From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mail.toke.dk; dkim=pass header.d=mojatatu.com header.i=@mojatatu.com header.a=rsa-sha256 header.s=google header.b=HV5b7G1s; arc=none (Message is not ARC signed); dmarc=none Received: from mail-qv1-xf33.google.com (mail-qv1-xf33.google.com [IPv6:2607:f8b0:4864:20::f33]) by mail.toke.dk (Postfix) with ESMTPS id 1BEB71816013 for ; Thu, 15 Oct 2026 12:32:57 +0200 (CEST) Received: by mail-qv1-xf33.google.com with SMTP id 6a1803df08f44-917d595138fso8445206d6.3 for ; Thu, 15 Oct 2026 03:32:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu.com; s=google; t=1792060376; x=1792665176; darn=lists.bufferbloat.net; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=66piF5YkkVEBVNwq8Z5bqRw7oWnzwFidIdz5zrD4ZM8=; b=HV5b7G1skJafWYkj9rGjfzdXdniViZ3P62l3CLqgsZSbNTA1ZwI3R4k26RQG91jaCi bpkiNkgxnicWmanGCn98KKtGoS2VTXkSmZFz9kxqkP5/xKjHXQvqg71Paa5sG2FYLHp7 zh+UNbubN4HTTDzfYJNvCPQlXdcSiyU2zFuwM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792060376; x=1792665176; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=66piF5YkkVEBVNwq8Z5bqRw7oWnzwFidIdz5zrD4ZM8=; b=OJ2kAtCK2zxoMSKNsyexv6fIcN2KcoFwaEhomVAD2oc/GRkWuENT7hp0WanZn6Ball X8z63mqWGe6WFBkIycO3tNsb5L/mvRuPCScjp68U8wNegHhp+WMB1Tc314bLGGvidXei Kl85+0XjYs+XwuRNdkBQZyiS7fPNNmq1Wx/mdeyr8J/B+Exy8vbKob59u6RL5aNbYe/v i09dR0GuVaMx6U4qzjxkIIfTp4upEdcid+M4sYxm2gtdk+MNfKaz5SZyIRWnX3bvBOum ShjF+9vr5Uce+nxNjcLTmVSn7FhbRFKDcjtb/VEqozW1+KleWzWxkUQCvA63CE4gZb+d BJRQ== X-Forwarded-Encrypted: i=1; AKwUvBwUA6hZGLLILhrRSo6adgrND3UqRyV2VBDdt+LKI0PP6Ci0Sf3HrvR464VUPlGRUilO28gv@lists.bufferbloat.net X-Gm-Message-State: AFq9FYKZl4Dn3b7Q339kT/o0quTNrXCeY9BbeSURPOYdwHOYBUIVDZnI 4M0W6yN4U8n2tutrqg8sfDNxV699aOq7vcKvCz8AGRGPNnUV8op54o4sCHkh4uqSQw== X-Gm-Gg: AYBFou2b6FhHx0+T5Qpanql60ScqtgXURF2HRFViie32i1jFdm5bO+KU6oKZvF7NJNd 01P1NpM0tBuCm+OaRUO69HMlqJhV+SswEUPJl1JSNJ+1i7mtMQXnA/3kIpf1UHn689POdzQj4oO 0gFB/dO/hQ3N8PjwZ11P8nIMjPDln4Cc8uqNEJMso6hIglmpGJQ8kwkhVtXFfrONsNvnFI8EDwd 8sNrMVWg4kO8kNnsYTlYHU7eu5B/u8K/d68Hx2fTmBZqxMPCk7WqCfpghmwiUZ5dFpAuRnUgtCM nssAaIvDhQSvQ8lrX7psXh1oZGHowhcIoy0/MNGYxJF0tDD/q2+Vkvvlx1mRQHM3k2NcgRo2+mk G1mXfJfrLrslVjl5k4+G1wyIvyk4TU/EnalS3Q69Rp4HNmklLWy0ggp0x/YNdTKBOPPQtnHIH33 mk3wsGIk6DCN0UVWajvwkrk5EErsJ2U3JbTe3utGCfikDK7B8N7T5xap+U2cJgPrDSVzg19j9dl XYojgFu7ZiuwiomD9H3wiNLLL0GDpe2qCG/LgFtlmMp X-Received: by 2002:a05:6214:268e:b0:917:a8ae:26d6 with SMTP id 6a1803df08f44-91b5557f525mr318815846d6.34.1792060375737; Thu, 15 Oct 2026 03:32:55 -0700 (PDT) Received: from mbili.waya ([64.203.83.2]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91ba684f404sm55261936d6.31.2026.10.15.03.32.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Oct 2026 03:32:54 -0700 (PDT) From: Jamal Hadi Salim To: netdev@vger.kernel.org Cc: Jamal Hadi Salim , =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Jiri Pirko , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , cake@lists.bufferbloat.net, Victor Nogueira , Sashiko Date: Thu, 15 Oct 2026 06:32:44 -0400 Message-Id: X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: OAETW32TTR4PVN6TTUWIUYF65UGMVTWV X-Message-ID-Hash: OAETW32TTR4PVN6TTUWIUYF65UGMVTWV X-MailFrom: jhs@mojatatu.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list Subject: [Cake] [PATCH net-next v2 3/4] net/sched/sch_cake: widen buffer_used to u64 List-Id: Cake - FQ_codel the next generation Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This is a follow-up to commit 4c660ee8c809 ("net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue"), which promoted the backlog + length admission sums in gred, bfifo and plug to u64. CAKE's own memory accounting has the same 32-bit wrap. The issue: cake_sched_data.buffer_used accumulates skb->truesize and is compared against memory_limit: q->buffer_used += skb->truesize; if (q->buffer_used <= q->buffer_limit) return NET_XMIT_SUCCESS; while (q->buffer_used > q->buffer_limit) drop... buffer_used is u32, so once the resident truesize passes 2^32 it wraps to a small value, the <= test passes and the drop loop is skipped even though far more than the configured limit is queued. memory_limit is a u32 attribute (TCA_CAKE_MEMORY), so buffer_limit can be as large as U32_MAX and never caps buffer_used below the wrap point; with a large memory_limit the queue then grows until the machine is out of memory. The fix: Widen buffer_used and buffer_max_used to u64, the same shape as the gred/bfifo/plug fix. buffer_limit stays u32; the comparison promotes it to u64, so the bounded queue stops at the configured limit below 2^32 and the counter can no longer wrap. buffer_used is subtracted on dequeue and drop, so the widened type flows through unchanged. The ACK-filter replacement applied the net delta as one expression, q->buffer_used += skb->truesize - ack->truesize. Both operands are unsigned int, so the subtraction is evaluated at u32 and a larger removed ACK wraps the delta; the old u32 accumulator folded that back to the correct net value, but the widened u64 accumulator would persist it as a roughly 4 GiB over-count. Apply the replacement as two exact operations on the widened counter instead; the queue already accounts ack->truesize, so the subtraction cannot underflow. Widening the counters alone is incomplete because cake_dump_stats() still exports buffer_max_used through PUT_STAT_U32(MEMORY_USED, ...), and tc.yaml declares memory-used as u32. buffer_max_used only ever rises, so once the widened counter passes 2^32 the export reports peak - 2^32 for the rest of the qdisc's life. Clamp the exported value to U32_MAX; the counter itself is unaffected. Conditions to recreate the bug: CAP_NET_ADMIN (root or a user namespace, the qdisc attach is gated by netlink_net_capable(CAP_NET_ADMIN)). # hold a tun device's tx ring so the root qdisc parks packets ip tuntap add tun0 mode tun ip link set tun0 txqueuelen 32 up ip addr add 10.99.0.1/24 dev tun0 tc qdisc add dev tun0 root handle 1: cake memlimit 4294967295 # drive >4 GiB of resident truesize through the qdisc (e.g. several UDP # sockets with SO_SNDBUFFORCE). On the unfixed kernel buffer_used wraps, # the drop loop is bypassed and the guest OOMs; with the fix the counter # passes the limit without wrapping and drops the excess. # the ACK-filter over-count is reached with ack-filter enabled and a # queued pure ACK whose truesize is larger than the replacement ACK: tc qdisc add dev tun0 root handle 1: cake ack-filter Reported-by: Sashiko (gemini) Closes: https://sashiko.dev/#/patchset/20260818095927.15901-1-jhs@mojatatu.com Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260818095927.15901-1-jhs@mojatatu.com Link: https://lore.kernel.org/netdev/20260818095927.15901-1-jhs@mojatatu.com/ Reviewed-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim --- net/sched/sch_cake.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index dc93267029e7..79a07fa80b35 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -234,8 +234,9 @@ struct cake_sched_data { u16 tin_cnt; /* resource tracking */ - u32 buffer_used; - u32 buffer_max_used; + + u64 buffer_max_used; + u64 buffer_used; u32 buffer_limit; /* indices for dequeue */ @@ -1850,7 +1851,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, qdisc_qstats_drop(sch); ack_pkt_len = qdisc_pkt_len(ack); WRITE_ONCE(b->bytes, b->bytes + ack_pkt_len); - q->buffer_used += skb->truesize - ack->truesize; + q->buffer_used += skb->truesize; + q->buffer_used -= ack->truesize; if (q->config->rate_flags & CAKE_FLAG_INGRESS) cake_advance_shaper(q, b, ack, now, true); @@ -3012,7 +3014,8 @@ static int cake_dump_stats(struct Qdisc *sch, struct gnet_dump *d) PUT_STAT_U64(CAPACITY_ESTIMATE64, READ_ONCE(q->avg_peak_bandwidth)); PUT_STAT_U32(MEMORY_LIMIT, READ_ONCE(q->buffer_limit)); - PUT_STAT_U32(MEMORY_USED, READ_ONCE(q->buffer_max_used)); + PUT_STAT_U32(MEMORY_USED, + min_t(u64, READ_ONCE(q->buffer_max_used), U32_MAX)); PUT_STAT_U32(AVG_NETOFF, ((READ_ONCE(q->avg_netoff) + 0x8000) >> 16)); PUT_STAT_U32(MAX_NETLEN, READ_ONCE(q->max_netlen)); PUT_STAT_U32(MAX_ADJLEN, READ_ONCE(q->max_adjlen));