Re: [PATCH net] net/sched: Avoid quadratic handle scan in qdisc_alloc_handle

On Wed, Sep 16, 2026 at 8:04 PM Jakub Kicinski [off-list ref] wrote:

On Wed, 16 Sep 2026 06:34:57 -0400 Jamal Hadi Salim wrote:

quoted

quoted

IMO any attack from containers / user ns is hardening. If it leads
to a crash we take it via net _because it's a crash_ not because
user ns can trigger it.

Ok - will review the pending ones with this in mind.

FWIW, here are the rules we have been using:

It is net if: Regression (worked before, broke) or always-triggerable
crash/UAF/leak/lockup
This specific bug could potentially cause a soft lockup but it wasnt
consistently...

It goes to net-next if:
a) Never worked (adds a cap, validation, accounting, or enforcement
that never existed, e.g. memcg-class)
b) Doc/comment
c) tests - although the exception we currently make is if we create a
tdc test for a net patch then it goes to net just dont cc stable on
it.

quoted

quoted

Since we have a few similar "grey" issues in our pending queue - so
where's the line for net/net-next?

 [...]

Given the flood, here are the priority rules we are using:
1) submit net before net-next
2) All bugs must be reproducible by our (semi-automated) system
(hybris). I dont even look at issues unless they are reproducible
(hence my nagging "do you have a PoC?" ;->)
3) Assign a priority to each bug and submit the highest priority ones
first. The priorities are assigned as follows:
- base (reproduced, ACCURATE) +1
- Crash (oops/panic/NULL-deref/OOM/corruption) +2
- UAF +2
- Lockup (soft lockup/livelock/infinite loop) +1
- leak +1
- simple-trigger (plain tc/tdc, no special PoC) +1
- privilege required: (root) +1 / (unshare -Urn) +2

nice system :)
no distinction between control path-trigger an packet trigger?

At the moment we dont make a distinction - the existing point system
would still work, I think. Do you see it differently?

cheers,
jamal