mirror of
https://github.com/torvalds/linux.git
synced 2026-09-30 14:34:02 +02:00
The CoDel control law schedules the next drop one interval/sqrt(count) after the previous drop, using the configured interval (codel_params.interval). For very small intervals the scheduled step rounds down to zero, so the dropping loop in codel_dequeue() never advances and drains the entire backlog under the qdisc lock in one call - an unprivileged user can trigger a soft lockup this way. Fix in the shared codel code used by both codel and fq_codel: 1. Make the control-law step at least 1 tick so the dropping loop always moves forward. 2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops per codel_dequeue() call, resyncing drop_next to now when the cap is hit: the catch-up owed to the loop grows with the idle gap and the backlog, which no interval threshold can bound. This is a deliberate behaviour change after long idle gaps. The cap applies to fq_codel (4b549a2ef4) and the mac80211 TXQ path (fixed interval, cap only). The target sojourn delay (codel_params.target) is not validated: it does not feed the control law, so a sub-tick value is aggressive rather than deadlock-prone. Conditions to recreate the bug: - tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000 - tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel) - unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf soft-lockups (watchdog: BUG: soft lockup) while one codel_dequeue() call drops the backlog under the qdisc lock - patched kernel: same setup, at most 256 drops per dequeue call, no soft lockup Testing: claim reproducer and interval 2us/3us variants run clean; tdc qdisc category passes (see the selftests patch). Fixes:76e3cc126b("codel: Controlled Delay AQM") Reported-by: Vega <vega@nebusec.ai> Reviewed-by: Eric Dumazet <edumazet@google.com> Tested-by: Victor Nogueira <victor@mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/QDISC-1L5H.v1.20260912080102@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
173 lines
6.0 KiB
C
173 lines
6.0 KiB
C
#ifndef __NET_SCHED_CODEL_H
|
|
#define __NET_SCHED_CODEL_H
|
|
|
|
/*
|
|
* Codel - The Controlled-Delay Active Queue Management algorithm
|
|
*
|
|
* Copyright (C) 2011-2012 Kathleen Nichols <nichols@pollere.com>
|
|
* Copyright (C) 2011-2012 Van Jacobson <van@pollere.net>
|
|
* Copyright (C) 2012 Michael D. Taht <dave.taht@bufferbloat.net>
|
|
* Copyright (C) 2012,2015 Eric Dumazet <edumazet@google.com>
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions, and the following disclaimer,
|
|
* without modification.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. The names of the authors may not be used to endorse or promote products
|
|
* derived from this software without specific prior written permission.
|
|
*
|
|
* Alternatively, provided that this notice is retained in full, this
|
|
* software may be distributed under the terms of the GNU General
|
|
* Public License ("GPL") version 2, in which case the provisions of the
|
|
* GPL apply INSTEAD OF those given above.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
|
|
* DAMAGE.
|
|
*
|
|
*/
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/ktime.h>
|
|
#include <linux/skbuff.h>
|
|
|
|
/* Controlling Queue Delay (CoDel) algorithm
|
|
* =========================================
|
|
* Source : Kathleen Nichols and Van Jacobson
|
|
* http://queue.acm.org/detail.cfm?id=2209336
|
|
*
|
|
* Implemented on linux by Dave Taht and Eric Dumazet
|
|
*/
|
|
|
|
|
|
/* CoDel uses a 1024 nsec clock, encoded in u32
|
|
* This gives a range of 2199 seconds, because of signed compares
|
|
*/
|
|
typedef u32 codel_time_t;
|
|
typedef s32 codel_tdiff_t;
|
|
#define CODEL_SHIFT 10
|
|
#define MS2TIME(a) ((a * NSEC_PER_MSEC) >> CODEL_SHIFT)
|
|
|
|
static inline codel_time_t codel_get_time(void)
|
|
{
|
|
u64 ns = ktime_get_ns();
|
|
|
|
return ns >> CODEL_SHIFT;
|
|
}
|
|
|
|
/* Dealing with timer wrapping, according to RFC 1982, as desc in wikipedia:
|
|
* https://en.wikipedia.org/wiki/Serial_number_arithmetic#General_Solution
|
|
* codel_time_after(a,b) returns true if the time a is after time b.
