[PATCH net v3 0/3] net/sched: taprio: fix RCU stall from replayed schedule entries

From: Krystian Kaniewski

Date: Wed Nov 04 2026 - 09:27:03 EST


syzbot reported an RCU stall with a software taprio schedule made of a
single 127 ns entry. When advance_sched() falls behind, it replays every
missed entry inside the timer interrupt and the backlog only grows.
Patch 3 makes it continue from the entry in progress instead.

Patch 2 fixes a pre-existing wrap of the cycle-time-extension sum in the
software and txtime-assist paths. Patch 3 relies on it. Patch 1 prevents
a saturated extension from handing over to an admin schedule whose
software timestamps cannot be represented.

AI coding assistants helped with analysis, patch drafting and review.
The submitter reviewed the complete series and is responsible for it.

v3:
- patch 2: split the cycle-time-extension overflow handling from patch 3
as suggested by Vinicius, and use the same saturating helper in
get_interval_end_time()
- patch 3: return the cycle end from taprio_entry_at() and update
cycle_end_time in advance_sched() (Vinicius)
- patch 1: reword the range-check comment to describe only software
timer timestamps (Vinicius)
- all patches: add Acked-by from Vinicius, drop the obsolete
Assisted-by trailers, and rebase onto current net/main
v2: https://lore.kernel.org/all/20261009123309.284193-1-krystianmkaniewski@xxxxxxxxx/
v1: https://lore.kernel.org/all/20261006113335.241564-1-krystianmkaniewski@xxxxxxxxx/

Krystian Kaniewski (3):
net/sched: taprio: reject software schedules that overflow their
timestamps
net/sched: taprio: prevent cycle time extension overflow
net/sched: taprio: do not replay missed entries in advance_sched()

net/sched/sch_taprio.c | 191 ++++++++++++++++++++++++++++++++++++-----
1 file changed, 168 insertions(+), 23 deletions(-)


base-commit: 241dec6f9ab74d8c3ef246764f3611666b96b9e1
--
2.53.0