (mail-yx2-f41.google.com [74.125.224.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30DE94B95C1 for ; Mon, 28 Sep 2026 13:25:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790601908; cv=none; b=oKC2NfZeYXdTsORYReuhHNDfdQ5k0e6xzKlTZa+73PEUoMBCrYbjqnD119hkgc4/pQCXPwPRTp+gz9Rmg6fRQHyw5aQmb+aCYVogQ2RCgRZIQwhLF+UQhY5D9flEeX0h3ALbcjLS6aMGOLAnULJs4z4WMhyf2T5XZqR43U3ZOp0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790601908; c=relaxed/simple; bh=u7GTV46Kc3atN0PkVHNGN5ZvnEXCF0ExjGMVF2Sn/vc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=rSSWexh8IrH8jlFpss61SpNFknhzteZ9ubIMGcNiaWy4EL0HDuNncOTRNCObbbkMFO2FXllcCzPkffYDyZkVO9PBq/794XfWA+Z9gC5y5fuSgfAm1+smBjKtvz1/5AWJMfl98u9OoRLa8QMyNxQpszg69qAwWvAWqenaPSlGH9I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ob90t9sv; arc=none smtp.client-ip=74.125.224.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ob90t9sv" Received: by mail-yx2-f41.google.com with SMTP id 00721157ae682-8a860e5505aso28246887b3.1 for ; Mon, 28 Sep 2026 06:25:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790601906; x=1791206706; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=9xMUlBVNA1RsBcAarv0vzsm76oqs4M2vGHPlhW4TkRw=; b=ob90t9svFNLiLnOtdfAU2GUhxSVIhsWxZEaTzMrxQCucw180bqCUMvwxjsPuQUjxLo 8yqT6f26uvnJpPMIb75CMPXQ7rhlh61hnUfXbn7/D5xUui3erBryvWFn5lvdK+4H/ux0 NEATypIViVr3xAs4dWmLKnIIoRqfQD7bpGd/vT+M/s2y/wrmrEwsFCNu2vrTxtsZwemu /FLHj207wstq+ong4Y2IVMwT3CUJmtHDOB/aov6776AX3ppk86XoqA2g91on7es7TY+0 ymgx+aqJpnhABD9GOd/bB04GnGvv+Co1I5cCUdg4gm4Sos8VddZWztJF7ngYqY+wPyyi tspQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790601906; x=1791206706; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=9xMUlBVNA1RsBcAarv0vzsm76oqs4M2vGHPlhW4TkRw=; b=emv7NPWho18MEU6pj7VTbcHoD6kZV3iUlP98UafRN2D0w8JUDPa1mahPmB1JRzHwzE RpHI9AuEOt3/j46DKNz1NdPu/t4l4Knkch+mjQhNGt05EXdUZ8OJrbpSerKAcLodwaxO VZ16UJ5az7YhbpvbIs1qqqk/2A74rfkRYtEcvzJuuJ6OfhMerlo4DnZ0UTt62FkXprrk Y9foA+ht06TLUq4BIHXZbxbH3AtxWuV9ZerUfXk1GcyuwWl7TO3t9WmvglzczcpdHpjP Iedo//4/tMLoOmhLg3yDaBT2mmMxUadHZ+3t8v3MDNhFcVY6+Q4u6fqEB3TVtQs98zHB CC9Q== X-Forwarded-Encrypted: i=1; AKwUvBzRUZpd9Qd8vvUChKidFiWjtn76uRsluGsp+cWJU0uzFZ7ObZB2fzB3BumfmUD5ZjHrmZl2S7tvKLZI3EY=@vger.kernel.org X-Gm-Message-State: AFq9FYIyuFHSUU84v4kQJ7JIoy9lksZ+Tv1ejL4l9leTGTTuX7pg8rg+ FrFEZXw/eYX324KqhXmkmDkZScxAXsKlA8uw9mwWm1mxwhnPdpEhZkA0 X-Gm-Gg: AYBFou2Y+uPlPcSLRzlEA+XtGFWu3Y6KbrKUkk7gCVY/7AkfAbKktJoX1XamvEgyddk MFREaq5DuiQ/qdgCgWQQg8L+A8c+SAKPXcaB2ULZrg2s5Q6VeSf7JG39g4aFcIwqFX7TS1YJHLm X4UjxaSD+ufLDKvxizv0JUyTIn+5eNdz04cEDLDNI32UTA9OfikRkVuZZ8Cbry34AxblslOpzEy +r1k2iHs9efYNBjIou/rHSHcYrfRk7nvVE4MZj8r9erbV6GxuPN9VcsmeCwQ2hLTi/bXxAkTzQq h0nnnTim1x0ILY3hvmJrKG1Rq2e+cOSEnc/eejfnc8U55Flmd2ejVh68LNM08GsW7qy3w/sl8n1 IUjnfvvwaH4RxY7su5u7Roqgjflw61Vodu8hpkJILqWIbzZC5giLfgJubm7rk3y60C8DaRDnDG6 rWOvelszptdepm3oYHQZR92SUlbjPVi0HXqZa21iACvWLQNMm+7BxES6fP0yHxa9WtM/pgg3Jo+ tBjJcWBx/3tRiU1I4r1ztNFpFiM0P1OocSJUycS X-Received: by 2002:a05:690c:c609:b0:88e:edf8:e375 with SMTP id 00721157ae682-8a64af41f90mr55822717b3.5.1790601906046; Mon, 28 Sep 2026 06:25:06 -0700 (PDT) Received: from localhost.localdomain ([2409:8a1e:2e81:7320:94d6:8f64:6f66:fcd2]) by smtp.gmail.com with ESMTPSA id 00721157ae682-8ab391acfb0sm298087b3.48.2026.09.28.06.25.01 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Sep 2026 06:25:05 -0700 (PDT) From: Yuchao Zhang To: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: Simon Horman , Jamal Hadi Salim , Jiri Pirko , cake@lists.bufferbloat.