diff options
| author | Jamal Hadi Salim <jhs@mojatatu.com> | 2026-09-01 17:39:29 -0400 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-09-05 13:48:08 -0700 |
| commit | 1c38487f46b243bfeefec0c0c86023a3904f2214 (patch) | |
| tree | 9ddf44dd715f70ef12510efc2e48145450738bf8 /scripts/basic/split-include.c | |
| parent | 8382abec0f1568d0a5590d75a3df92f23fcf5196 (diff) | |
| download | linux-1c38487f46b243bfeefec0c0c86023a3904f2214.tar.gz linux-1c38487f46b243bfeefec0c0c86023a3904f2214.zip | |
net/sched: ets: clamp quantum in parse and fallback paths
ets_qdisc_change() falls back to psched_mtu() with no floor for bands
without an explicit quantum. With a crafted size table qdisc_pkt_len
reaches ~2 GiB, so a zero psched_mtu on a headerless device makes the
deficit-refill loop spin under the qdisc lock.
Move the floor into ets_quantum_parse() so explicitly configured quanta
are also clamped to [256, 1<<20], not just the fallback path.
Conditions to recreate the bug:
CONFIG_NET_SCH_ETS=y. Requires CAP_NET_ADMIN (namespace-local via
unshare -Urn suffices).
tc qdisc add dev dummy0 root ets bands 3 strict 2 quanta 1 1
Fixes: dcc68b4d8084 ("net: sch_ets: Add a new Qdisc")
Reported-by: Vega <vega@nebusec.ai>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/QDISC-0CFC.v3.20260901204856@mojatatu.com.9
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions