github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-03 17:59:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
36d32222fc
linux/net/sched
History
Samuel Moelius b7f97cae7e net/sched: cake: reject overhead values that underflow length 
CAKE accepts signed overhead values and stores them in an s16, but the
adjusted packet length calculation uses unsigned arithmetic.  A negative
effective length can therefore wrap to a large value.

Such configurations make rate accounting depend on integer wraparound
rather than on the packet size userspace intended to model.  A static
netlink lower bound is not enough because packets reaching CAKE can be
smaller than any reasonable manual-overhead allowance.

Fold the signed overhead adjustment into the existing datapath MPU clamp
so negative adjusted lengths are clamped before link-layer framing
adjustments.

Fixes: a729b7f0bd ("sch_cake: Add overhead compensation support to the rate shaper")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260702000758.297407.e5c888d9d99d.cake-overhead-underflow@trailofbits.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-08 11:42:21 +02:00
..
act_api.c net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload 2026-07-06 12:52:01 +02:00
act_bpf.c net/sched: act_bpf: use rcu_dereference_bh() to read the filter 2026-06-30 18:27:26 -07:00
act_connmark.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_csum.c net/sched: act_csum: don't mangle UDP tunnel GSO packets 2026-06-14 13:27:39 +02:00
act_ct.c net/sched: act_ct: fix nf_connlabels leak on two error paths 2026-06-21 15:00:47 -07:00
act_ctinfo.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_gact.c
act_gate.c net/sched: act_gate: snapshot parameters with RCU on replace 2026-02-27 16:10:36 -08:00
act_ife.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c net/sched: act_mirred: Fix return code in early mirred redirect error paths 2026-05-28 12:26:36 +02:00
act_mpls.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_nat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_pedit.c net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload 2026-07-06 12:52:01 +02:00
act_police.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_sample.c
act_simple.c net/sched: Remove redundant memset(0) call in reset_policy() 2025-08-12 17:13:29 -07:00
act_skbedit.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_skbmod.c net/sched: rename qstats_overlimit_inc() to qstats_cpu_overlimit_inc() 2026-04-29 16:42:44 -07:00
act_tunnel_key.c net_sched: add back BH safety to tcf_lock 2025-09-02 15:51:45 -07:00
act_vlan.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
bpf_qdisc.c bpf: net_sched: Use the correct destructor kfunc type 2026-01-12 18:53:57 -08:00
cls_api.c net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload 2026-07-06 12:52:01 +02:00
cls_basic.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cls_bpf.c net/sched: cls_bpf: prevent unbounded recursion in offload rollback 2026-05-27 17:46:35 -07:00
cls_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cls_flow.c net/sched: cls_flow: Dont expose folded kernel pointers 2026-06-11 15:04:56 -07:00
cls_flower.c net/sched: cls_flower: revert unintended changes 2026-04-30 13:47:01 +02:00
cls_fw.c net/sched: cls_fw: fix NULL dereference of "old" filters before change() 2026-04-12 08:49:13 -07:00
cls_matchall.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cls_route.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cls_u32.c net: sched: cls_u32: Avoid memcpy() false-positive warning in u32_init_knode() 2026-03-10 19:39:35 -07:00
em_canid.c net/sched: em_canid: fix uninit-value in em_canid_match 2025-11-26 16:28:10 +01:00
em_cmp.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_ipset.c
em_ipt.c
em_meta.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
em_nbyte.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_text.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
em_u32.c
ematch.c
Kconfig sched: Add enqueue/dequeue of dualpi2 qdisc 2025-07-23 17:52:07 -07:00
Makefile sched: Add enqueue/dequeue of dualpi2 qdisc 2025-07-23 17:52:07 -07:00
sch_api.c net/sched: prefer existing extack message in qdisc_offload_graft_helper() 2026-05-22 17:23:37 -07:00
sch_blackhole.c
sch_cake.c net/sched: cake: reject overhead values that underflow length 2026-07-08 11:42:21 +02:00
sch_cbs.c net: sched: avoid printing uninitialized link speed 2026-06-11 15:44:55 +02:00
sch_choke.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_codel.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
sch_drr.c net/sched: sch_drr: make cl->quantum lockless 2026-05-20 19:04:58 -07:00
sch_dualpi2.c net/sched: dualpi2: clear stale classification on filter miss 2026-07-01 09:00:25 +01:00
sch_etf.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_ets.c net/sched: sch_ets: make cl->quantum lockless 2026-05-25 11:09:27 -07:00
sch_fifo.c
sch_fq_codel.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
sch_fq_pie.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_fq.c net_sched: sch_fq: convert skb->tstamp if not monotonic 2026-06-08 16:00:06 -07:00
sch_frag.c net: convert remaining ipv6_stub users to direct function calls 2026-03-29 11:21:23 -07:00
sch_generic.c net: do not acquire dev->tx_global_lock in netdev_watchdog_up() 2026-06-23 14:40:33 -07:00
sch_gred.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_hfsc.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
sch_hhf.c net/sched: hhf: clear heavy-hitter state on reset 2026-07-01 09:09:38 +01:00
sch_htb.c net/sched: sch_htb: fix htb_dump_class_stats() vs offload mode 2026-05-19 18:42:48 -07:00
sch_ingress.c clsact: Fix use-after-free in init/destroy rollback asymmetry 2026-03-17 12:09:16 +01:00
sch_mq.c net/sched: mq: no longer acquire qdisc spinlocks in dump operations 2026-05-11 18:28:08 -07:00
sch_mqprio_lib.c
sch_mqprio_lib.h
sch_mqprio.c net/sched: mq_prio: no longer acquire qdisc spinlocks in mqprio_dump_class_stats() 2026-05-11 18:28:08 -07:00
sch_multiq.c net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked 2026-06-26 18:52:26 -07:00
sch_netem.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-05-28 14:02:21 -07:00
sch_pie.c net/sched: sch_pie: annotate more data-races in pie_dump_stats() 2026-05-01 17:54:57 -07:00
sch_plug.c
sch_prio.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_qfq.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_red.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_sfb.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_sfq.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_skbprio.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_taprio.c net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked 2026-06-26 18:52:26 -07:00
sch_tbf.c net/sched: tbf: add extack to offload params 2026-05-22 17:23:37 -07:00
sch_teql.c net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants 2026-07-03 16:02:38 +02:00