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Yuchao Zhang Subject: [PATCH net v4 0/2] net/sched: sch_cake: prevent shaper corruption and stall in cake_overhead() Date: Mon, 28 Sep 2026 21:24:50 +0800 Message-ID: <20260928132452.59996-1-ndaugoing@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This series addresses two issues in cake_overhead() that can lead to corrupted rate shaper accounting or long dequeue stalls: Patch 1 fixes an integer underflow when segs == 0. When an skb with segs == 0 (such as dodgy GSO packets where gso_segs is not recomputed) reaches cake_overhead(), (segs - 1) wraps around to UINT32_MAX, multiplying per-segment overhead by ~4.29 billion and returning a length close to 4.29 GB. cake_advance_shaper() then charges that length to the shaper, stalling the dequeue queue for tens of seconds at 1 Gbit/s, and for minutes to hours at lower rates. This was introduced by commit c5d34f4583ea ("net_sched: cake: use qdisc_pkt_segs()"). Patch 2 validates the transport header offset computed in cake_overhead(). When the transport header was never set, skb_transport_offset() returns the ~0U sentinel (~65535), which inflates shaper accounting by ~66 KB per segment. Furthermore, if preceding egress BPF filters (e.g. sch_handle_egress()) or cake classifier actions (e.g. act_bpf trimming headers via bpf_skb_adjust_room(BPF_ADJ_ROOM_MAC)) leave the transport header stale (bpf_skb_net_hdr_pop() only re-syncs it when it aliased network_header), skb_transport_offset() can become negative. Because hdr_len was declared as unsigned int, a negative offset wraps to near UINT_MAX. Patch 2 checks !skb_transport_header_was_set() and ensures hdr_len >= 0, unifying all early fallback exits to an 'err' label at the end of the function. Both hunks date back to commit a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper"). Changes in v4: - Patch 1: Add Acked-by: Toke Høiland-Jørgensen . - Patch 2: Consolidate the 3 duplicate calls to cake_calc_overhead() into a single 'err' label at the end of the function, turning early returns into 'goto err' statements per Toke Høiland-Jørgensen review. - Link to v3: https://lore.kernel.org/netdev/20260927131009.24250-1-ndaugoing@gmail.com/ Changes in v3: - Split the v2 patch into a 2-patch series per Simon Horman and Sashiko AI review so each logical fix carries its own accurate Fixes: tag and matches proper stable tree backport ranges: - Patch 1 Fixes: c5d34f4583ea ("net_sched: cake: use qdisc_pkt_segs()") - Patch 2 Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper") - Clarify the timing and code paths where header mangling can occur (sch_handle_egress() and cake_classify() before cake_overhead()) rather than inaccurate "post-enqueue mangling" wording. - Link to v2: https://lore.kernel.org/netdev/20260922084124.36858-1-ndaugoing@gmail.com/ Changes in v2: - Accurately describe the impact as shaper accounting corruption / stall rather than OOB read past the allocation. - Fix integer underflow when segs == 0 by checking segs <= 1. - Import companion check !skb_transport_header_was_set(skb) from qdisc_pkt_len_segs_init() to prevent unset transport header sentinel (~0U) from inflating packet length to ~66 KB. - Link to v1: https://lore.kernel.org/netdev/20260917122153.62722-1-ndaugoing@gmail.com/ Yuchao Zhang (2): net/sched: sch_cake: fix shaper stall on segs == 0 in cake_overhead() net/sched: sch_cake: validate transport header offset in cake_overhead() net/sched/sch_cake.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) -- 2.53.0