# \[PATCH net 0/3 repost1\] net/sched: fix short-skb metadata and namespace boundaries - From: Jamal Hadi Salim \ - Date: 2026-10-31 19:36:06 - List: netdev - Page: https://ratatoskr.run/netdev/2026/10/17838372 - Thread: https://ratatoskr.run/netdev/2026/10/17838372/t.md ```text This series fixes three independent boundary problems in net/sched. 1/3 act_ife: encode a configured zero metadata value. ife_check_meta_u32() reserves an 8-byte TLV for a configured zero value, but the encoder returned without writing it, leaking stale skb headroom bytes. 2/3 act_ife: require a full Ethernet header on egress. An undersized linear head can make the encoder read past the end of the skb data. 3/3 sch_teql: reject qdiscs from another network namespace. The global TEQL master lives in the initial netns; a qdisc created in another netns could still mutate the master's MTU and flags. Origins: 1/3: reported by shaos [ref] with a reproducer, which was reproduced and verified in our test environment. 2/3: found by Sashiko (nipa and gemini) while reviewing Victor Nogueira's parent act_ife patchset; independently reported by shaos [ref] with a reproducer, which was verified in our test environment. 3/3: reported by shaos [ref] with a reproducer, which was reproduced and verified in our test environment. The three patches are independent. They target net and carry a stable nomination. They are sent together because they share the short-skb and namespace-boundary review context. Jamal Hadi Salim (3): net/sched: act_ife: encode a configured zero metadata value net/sched: act_ife: require a full Ethernet header on egress net/sched: sch_teql: reject qdiscs from another network namespace net/sched/act_ife.c | 8 +++++--- net/sched/sch_teql.c | 5 +++++ 2 files changed, 10 insertions(+), 3 deletions(-) Signed-off-by: Jamal Hadi Salim --- ```