Re: [PATCH net] net/sched: Avoid quadratic handle scan in qdisc_alloc_handle

[Jakub Kicinski <kuba@kernel.org>]

On Wed, 16 Sep 2026 06:34:57 -0400 Jamal Hadi Salim wrote:
> > IMO any attack from containers / user ns is hardening. If it leads
> > to a crash we take it via net _because it's a crash_ not because
> > user ns can trigger it.
> >  
> 
> Ok - will review the pending ones with this in mind.
> 
> FWIW, here are the rules we have been using:
> 
> It is net if: Regression (worked before, broke) or always-triggerable
> crash/UAF/leak/lockup
> This specific bug could potentially cause a soft lockup but it wasnt
> consistently...
> 
> It goes to net-next if:
> a) Never worked (adds a cap, validation, accounting, or enforcement
> that never existed, e.g. memcg-class)
> b) Doc/comment
> c) tests - although the exception we currently make is if we create a
> tdc test for a net patch then it goes to net just dont cc stable on
> it.
> 
> > > Since we have a few similar "grey" issues in our pending queue - so
> > > where's the line for net/net-next?  
>  [...]  
> 
> Given the flood, here are the priority rules we are using:
> 1) submit net before net-next
> 2) All bugs must be reproducible by our (semi-automated) system
> (hybris). I dont even look at issues unless they are reproducible
> (hence my nagging "do you have a PoC?" ;->)
> 3) Assign a priority to each bug and submit the highest priority ones
> first. The priorities are assigned as follows:
> - base (reproduced, ACCURATE) +1
> - Crash (oops/panic/NULL-deref/OOM/corruption) +2
> - UAF +2
> - Lockup (soft lockup/livelock/infinite loop) +1
> - leak +1
> - simple-trigger (plain tc/tdc, no special PoC) +1
> - privilege required: (root) +1 / (unshare -Urn) +2

nice system :)
no distinction between control path-trigger an packet trigger?

> The priority is capped at 9. So a priority 9 with net gets immediate attention.
> A priority 9 that requires root permission is not as important as
> priority 9 that requires cap_net_admin (-urn)
> Yuan has a taxonomy as well; he calls these L1 and L2 when we pull the
> reports from his system.
> There is an exception: Priority 10. These are assigned to bugs which
> require no root/cap_net_admin and other UPEs
> 
> We also capture all "pre-existing bugs" and address them when the
> pending queue is empty. Most of these end up being a waste after fixes
> go in.