Re: [PATCH v2] net/sched: sch_cake: prevent shaper corruption and stall in cake_overhead()

[Simon Horman]

On Tue, Sep 22, 2026 at 04:41:24PM +0800, Yuchao Zhang wrote:
> In cake_overhead(), the header length up to the transport layer is
> computed using logic borrowed from qdisc_pkt_len_segs_init():
> 
>         /* borrowed from qdisc_pkt_len_segs_init() */
>         if (!skb->encapsulation)
>                 hdr_len = skb_transport_offset(skb);
>         else
>                 hdr_len = skb_inner_transport_offset(skb);
> 
> However, cake_overhead() suffers from several issues:
> 
> 1. When segs == 0 (e.g. from dodgy GSO packets where gso_segs is not
>    recomputed), the multi-segment arithmetic underflows: (segs - 1) wraps
>    to 4294967295, causing cake_calc_overhead() * (segs - 1) to produce
>    an enormous length. When charged in cake_advance_shaper(),
>    time_next_packet is pushed decades into the future, permanently
>    stalling the CAKE dequeue queue.
>    Fix this by returning cake_calc_overhead(q, len, off) for segs <= 1.
> 
> 2. When the transport header was never set, skb->transport_header holds
>    the sentinel value ~0U. skb_transport_offset() returns ~65535, which
>    is not caught by a negative offset check. skb_header_pointer() fails,
>    and hdr_len stays ~65535, charging ~66 KB per segment to the shaper.
>    Fix this by mirroring qdisc_pkt_len_segs_init() and checking
>    unlikely(!skb_transport_header_was_set(skb)).
> 
> 3. Both skb_transport_offset() and skb_inner_transport_offset() return
>    signed int, but hdr_len is declared as unsigned int. If post-enqueue
>    mangling (such as BPF packet trimming via bpf_skb_net_shrink())
>    produces a negative offset, hdr_len wraps to near UINT_MAX, causing
>    corrupted header length accounting.
>    Fix this by declaring hdr_len as int and falling back to
>    cake_calc_overhead(q, len, off) if hdr_len is negative.
> 
> Fixes: a41851bea7bf ("net: account for encap headers in qdisc pkt len")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yuchao Zhang <ndaugoing@xxxxxxxxx>
> ---
> v2:
>  - Accurately describe the impact as shaper accounting corruption / stall
>    rather than OOB read past the allocation per Sashiko review.
>  - Fix pre-existing high-severity integer underflow when segs == 0 by
>    checking segs <= 1.
>  - Import companion check !skb_transport_header_was_set(skb) from
>    qdisc_pkt_len_segs_init() to prevent unset transport header sentinel
>    (~0U) from inflating packet length to ~66 KB.


Please do include lore.kernel.org links to earlier versions in
the changelog. This helps tremendously with review.

Please do not post updated patch revisions as responses to earlier versions.
Rather, please start a new thread for each version.

Thanks!