From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mail.toke.dk; spf=pass smtp.mailfrom=; dkim=pass header.d=trailofbits.com; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=trailofbits.com policy.dmarc=reject Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) by mail.toke.dk (Postfix) with ESMTPS id 07DBF12B5DB3 for ; Thu, 02 Jul 2026 02:08:54 +0200 (CEST) Received: by mail-qt1-x831.google.com with SMTP id d75a77b69052e-51c2c8f43aaso3959051cf.1 for ; Wed, 01 Jul 2026 17:08:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1782950933; x=1783555733; darn=lists.bufferbloat.net; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=cuxDLRMlHGpmhBCSI7O3vt6aIkiR+j43OrPR52n2sNY=; b=Coopja54og7RREMvHv/MAkWy8yjNJJuo15rT6HcWR0gYFeAZtchksPph+akKpqrN9j Ey8fP7r4G4VIW/hLT6GVTxmt+fWbNA4RE1cwnTlvXFBFhdrjAQjjxZUHntgJoWcsF7ue anAs0zb6nmgZZ0S3EnkwliQVvrQMqvKOY1Y3bs4T2F3kAC57HACBeaEM6xAv0S1a4NhW pl/XfCH5sC6QMDWLVFNiJXGJ+Qit0wVvmyrkAsvrPqhoeZ8k9/S6Tj3c1+cte/HoNeQH kRufnKF0GvQc4bk29pMD5DmJ8WagLMssBHaFVzoqHNdDY645u0IHcfF/4H3kobcAPETX 3Jtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782950933; x=1783555733; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=cuxDLRMlHGpmhBCSI7O3vt6aIkiR+j43OrPR52n2sNY=; b=LFxsteDFATjKdWRoOwLg4x10pDNHa0xUV/u/Uik6qmq8cEw36011LoSGlKp43oYg9I Jf7zEkVDRkzWP9zrE/h52zbSUZqS7C5CQYYQZtH+tL66TlEYqPNmdjepaGHkF97IGkga wuKo5f6ujoDQ291IXok+fU9pgT85vBbfZWAZSrp3bQMsupdXyhJU6BYA5/5tVBntNrLC H70SI8i4kPeyO6oAHuaJg86mVLTLCo380OcHC1S4ijiCjVERYt4iNariEvMZ4eKQKteB iqaCHtD9D7BMpiqj3OGZ4b1EmMuFko/q1Q0M4lNXwN84fNamHJ2ccMvngafHWftEXWio EvtA== X-Forwarded-Encrypted: i=1; AFNElJ83jNPLDN0/9gRPIAFo3O+QzPb0HsNRQi8V/2lB+8GENFG3ybHgQuxnCK1nfTpSmbPUvvzW@lists.bufferbloat.net X-Gm-Message-State: AOJu0Yy7o4agPdRoP425cffSjymLhdAIQG8yYygYrC7z+ZiWI6tZIJDY ZARvBVV67zUIlYRZ3D1n4psen+1LdKb+oXMG8bPj5ZcaP6zumcrLwgVwgs/89vUu2Rc= X-Gm-Gg: AfdE7ckflaCzXOH5YGhC1wvuIGNN9Xc1GHWmEbkw08Fs2JWjTHGPJP0Ek329D6R9FUM eTXDmxc6vRcQ8NdqEQTHx1BH4/65j3Jwi6AEtuDV1PaOdAw8wbo+XsT2LehtJeY1hWd0ieKCgYa KX6n1vxBxgAqGvdb+J+lmlRIxDNraqFHU+s21vE16DuWxdfxLrK8/uVZem+r1qcWKTqywxT1Ogf XZ5pZJfOS8/X/kwit1X1P+QPSmIk6v156Iu3Dc382XwF2ZDwK5zRDNnY+bjBP2WzR7jNdlQND1+ /Pk8EdZTAQjKHyDbZjjN5dOM0GCWmVgG3DnMIqIEN8uAJR4Xn+ezHCzNloG8CG1uTe3J9++o5Ys O9MbCFRHCS99viYwb/TRgCHDUYzOk3TAmzsDhWlHCBfYNgbbqo6YNFS+ZqlsajkjTrUhkhVJBge C6Lg3SX2soix2f4cfv X-Received: by 2002:a05:622a:558d:b0:51c:478:32a1 with SMTP id d75a77b69052e-51c26a61f79mr48748921cf.18.1782950932695; Wed, 01 Jul 2026 17:08:52 -0700 (PDT) Received: from localhost ([161.35.96.86]) by smtp.gmail.com with UTF8SMTPSA id d75a77b69052e-51c30b130d0sm3628021cf.9.2026.07.01.17.08.49 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 01 Jul 2026 17:08:51 -0700 (PDT) From: Samuel Moelius To: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= Cc: Samuel Moelius , Jamal Hadi Salim , Jiri Pirko , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , cake@lists.bufferbloat.net (moderated list:CAKE QDISC), netdev@vger.kernel.org (open list:TC subsystem), linux-kernel@vger.kernel.org (open list) Date: Thu, 2 Jul 2026 00:07:59 +0000 Message-ID: <20260702000758.297407.e5c888d9d99d.cake-overhead-underflow@trailofbits.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-MailFrom: sam.moelius@trailofbits.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: 23LTSDV6JYORMRZ2O7ARD44FQQYZVSPW X-Message-ID-Hash: 23LTSDV6JYORMRZ2O7ARD44FQQYZVSPW X-Mailman-Approved-At: Thu, 02 Jul 2026 11:13:24 +0200 X-Mailman-Version: 3.3.10 Precedence: list Subject: [Cake] [PATCH v3] net/sched: cake: reject overhead values that underflow length List-Id: Cake - FQ_codel the next generation Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value. Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance. Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments. Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper") Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius --- Changes in v3: - Adjust how check is performed - Resend with v3 suffix Changes in v2: - Add fixes tag net/sched/sch_cake.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index a3c185505afc..f78f8e950776 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -1389,10 +1389,7 @@ static u32 cake_calc_overhead(struct cake_sched_data *qd, u32 len, u32 off) if (qd->min_netlen > len) WRITE_ONCE(qd->min_netlen, len); - len += q->rate_overhead; - - if (len < q->rate_mpu) - len = q->rate_mpu; + len = max((s32)len + q->rate_overhead, (s32)q->rate_mpu); if (q->atm_mode == CAKE_ATM_ATM) { len += 47; -- 2.43.0