* [PATCH net v3 1/3] net/sched: taprio: reject software schedules that overflow their timestamps
2026-11-04 14:17 [PATCH net v3 0/3] net/sched: taprio: fix RCU stall from replayed schedule entries Krystian Kaniewski
@ 2026-11-04 14:17 ` Krystian Kaniewski
2026-11-04 14:17 ` [PATCH net v3 2/3] net/sched: taprio: prevent cycle time extension overflow Krystian Kaniewski
2026-11-04 14:17 ` [PATCH net v3 3/3] net/sched: taprio: do not replay missed entries in advance_sched() Krystian Kaniewski
2 siblings, 0 replies; 4+ messages in thread
From: Krystian Kaniewski @ 2026-11-04 14:17 UTC (permalink / raw)
To: Vinicius Costa Gomes, Jamal Hadi Salim, Jiri Pirko,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Vladimir Oltean, Vedang Patel, netdev, linux-kernel
taprio takes base-time as an unbounded signed 64-bit value. A base time
in the future is used as the schedule start unchanged, and
setup_first_end_time() then adds the cycle time, the first interval and
the gate durations of the first entry to it. With a start close to
KTIME_MAX these sums overflow, and the software schedule starts with end
and gate close times that lie far in the past.
If this is the first schedule, the qdisc timer is armed for its future
start. With an operational schedule running, taprio_start_sched() keeps
the earlier operational expiry instead. A large cycle-time-extension
can then trigger an early handover to the pending admin schedule.
advance_sched() uses the invalid entry end as the next expiry and can
keep restarting inside the same timer interrupt.
Before a software schedule is initialized and published, check that the
computed start is not negative and leaves room for every timestamp
initialized from it, and reject the schedule with -ERANGE otherwise. Full
offload and txtime-assist do not use the software timer and are not
affected. Schedules with a reasonable base time behave as before.
Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Krystian Kaniewski <krystianmkaniewski@gmail.com>
---
v3:
- reword the range-check comment to describe only software timer
timestamps (Vinicius)
- add Acked-by from Vinicius
- drop the obsolete Assisted-by trailers
- rebase onto current net/main
v2: https://lore.kernel.org/all/20261009123309.284193-2-krystianmkaniewski@gmail.com/
- no change
v1: https://lore.kernel.org/all/20261006113335.241564-2-krystianmkaniewski@gmail.com/
net/sched/sch_taprio.c | 46 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 46 insertions(+)
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 4f69ef3d847a6b..2a31b189d654e2 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1258,6 +1258,48 @@ static int taprio_get_start_time(struct Qdisc *sch,
return 0;
}
+static int taprio_validate_start_time(struct taprio_sched *q,
+ const struct sched_gate_list *sched,
+ ktime_t start,
+ struct netlink_ext_ack *extack)
+{
+ int num_tc = netdev_get_num_tc(qdisc_dev(q->root));
+ const struct sched_entry *first, *entry;
+ u64 offset = 0, span;
+ int tc;
+
+ if (TXTIME_ASSIST_IS_ENABLED(q->flags) ||
+ FULL_OFFLOAD_IS_ENABLED(q->flags))
+ return 0;
+
+ first = list_first_entry(&sched->entries, struct sched_entry, list);
+
+ /* The software timer adds the cycle time, the first interval and
+ * the finite gate durations of the first entry to the start. Entry
+ * offsets are also calculated from that start. None of these sums
+ * may overflow.
+ */
+ span = max_t(u64, sched->cycle_time, first->interval);
+ list_for_each_entry(entry, &sched->entries, list) {
+ span = max(span, offset);
+ offset += entry->interval;
+ }
+
+ for (tc = 0; tc < num_tc; tc++) {
+ if (first->gate_duration[tc] == sched->cycle_time)
+ continue;
+ span = max(span, first->gate_duration[tc]);
+ }
+
+ if (start < 0 || span > KTIME_MAX ||
+ (u64)start > KTIME_MAX - span) {
+ NL_SET_ERR_MSG(extack, "Schedule timing is out of range");
+ return -ERANGE;
+ }
+
+ return 0;
+}
+
static void setup_first_end_time(struct taprio_sched *q,
struct sched_gate_list *sched, ktime_t base)
{
@@ -1982,6 +2024,10 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt,
goto unlock;
}
+ err = taprio_validate_start_time(q, new_admin, start, extack);
+ if (err)
+ goto unlock;
+
setup_txtime(q, new_admin, start);
if (TXTIME_ASSIST_IS_ENABLED(q->flags)) {
--
2.53.0
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH net v3 2/3] net/sched: taprio: prevent cycle time extension overflow
2026-11-04 14:17 [PATCH net v3 0/3] net/sched: taprio: fix RCU stall from replayed schedule entries Krystian Kaniewski
2026-11-04 14:17 ` [PATCH net v3 1/3] net/sched: taprio: reject software schedules that overflow their timestamps Krystian Kaniewski
@ 2026-11-04 14:17 ` Krystian Kaniewski
2026-11-04 14:17 ` [PATCH net v3 3/3] net/sched: taprio: do not replay missed entries in advance_sched() Krystian Kaniewski
2 siblings, 0 replies; 4+ messages in thread
From: Krystian Kaniewski @ 2026-11-04 14:17 UTC (permalink / raw)
To: Vinicius Costa Gomes, Jamal Hadi Salim, Jiri Pirko,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Vladimir Oltean, Vedang Patel, netdev, linux-kernel
cycle_time_extension is an unrestricted signed 64-bit netlink value.
should_change_schedules() and get_interval_end_time() add it to an
absolute time without checking for overflow. A positive extension can
therefore wrap the result negative. The schedule handover test then
ignores an extension that should cover the admin base time. The
txtime-assist path can use the same wrapped value as its extended cycle
boundary.
Add one helper that saturates positive overflow at KTIME_MAX and use it
for both sums. Values that do not overflow, including negative
extensions, keep their existing behavior.
Fixes: c25031e99344 ("taprio: Add support for cycle-time-extension")
Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode")
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Krystian Kaniewski <krystianmkaniewski@gmail.com>
---
v3:
- split the overflow handling from the advance_sched() change (Vinicius)
- use the same helper for the sum in get_interval_end_time()
- add Acked-by from Vinicius
- drop the obsolete Assisted-by trailers
- rebase onto current net/main
v2: https://lore.kernel.org/all/20261009123309.284193-3-krystianmkaniewski@gmail.com/
net/sched/sch_taprio.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 2a31b189d654e2..e4c937cf74c10f 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -239,6 +239,18 @@ static s32 get_cycle_time_elapsed(struct sched_gate_list *sched, ktime_t time)
return time_elapsed;
}
+/*
+ * Netlink accepts any s64 cycle_time_extension. Saturate positive overflow
+ * so comparisons remain monotonic in end_time.
+ */
+static ktime_t taprio_cycle_ext_end(ktime_t end_time, s64 extension)
+{
+ if (extension > 0 && end_time > KTIME_MAX - extension)
+ return KTIME_MAX;
+
+ return ktime_add_ns(end_time, extension);
+}
+
static ktime_t get_interval_end_time(struct sched_gate_list *sched,
struct sched_gate_list *admin,
struct sched_entry *entry,
@@ -249,7 +261,8 @@ static ktime_t get_interval_end_time(struct sched_gate_list *sched,
cycle_end = ktime_add_ns(intv_start, sched->cycle_time - cycle_elapsed);
intv_end = ktime_add_ns(intv_start, entry->interval);
- cycle_ext_end = ktime_add(cycle_end, sched->cycle_time_extension);
+ cycle_ext_end =
+ taprio_cycle_ext_end(cycle_end, sched->cycle_time_extension);
if (ktime_before(intv_end, cycle_end))
return intv_end;
@@ -916,7 +929,8 @@ static bool should_change_schedules(const struct sched_gate_list *admin,
* next schedule base_time, we can extend the current schedule
* for that amount.
