RE: [PATCH] net/sched: cake: reject overhead values that underflow length

[Jagielski, Jedrzej]

From: Samuel Moelius <sam.moelius@xxxxxxxxxxxxxxx> 
Sent: Thursday, July 2, 2026 1:57 AM

>CAKE accepts signed overhead values and stores them in an s16, but the
>adjusted packet length calculation uses unsigned arithmetic.  A negative
>effective length can therefore wrap to a large value.
>
>Such configurations make rate accounting depend on integer wraparound
>rather than on the packet size userspace intended to model.  A static
>netlink lower bound is not enough because packets reaching CAKE can be
>smaller than any reasonable manual-overhead allowance.
>
>Fold the signed overhead adjustment into the existing datapath MPU clamp
>so negative adjusted lengths are clamped before link-layer framing
>adjustments.
>
>Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper")
>Assisted-by: Codex:gpt-5.5-cyber-preview
>Signed-off-by: Samuel Moelius <sam.moelius@xxxxxxxxxxxxxxx>
>---
>Changes in v3:
>  - Adjust how check is performed
>Changes in v2:
>  - Add fixes tag

Hi,

just for the future - please mention the revision number in the
mail subject