[PATCH net v2] net/sched: cake: reject overhead values that underflow length
From: Samuel Moelius
Date: Tue Jun 09 2026 - 19:30:20 EST
CAKE accepts overhead values that can make adjusted packet length
arithmetic underflow. A negative effective length can wrap through
unsigned arithmetic and become a large value.
Such configurations make rate accounting depend on integer wraparound
rather than on the packet size userspace intended to model.
Validate overhead settings before using them in adjusted length
calculations.
Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@xxxxxxxxxxxxxxx>
---
Changes in v2:
- Add fixes tag
net/sched/sch_cake.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 5862933be8d7..03972e5525b5 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -2308,12 +2308,18 @@ static void cake_reset(struct Qdisc *sch)
cake_clear_tin(sch, c);
}
+static const struct netlink_range_validation_signed cake_overhead_range = {
+ .min = -64,
+ .max = 256,
+};
+
static const struct nla_policy cake_policy[TCA_CAKE_MAX + 1] = {
[TCA_CAKE_BASE_RATE64] = { .type = NLA_U64 },
[TCA_CAKE_DIFFSERV_MODE] = { .type = NLA_U32 },
[TCA_CAKE_ATM] = { .type = NLA_U32 },
[TCA_CAKE_FLOW_MODE] = { .type = NLA_U32 },
- [TCA_CAKE_OVERHEAD] = { .type = NLA_S32 },
+ [TCA_CAKE_OVERHEAD] =
+ NLA_POLICY_FULL_RANGE_SIGNED(NLA_S32, &cake_overhead_range),
[TCA_CAKE_RTT] = { .type = NLA_U32 },
[TCA_CAKE_TARGET] = { .type = NLA_U32 },
[TCA_CAKE_AUTORATE] = { .type = NLA_U32 },
--
2.43.0