From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mail.toke.dk; dkim=pass header.d=mojatatu.com header.i=@mojatatu.com header.a=rsa-sha256 header.s=google header.b=IMcfiCf3; arc=pass; dmarc=none Received: from mail-pf1-x42f.google.com (mail-pf1-x42f.google.com [IPv6:2607:f8b0:4864:20::42f]) by mail.toke.dk (Postfix) with ESMTPS id 017501874D5A for ; Mon, 19 Oct 2026 23:08:29 +0200 (CEST) Received: by mail-pf1-x42f.google.com with SMTP id d2e1a72fcca58-8a06454116eso770884b3a.1 for ; Mon, 19 Oct 2026 14:08:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1792444107; cv=none; d=google.com; s=arc-20260327; b=mz42iSLenMRe4vT87WVF8zkiumf/TSH0DxEuf3CsHiKutdq4or2cRtDl1179wIUzgP 8HEdQBqYp2dpUmqqq3qVXRgobQ0/LS7RK3/WPqfZJVNiGOcCjHclZTqYWm3pjqogWKCA w8s4kQo8JJXLdWES2F2xBvl02ig8qH7XQxTsv/jGMbRlKohL6/gHgD7E2P/bJNnCm4QS EYuks112umlkFQwJeKJH+bJnY+AVPta7+WUhkfJIiAJTFIhkAwApQgD4368A94nAAfs6 SbJgaw9hJDTtYdNB4JoEVPJoylBM2ZZLqgMQy6CCKUaIiqOqvLCmDUf3vpo9uOkuhkf5 iq6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=BQAlR8hJ+t0fEkcY1C90gZxc6fFNmtiyvrRw14WgVU4=; fh=xWZv2m+KhXfn46mGkzfCria87Ghrhr9/zonXfbMy6n0=; b=UHfvNZ9Bu1KlI6b9TNskU1SgR3VcqCFUNTz9pFzKA8oNLFU3/7Hn/AbtpsotJQygmZ v6T3rW54MNekSJU9xXrdCCYFktpCmBwmSLURXOaLqGSn7meAOoeRy2670mlCiV3/2Mr1 zCEwyARf3Zdq2ar8pU7efwCpegv6zM9TrzmK4h/gKLj3ndPoeVcWyCQ1S2gQ4mXMotL7 3ROtzKeduuucfa4D+XbLdEXeBRSE/upJc/Gr2Gicu9lzQr6pNRImbQ8Lj6xeprD7MilB +Lsom1bqJ99V0v8oF0MIDjUuFGZzK1wPsoYWm5uBhSC8Ar4x7o7drKS1yus+q5OxQfqf QTmw==; darn=lists.bufferbloat.net ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu.com; s=google; t=1792444107; x=1793048907; darn=lists.bufferbloat.net; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to:content-type; bh=BQAlR8hJ+t0fEkcY1C90gZxc6fFNmtiyvrRw14WgVU4=; b=IMcfiCf3PNSuIgOIjV0zvgaBfTpYI+egIFEWAeuwo0OMiMoWxyPLDifyr9eYqp4Aox E4v8izyAimdeDeUfX/DMxwiNRcNid+b+O3nGqWYwI6My+80OV0QBEYqtra9TW6RDgu+A fSC/Ln3Kw4mFPHJo0+t2h3q6+QNfVFdvqi1qw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792444107; x=1793048907; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=BQAlR8hJ+t0fEkcY1C90gZxc6fFNmtiyvrRw14WgVU4=; b=Aefxu7n35AkKu6aOuOdGeVWxG3riLuQnOREaO5chQWbkyeMDFmO1P25gUG7nmPlkug XMSe6qVSSIqu9TiaDFeu+7hrJ3W/d87OAyuK8PSOxfIiusXRnUFmvfJP1KEjmYltt6K8 GZ8esD3rKE/ERgZtMHGCJxYGbBx8fTYn6/XWyZWC831iWN4emn9qo/pGPiWZT23PnVcE cwgVIUvjrYndeNcC9SWLwlBfVax59FfT5tO9+dFfZiAKYb7gJsIn8gNjCQXZIXaQvBLY 6mmGyGSPy/3J3QTjpLRBJ7pU7/04VEOsl3nYSRv0pWNmgy60cdnTMZZ2rgYqI/+eWnar x1sw== X-Forwarded-Encrypted: i=1; AKwUvBzaQB3WB4nFo35SoB76+EuQFkLSXqeh+zJ3h1Exmi31CT4F9umIeQ4yKhi11Z3xMQKdBQGb@lists.bufferbloat.net X-Gm-Message-State: AFq9FYJYn3iRNv2mvy8JhjFLmeGTLRsW5Z3P6XfNe2etSZvFZ3mSFOhF cX6AU6Dkeki4xLHyqASaZZ9Yc8LnF6EUwlSeqJNmg8A6Cl87oN189+/Gycvc0ZoWZbdrPSqhkYB l6GJzrr4JW3d28r5iogkySz0ycR69+BP0L8P5zZCe X-Gm-Gg: AYBFou38afVg/F1N8TIf4AOjkg8B06gc7oGzAP1xyoorfqJ7/OvOxSYg/XxaDfZxSBI AEnnFm23jYFtvhNZrOv6V9T83KZtDJzk57/NTQlKpH7gt6DAyDnkW/KeedEXZBV6czBCM+JXX7g +xXd6saNASji+TpZSohPmb+ufqBudwxLGlulzC+m+uJVbSD083CFDuiMSgNfYv0aOtAXT/GlR6f YIOh8SwXF99mVaQWhZJsJ8L0CSYdgLYEeuRk+WELAUiv0livai/UbTvbDF0K2ppt7ejWq+IvXt+ n7mEBHYPJLPKoCJCf+kqmFShHkaaTn+qnjtfIeW4hA+A7pYFvuWVv9OBvDElo2cCr0e648frE4/ BxuGzChSmYIN8Uotq+LTupq65gDm0um4vQg== X-Received: by 2002:a05:6a00:2296:b0:878:34d7:699e with SMTP id d2e1a72fcca58-8a04caf967emr6870962b3a.46.1792444107445; Mon, 19 Oct 2026 14:08:27 -0700 (PDT) MIME-Version: 1.0 References: <87qzhlwo0a.fsf@toke.dk> In-Reply-To: <87qzhlwo0a.fsf@toke.dk> From: Jamal Hadi Salim Date: Mon, 19 Oct 2026 17:08:15 -0400 X-Gm-Features: AclHuK-QQl6EUrq2SbfmkjVQQT3-8KohZSlX-iqbzLfUmB0GFt2NA5_IPkxSmpQ Message-ID: To: =?UTF-8?B?VG9rZSBIw7hpbGFuZC1Kw7hyZ2Vuc2Vu?= Cc: netdev@vger.kernel.org, Jiri Pirko , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Victor Nogueira , =?UTF-8?B?QmrDtnJuIFTDtnBlbA==?= , cake@lists.bufferbloat.net, Sashiko Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: PEU3ZEJKU4XW2NOMRW7NLEAZQXH6BSXH X-Message-ID-Hash: PEU3ZEJKU4XW2NOMRW7NLEAZQXH6BSXH X-MailFrom: jhs@mojatatu.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list Subject: [Cake] Re: [PATCH net-next v7 3/4] net/sched: cap the accounted backlog before it can wrap List-Id: Cake - FQ_codel the next generation Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Mon, Oct 19, 2026 at 2:20=E2=80=AFPM Toke H=C3=B8iland-J=C3=B8rgensen wrote: > > Jamal Hadi Salim writes: > > > This is a followup of commit 709f34f7c28d ("net/sched: fq: add overflow > > bounds to quantum and initial quantum") as reported by Sashiko. > > The rest of this commit message is somewhat obtuse - too much run-on > information. I think it can be pretty easily fixed by a couple of > rearrangements and paragraph breaks, like this: > Sigh - i thought i took care of this (iirc, Stephen preferred the shorter form as well) Thanks for the reviewed by. I guess i have to send a v8. cheers, jamal > > The issue: fq_codel, cake, codel, pie, fq_pie, dualpi2, RED, pfifo, > > plug and (non-WRED) gred account every enqueued packet's stab-adjusted > > length into the 32-bit sch->qstats.backlog. A crafted tc size table > > inflates qdisc_pkt_len() up to QDISC_PKT_LEN_MAX (1 MiB), and a dodgy > > GSO skb can account even more through qdisc_pkt_len_segs_init(), so a > > few thousand packets wrap the counter mod 2^32. > > > > The AQM then reads a small backlog and makes the wrong drop decision, > > and the dequeue-side subtractions leave it corrupt (for non-WRED gred > > it is the reported stats and the dequeue-side subtractions that go > > wrong instead). In fq_codel a wrapped per-flow backlog can also make > > fq_codel_drop()'s scan pick an empty flow, dereferencing a NULL > > flow->head. > > > > The Fix: drop at enqueue once the stored backlog cannot represent the > > incoming packet's accounted length. > > > > Ordinary packets (qdisc_pkt_len() at most QDISC_PKT_LEN_MAX) are > > covered by a standing ceiling: drop once the backlog is within > > QDISC_MAX_BACKLOG (U32_MAX - QDISC_PKT_LEN_MAX) of the wrap point, the > > largest backlog one more 1 MiB packet cannot wrap, so there is no > > per-enqueue 64-bit add. > > > > A larger wire estimate is checked against the space that actually > > remains (len > U32_MAX - backlog): qdisc_pkt_len_segs_init() adds the > > headers replicated on every output segment, so a supported small-MSS > > BIG TCP aggregate can carry a wire estimate above 1 MiB while its raw > > length stays within GSO_MAX_SIZE, and such traffic must pass on an > > empty queue. > > > > qdisc_pkt_len() itself stays truthful for every input: it is not > > clamped and the initializer keeps succeeding, so BPF > > __sk_buff.wire_len, act_police and the HTB/TBF shapers read the real > > length, and sch_handle_ingress() -- which ignores the initializer's > > return value and reads pkt_segs for packet statistics -- keeps > > complete metadata. > > > > Cover sch_plug and non-WRED sch_gred too: plug admits on skb->len > > while qdisc_enqueue_tail() adds qdisc_pkt_len(), and gred bounds each > > virtual queue but adds every VQ into the one aggregate. pfifo is > > included because RED reads a grafted child's backlog into > > red_calc_qavg(); it can be reached standalone or as the default child > > of SFB. In RED, account the packet to the aggregate before handing it > > to the child, because a duplicating netem child re-enqueues its clone > > at the root while the stored backlog is still un-updated -- one guard > > check must not authorize two additions. > > > > The guard bounds each qdisc's own enqueue path: a child that segments a > > GSO skb (tbf, netem) can still grow a parent's aggregate through > > qdisc_tree_reduce_backlog()'s unclamped byte delta, which is left to a > > separate change. > > > > Conditions to recreate the bug: > > ip tuntap add tun0 mode tun > > ip link set tun0 txqueuelen 32 up > > ip addr add 10.99.0.1/24 dev tun0 > > tc qdisc add dev tun0 root handle 1: stab overhead 2000000000 \ > > fq_codel flows 1 limit 20000 ecn > > # hold the tun fd open without reading so the backlog persists, then > > # send 6000 packets: the counter wraps and the unfixed kernel reports > > # a wrapped backlog, while the fixed one drops at the ceiling. > > > > Reported-by: Sashiko (nipa) > > Closes: https://lore.kernel.org/netdev/20260818101130.16203-1-jhs@mojat= atu.com/ > > Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/2026081810113= 0.16203-1-jhs@mojatatu.com > > Link: https://lore.kernel.org/netdev/CANn89iLfMJV7ancKH1Gjzzm7ZUG-gKcrc= zkJjJEWN5sCuWd-ug@mail.gmail.com/ > > Link: https://lore.kernel.org/netdev/CANn89i+GOFH_8g+vSV0jUj0aBqLYVWuFO= rHuDggZu9kPC_m6tQ@mail.gmail.com/ > > Link: https://lore.kernel.org/netdev/87a4oottcj.fsf@toke.dk/ > > Link: https://lore.kernel.org/netdev/87pkxks68f.fsf@toke.dk/ > > Link: https://lore.kernel.org/netdev/179231932946.3135.7497478990186385= 688@kernel.org/ > > Reviewed-by: Victor Nogueira > > Signed-off-by: Jamal Hadi Salim > > With the above rewording: > > Reviewed-by: Toke H=C3=B8iland-J=C3=B8rgensen