*/
- extension_time = ktime_add_ns(end_time, oper->cycle_time_extension);
+ extension_time = taprio_cycle_ext_end(end_time,
+ oper->cycle_time_extension);
/* FIXME: the IEEE 802.1Q-2018 Specification isn't clear about
* how precisely the extension should be made. So after
--
2.53.0
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH net v3 3/3] net/sched: taprio: do not replay missed entries in advance_sched()
2026-11-04 14:17 [PATCH net v3 0/3] net/sched: taprio: fix RCU stall from replayed schedule entries Krystian Kaniewski
2026-11-04 14:17 ` [PATCH net v3 1/3] net/sched: taprio: reject software schedules that overflow their timestamps Krystian Kaniewski
2026-11-04 14:17 ` [PATCH net v3 2/3] net/sched: taprio: prevent cycle time extension overflow Krystian Kaniewski
@ 2026-11-04 14:17 ` Krystian Kaniewski
2 siblings, 0 replies; 4+ messages in thread
From: Krystian Kaniewski @ 2026-11-04 14:17 UTC (permalink / raw)
To: Vinicius Costa Gomes, Jamal Hadi Salim, Jiri Pirko,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Vladimir Oltean, Vedang Patel, netdev,
linux-kernel, syzbot+e044a9b6370ed8ca9737
advance_sched() advances the software schedule by one entry per hrtimer
expiry and rearms the timer at the nominal end of that entry, without
reading the clock. When that time has already passed, the hrtimer core
runs the callback again inside the same interrupt, once for every missed
entry.
syzbot hits this with a single 127 ns entry on a veth device.
fill_sched_entry() only rejects intervals below the transmission time of
a minimum sized frame, which is 48 ns at the 10 Gb/s reported by veth,
so 127 ns is accepted. One expiry takes longer than 127 ns, so the
backlog grows instead of shrinking, the CPU stays in the timer interrupt
and RCU reports a stall. Lateness from a forward step of CLOCK_REALTIME
or CLOCK_TAI, from resume with CLOCK_BOOTTIME, or from a long time with
interrupts disabled leads to the same replay with any interval.
Record when the schedule starts and the period after which it repeats,
which is the cycle time, or the sum of the intervals when the entries
end before the cycle does. Whenever the entry that advance_sched() is
about to start has already ended, find the entry in progress from these
two values and continue from there. This selects the entry and the end
time that the replay would have reached, so a schedule that keeps up
with its timer behaves as before. The same check covers the first entry
after taprio_change() resets the current entry of a running schedule,
and the first entry of an admin schedule that takes over late.
advance_sched() now evaluates should_change_schedules() once on the
caught up end time instead of once per missed entry. This relies on
should_change_schedules() saturating the cycle_time_extension sum, which
makes the test monotonic in end_time. One check after catching up is
therefore equivalent to the repeated checks.
This bounds the work done per expiry. It does not limit how often the
timer fires. Unless the clock is stepped backward between the hrtimer
core reading it and the callback reading it, the timer is rearmed after
the current time and the CPU leaves the timer interrupt between
expiries. On the high-resolution hard interrupt path, a schedule whose
intervals are shorter than one expiry is then held back by the hang
detection in hrtimer_interrupt().
Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
Reported-by: syzbot+e044a9b6370ed8ca9737@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e044a9b6370ed8ca9737
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Krystian Kaniewski <krystianmkaniewski@gmail.com>
---
v3:
- move cycle-time-extension overflow handling to patch 2 (Vinicius)
- return the cycle end from taprio_entry_at() and update
cycle_end_time in advance_sched() (Vinicius)
- add Acked-by from Vinicius
- drop the obsolete Assisted-by trailers
- rebase onto current net/main
v2: https://lore.kernel.org/all/20261009123309.284193-3-krystianmkaniewski@gmail.com/
- taprio_entry_at(): do not use the list iterator after the loop.
Return the entry through a separate pointer that is set inside the
loop, and say in the comment why it is always set (Jakub)
- wrap the lines longer than 80 columns, with a local variable for the
number of elapsed periods in taprio_entry_at()
v1: https://lore.kernel.org/all/20261006113335.241564-3-krystianmkaniewski@gmail.com/
net/sched/sch_taprio.c | 127 ++++++++++++++++++++++++++++++++++-------
1 file changed, 106 insertions(+), 21 deletions(-)
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index e4c937cf74c10f..5a1dca9d5e9dec 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -90,6 +90,13 @@ struct sched_gate_list {
s64 cycle_time;
s64 cycle_time_extension;
s64 base_time;
+ /* The software schedule starts at start_time and repeats every period,
+ * which is the cycle time, or the sum of the intervals when the
+ * entries end before the cycle does, because advance_sched() then
+ * starts the list again right after the last entry.
+ */
+ ktime_t start_time;
+ s64 period;
};
struct taprio_sched {
@@ -942,16 +949,61 @@ static bool should_change_schedules(const struct sched_gate_list *admin,
return false;
}
+/* Return the entry of @sched which is in progress at @now, the one that
+ * advance_sched() reaches by moving one entry per expiry from the start of
+ * the schedule. Set @start and @end to the times at which it started and
+ * ends, and @cycle_end to the end of the cycle which contains it.
+ */
+static struct sched_entry *
+taprio_entry_at(const struct sched_gate_list *sched, ktime_t now,
+ ktime_t *start, ktime_t *end, ktime_t *cycle_end)
+{
+ struct sched_entry *entry, *found = NULL;
+ ktime_t cycle_start = sched->start_time;
+ s64 offset, entry_end = 0, elapsed = 0;
+
+ if (ktime_after(now, cycle_start)) {
+ s64 periods = div64_s64(ktime_sub(now, cycle_start),
+ sched->period);
+
+ cycle_start = ktime_add_ns(cycle_start,
+ periods * sched->period);
+ }
+ offset = ktime_sub(now, cycle_start);
+
+ /* The offset is less than one period, so an entry which ends after
+ * @now is found at the latest at the entry which reaches the end of
+ * the cycle, or at the last entry. A schedule has at least one entry,
+ * so the loop always sets found.
+ */
+ list_for_each_entry(entry, &sched->entries, list) {
+ entry_end = min_t(s64, elapsed + entry->interval,
+ sched->cycle_time);
+ if (offset < entry_end ||
+ list_is_last(&entry->list, &sched->entries)) {
+ found = entry;
+ break;
+ }
+ elapsed = entry_end;
+ }
+
+ *start = ktime_add_ns(cycle_start, elapsed);
+ *end = ktime_add_ns(cycle_start, entry_end);
+ *cycle_end = ktime_add_ns(cycle_start, sched->cycle_time);
+
+ return found;
+}
+
static enum hrtimer_restart advance_sched(struct hrtimer *timer)
{
struct taprio_sched *q = container_of(timer, struct taprio_sched,
advance_timer);
struct net_device *dev = qdisc_dev(q->root);
+ ktime_t cycle_end, end_time, start, now;
struct sched_gate_list *oper, *admin;
int num_tc = netdev_get_num_tc(dev);
struct sched_entry *entry, *next;
struct Qdisc *sch = q->root;
- ktime_t end_time;
int tc;
spin_lock(&q->current_entry_lock);
@@ -965,6 +1017,15 @@ static enum hrtimer_restart advance_sched(struct hrtimer *timer)
if (!oper)
switch_schedules(q, &admin, &oper);
+ /* The entry selected below can be over already, after a clock step,
+ * a long time with interrupts disabled, or because the intervals are
+ * shorter than one expiry takes. Moving on by one entry and arming the
+ * timer in the past would run this function again for every missed
+ * entry without leaving the timer interrupt. Take the entry which is in
+ * progress now instead, so that the timer is always armed after now.
+ */
+ now = taprio_get_time(q);
+
/* This can happen in two cases: 1. this is the very first run
* of this function (i.e. we weren't running any schedule
* previously); 2. The previous schedule just ended. The first
@@ -975,27 +1036,31 @@ static enum hrtimer_restart advance_sched(struct hrtimer *timer)
next = list_first_entry(&oper->entries, struct sched_entry,
list);
end_time = next->end_time;
- goto first_run;
- }
-
- if (should_restart_cycle(oper, entry)) {
- next = list_first_entry(&oper->entries, struct sched_entry,
- list);
- oper->cycle_end_time = ktime_add_ns(oper->cycle_end_time,
- oper->cycle_time);
+ if (likely(ktime_after(end_time, now)))
+ goto first_run;
+ /* Also after taprio_change() while the schedule runs */
+ next = taprio_entry_at(oper, now, &start, &end_time,
+ &cycle_end);
+ oper->cycle_end_time = cycle_end;
} else {
- next = list_next_entry(entry, list);
- }
-
- end_time = ktime_add_ns(entry->end_time, next->interval);
- end_time = min_t(ktime_t, end_time, oper->cycle_end_time);
+ if (should_restart_cycle(oper, entry)) {
+ next = list_first_entry(&oper->entries,
+ struct sched_entry, list);
+ oper->cycle_end_time =
+ ktime_add_ns(oper->cycle_end_time,
+ oper->cycle_time);
+ } else {
+ next = list_next_entry(entry, list);
+ }
- for (tc = 0; tc < num_tc; tc++) {
- if (next->gate_duration[tc] == oper->cycle_time)
- next->gate_close_time[tc] = KTIME_MAX;
- else
- next->gate_close_time[tc] = ktime_add_ns(entry->end_time,
- next->gate_duration[tc]);
+ start = entry->end_time;
+ end_time = ktime_add_ns(start, next->interval);
+ end_time = min_t(ktime_t, end_time, oper->cycle_end_time);
+ if (unlikely(!ktime_after(end_time, now))) {
+ next = taprio_entry_at(oper, now, &start, &end_time,
+ &cycle_end);
+ oper->cycle_end_time = cycle_end;
+ }
}
if (should_change_schedules(admin, oper, end_time)) {
@@ -1005,8 +1070,22 @@ static enum hrtimer_restart advance_sched(struct hrtimer *timer)
*/
next = list_first_entry(&oper->entries, struct sched_entry, list);
end_time = next->end_time;
+ if (likely(ktime_after(end_time, now)))
+ goto set_budgets;
+ next = taprio_entry_at(oper, now, &start, &end_time,
+ &cycle_end);
+ oper->cycle_end_time = cycle_end;
+ }
+
+ for (tc = 0; tc < num_tc; tc++) {
+ if (next->gate_duration[tc] == oper->cycle_time)
+ next->gate_close_time[tc] = KTIME_MAX;
+ else
+ next->gate_close_time[tc] =
+ ktime_add_ns(start, next->gate_duration[tc]);
}
+set_budgets:
next->end_time = end_time;
taprio_set_budgets(q, oper, next);
@@ -1319,7 +1398,8 @@ static void setup_first_end_time(struct taprio_sched *q,
{
struct net_device *dev = qdisc_dev(q->root);
int num_tc = netdev_get_num_tc(dev);
- struct sched_entry *first;
+ struct sched_entry *first, *entry;
+ s64 intervals = 0;
ktime_t cycle;
int tc;
@@ -1331,6 +1411,11 @@ static void setup_first_end_time(struct taprio_sched *q,
/* FIXME: find a better place to do this */
sched->cycle_end_time = ktime_add_ns(base, cycle);
+ list_for_each_entry(entry, &sched->entries, list)
+ intervals += entry->interval;
+ sched->start_time = base;
+ sched->period = min_t(s64, intervals, cycle);
+
first->end_time = ktime_add_ns(base, first->interval);
taprio_set_budgets(q, sched, first);
--
2.53.0
^ permalink raw reply [flat|nested] 4+ messages in thread