Samuel Moelius [off-list ref] writes:

CAKE accepts overhead values that can make adjusted packet length
arithmetic underflow.  A negative effective length can wrap through
unsigned arithmetic and become a large value.

Such configurations make rate accounting depend on integer wraparound
rather than on the packet size userspace intended to model.

Validate overhead settings before using them in adjusted length
calculations.

Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <redacted>

Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>