|
|
*/
|
|
#define codel_time_after(a, b) \
|
|
(typecheck(codel_time_t, a) && \
|
|
typecheck(codel_time_t, b) && \
|
|
((s32)((a) - (b)) > 0))
|
|
#define codel_time_before(a, b) codel_time_after(b, a)
|
|
|
|
#define codel_time_after_eq(a, b) \
|
|
(typecheck(codel_time_t, a) && \
|
|
typecheck(codel_time_t, b) && \
|
|
((s32)((a) - (b)) >= 0))
|
|
#define codel_time_before_eq(a, b) codel_time_after_eq(b, a)
|
|
|
|
static inline u32 codel_time_to_us(codel_time_t val)
|
|
{
|
|
u64 valns = ((u64)val << CODEL_SHIFT);
|
|
|
|
do_div(valns, NSEC_PER_USEC);
|
|
return (u32)valns;
|
|
}
|
|
|
|
/**
|
|
* struct codel_params - contains codel parameters
|
|
* @target: target queue size (in time units)
|
|
* @ce_threshold: threshold for marking packets with ECN CE
|
|
* @interval: width of moving time window
|
|
* @mtu: device mtu, or minimal queue backlog in bytes.
|
|
* @ecn: is Explicit Congestion Notification enabled
|
|
* @ce_threshold_selector: apply ce_threshold to packets matching this value
|
|
* in the diffserv/ECN byte of the IP header
|
|
* @ce_threshold_mask: mask to apply to ce_threshold_selector comparison
|
|
*/
|
|
struct codel_params {
|
|
codel_time_t target;
|
|
codel_time_t ce_threshold;
|
|
codel_time_t interval;
|
|
u32 mtu;
|
|
bool ecn;
|
|
u8 ce_threshold_selector;
|
|
u8 ce_threshold_mask;
|
|
};
|
|
|
|
/**
|
|
* struct codel_vars - contains codel variables
|
|
* @count: how many drops we've done since the last time we
|
|
* entered dropping state
|
|
* @lastcount: count at entry to dropping state
|
|
* @dropping: set to true if in dropping state
|
|
* @rec_inv_sqrt: reciprocal value of sqrt(count) >> 1
|
|
* @first_above_time: when we went (or will go) continuously above target
|
|
* for interval
|
|
* @drop_next: time to drop next packet, or when we dropped last
|
|
* @ldelay: sojourn time of last dequeued packet
|
|
*/
|
|
struct codel_vars {
|
|
u32 count;
|
|
u32 lastcount;
|
|
bool dropping;
|
|
u16 rec_inv_sqrt;
|
|
codel_time_t first_above_time;
|
|
codel_time_t drop_next;
|
|
codel_time_t ldelay;
|
|
};
|
|
|
|
#define REC_INV_SQRT_BITS (8 * sizeof(u16)) /* or sizeof_in_bits(rec_inv_sqrt) */
|
|
/* needed shift to get a Q0.32 number from rec_inv_sqrt */
|
|
#define REC_INV_SQRT_SHIFT (32 - REC_INV_SQRT_BITS)
|
|
|
|
/* Cap on drops per codel_dequeue() call: the loop's work depends on the
|
|
* idle gap and backlog, both outside our control; resync when exceeded.
|
|
*/
|
|
#define CODEL_MAX_DROPS_PER_DEQUEUE 256
|
|
|
|
/**
|
|
* struct codel_stats - contains codel shared variables and stats
|
|
* @maxpacket: largest packet we've seen so far
|
|
* @drop_count: temp count of dropped packets in dequeue()
|
|
* @drop_len: bytes of dropped packets in dequeue()
|
|
* @ecn_mark: number of packets we ECN marked instead of dropping
|
|
* @ce_mark: number of packets CE marked because sojourn time was above ce_threshold
|
|
*/
|
|
struct codel_stats {
|
|
u32 maxpacket;
|
|
u32 drop_count;
|
|
u32 drop_len;
|
|
u32 ecn_mark;
|
|
u32 ce_mark;
|
|
};
|
|
|
|
#define CODEL_DISABLED_THRESHOLD INT_MAX
|
|
|
|
typedef u32 (*codel_skb_len_t)(const struct sk_buff *skb);
|
|
typedef codel_time_t (*codel_skb_time_t)(const struct sk_buff *skb);
|
|
typedef void (*codel_skb_drop_t)(struct sk_buff *skb, void *ctx);
|
|
typedef struct sk_buff * (*codel_skb_dequeue_t)(struct codel_vars *vars,
|
|
void *ctx);
|
|
|
|
#endif
|