Re: [PATCH net v2 1/1] net: sched: ets: avoid deficit wrap and bound empty dequeue rounds
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-06-27 22:14:59
On Fri, 26 Jun 2026 16:32:00 +0800 Ren Wei wrote:
From: Wyatt Feng <redacted> ETS keeps each DRR-style deficit in a u32 and replenishes it with the configured quantum whenever the head packet is too large. Both the quantum and qdisc_pkt_len() are user-controlled inputs: a large quantum can wrap the deficit counter, while a tiny quantum combined with an inflated qdisc_pkt_len() can force billions of iterations in softirq context before any packet becomes eligible.
Do you mean when packet is gigabytes in size? Where do such packets originate?
quoted hunk ↗ jump to hunk
Store the deficit in u64 so replenishment cannot wrap the counter. This keeps the existing dequeue logic unchanged while fixing the overflow condition. Bound one dequeue attempt to at most nbands * 2 ETS rotations, as suggested in review. This avoids the livelock without adding heavier logic to the fast path. Fixes: dcc68b4d8084 ("net: sch_ets: Add a new Qdisc") Cc: stable@vger.kernel.org Reported-by: Yuan Tan <redacted> Reported-by: Yifan Wu <redacted> Reported-by: Juefei Pu <redacted> Reported-by: Zhengchuan Liang <redacted> Reported-by: Xin Liu <redacted> Suggested-by: Jamal Hadi Salim <jhs@mojatatu.com> Assisted-by: Codex:GPT-5.4 Signed-off-by: Wyatt Feng <redacted> Signed-off-by: Ren Wei <redacted> --- changes in v2: - Instead of doing a div() in the fast path, simply bound the loop per dequeue - v1 Link: https://lore.kernel.org/all/20260615103759.2404228-2-n05ec@lzu.edu.cn/ (local) net/sched/sch_ets.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c index cb8cf437ce87..12a156ccb0a6 100644 --- a/net/sched/sch_ets.c +++ b/net/sched/sch_ets.c@@ -40,7 +40,7 @@ struct ets_class { struct list_head alist; /* In struct ets_sched.active. */ struct Qdisc *qdisc; u32 quantum; - u32 deficit; + u64 deficit; struct gnet_stats_basic_sync bstats; struct gnet_stats_queue qstats; };@@ -463,6 +463,8 @@ ets_qdisc_dequeue_skb(struct Qdisc *sch, struct sk_buff *skb) static struct sk_buff *ets_qdisc_dequeue(struct Qdisc *sch) { struct ets_sched *q = qdisc_priv(sch); + unsigned int max_loops = READ_ONCE(q->nbands) * 2; + unsigned int loops = 0; struct ets_class *cl; struct sk_buff *skb; unsigned int band;@@ -499,6 +501,8 @@ static struct sk_buff *ets_qdisc_dequeue(struct Qdisc *sch) cl->deficit += READ_ONCE(cl->quantum); list_move_tail(&cl->alist, &q->active); + if (++loops > max_loops) + goto out; } out: return NULL;