Re: [BUG] net/sched: malformed UFO GSO geometry can soft-lock DRR dequeue

[Eric Dumazet]

Le jeu. 22 oct. 2026 à 16:48, shaos <shawnq1@xxxxxxx> a écrit :
>
> Hello,
>
> A PACKET_VNET_HDR AF_PACKET send supplies UFO GSO with gso_size=1 and hdr_len=65532 for a 524275-byte frame. qdisc_pkt_len_segs_init() computes an accounted length of 4,294,574,091 bytes. With DRR quantum 256, the dequeue path needs about 16.8 million deficit refills before it can dequeue the skb, keeping the CPU in the qdisc path long enough to trigger the soft-lockup watchdog.
>
> HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
> git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
> source version: Linux 7.3.0, local master
> compiler:       gcc 11.4.0, GNU ld 2.38
>
> console output:
> https://gist.githubusercontent.com/shaos26/8a4f7f445aa23601bfe8e04f9c6a5202/raw/f4ca89881f7b8163ddea72fbc54b204385142bb8/console-output.txt
> user-namespace positive output:
> https://gist.githubusercontent.com/shaos26/8a4f7f445aa23601bfe8e04f9c6a5202/raw/14de8e3a06e7e73c540ebf408e73d301bae3922d/userns-positive.log
> kernel config:
> https://gist.githubusercontent.com/shaos26/8a4f7f445aa23601bfe8e04f9c6a5202/raw/6ea0e3da68f1e239d565c64f7906d0f9c73bf784/kernel-config.txt
> reproducer sources:
> https://gist.githubusercontent.com/shaos26/e2add470a38b7aab41f2b79ef021accf/raw/7153646b9233fa53aca81c9af879d48e8f95dd80/poc.c
> https://gist.githubusercontent.com/shaos26/e2add470a38b7aab41f2b79ef021accf/raw/e8acddd986023c10a43b5106b4734a456a063deb/drop_priv.c
>
> Build the tested kernel with the attached configuration and boot a disposable QEMU guest. Compile the linked userspace reproducer and privilege-drop helper, then run the AF_PACKET/VNET_HDR test from a fresh user/network namespace.
>
> Impact and prerequisites:
> A process with only namespace-scoped CAP_NET_ADMIN and CAP_NET_RAW can keep a CPU in the DRR dequeue path long enough to trigger a host soft-lockup. With softlockup_panic=1, as used in the test configuration, the watchdog panics the kernel. This is a local denial-of-service issue; no memory corruption or privilege escalation is demonstrated.
>
> Validation: Two fresh positives reproduced the soft lockup, including one run from an unprivileged UID mapped to namespace UID 0. The same-frame non-GSO control completed in milliseconds.
>
> Thanks,
>

Related recent work:

commit 8f735d64382dcf162f4276d6699d03ad2f859c0b
Author: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
Date:   Tue Aug 25 04:14:03 2026 -0400

    net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup