linux/include
Jamal Hadi Salim 7f4a5ec625 net/sched: codel: bound the dropping loop per dequeue call
The CoDel control law schedules the next drop one interval/sqrt(count)
after the previous drop, using the configured interval
(codel_params.interval). For very small intervals the scheduled step
rounds down to zero, so the dropping loop in codel_dequeue() never
advances and drains the entire backlog under the qdisc lock in one
call - an unprivileged user can trigger a soft lockup this way.

Fix in the shared codel code used by both codel and fq_codel:

1. Make the control-law step at least 1 tick so the dropping loop
   always moves forward.

2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops
   per codel_dequeue() call, resyncing drop_next to now when the cap
   is hit: the catch-up owed to the loop grows with the idle gap and
   the backlog, which no interval threshold can bound. This is a
   deliberate behaviour change after long idle gaps.

The cap applies to fq_codel (4b549a2ef4) and the mac80211 TXQ path
(fixed interval, cap only).

The target sojourn delay (codel_params.target) is not validated: it
does not feed the control law, so a sub-tick value is aggressive
rather than deadlock-prone.

Conditions to recreate the bug:
  - tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000
  - tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel)
  - unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf
    soft-lockups (watchdog: BUG: soft lockup) while one
    codel_dequeue() call drops the backlog under the qdisc lock
  - patched kernel: same setup, at most 256 drops per dequeue call,
    no soft lockup

Testing: claim reproducer and interval 2us/3us variants run clean;
tdc qdisc category passes (see the selftests patch).

Fixes: 76e3cc126b ("codel: Controlled Delay AQM")
Reported-by: Vega <vega@nebusec.ai>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/QDISC-1L5H.v1.20260912080102@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-16 17:15:29 -07:00
..
acpi ACPI: bus: Drop two fields from struct acpi_device_pnp 2026-09-01 21:45:50 +02:00
asm-generic kho: make boot time huge page allocation work nicely with KHO 2026-08-23 09:17:38 -07:00
clocksource hyperv-next for v7.3-rc1 2026-08-26 16:47:40 -07:00
crypto This update includes the following changes: 2026-08-19 17:25:42 -07:00
cxl
drm Merge drm/drm-fixes into drm-misc-fixes 2026-09-01 09:38:51 +02:00
dt-bindings sound fixes for 7.3-rc1 2026-08-28 10:01:02 -07:00
hyperv
keys tpm: Initial step to reorganize TPM public headers 2026-08-25 18:13:35 +03:00
kunit gpio updates for v7.3-rc1 2026-08-19 09:10:07 -07:00
kvm KVM/arm64 changes for 7.3 2026-08-24 12:42:07 -04:00
linux Many fixes: 2026-09-16 15:54:56 -07:00
math-emu
media
memory
misc
net net/sched: codel: bound the dropping loop per dequeue call 2026-09-16 17:15:29 -07:00
pcmcia
ras
rdma
rv mm.git review status for linus..mm-stable 2026-08-27 09:17:06 -07:00
scsi SCSI updates for 7.3 2026-08-29 11:55:36 -07:00
soc Mostly the usual clk driver updates and new SoC additions plus non-critical 2026-08-26 11:14:30 -07:00
sound ALSA: rawmidi: Another workaround for false-positive mutex lockdep warning 2026-08-25 15:55:37 +02:00
target usb: gadget: f_tcm: keep port count until LUN teardown completes 2026-08-14 10:49:21 +09:00
trace Landlock fix for v7.3-rc3 2026-09-09 11:00:35 -07:00
uapi integrity-v7.3-rc2 2026-09-04 19:36:11 -07:00
ufs
vdso vDSO: Make clockmode constants available without CONFIG_GENERIC_GETTIMEOFDAY 2026-08-10 16:25:21 +02:00
video fbdev: maxine: fix 64-bit build error 2026-08-20 23:45:07 +02:00
xen
Kbuild