Re: [PATCH net] net: harden qdisc_pkt_len_segs_init() against malicious GSO packets

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Michael S. Tsirkin wrote:
> On Thu, Oct 22, 2026 at 05:54:36PM +0200, Eric Dumazet wrote:
> > An SKB_GSO_DODGY packet can carry untrusted gso_size and headers.
> > 
> > For instance, gso_size=1 and hdr_len=65532 for a 524275-byte frame
> > makes qdisc_pkt_len_segs_init() compute an accounted length of
> > about 4,294,574,091 bytes (after gso_segs silently wrapped in a u16).
> > 
> > With DRR quantum 256, the dequeue path then needs ~16.8 million
> > deficit refills before it can dequeue the skb, keeping the CPU in
> > the qdisc path long enough to trigger the soft-lockup watchdog.
> > 
> > Commit 8f735d64382d ("net/sched: bound qdisc_pkt_len to prevent
> > qdisc soft lockup") added QDISC_PKT_LEN_MAX to bound size table
> > amplification. Use the same bound for DODGY packets:
> > 
> > - Make gso_segs a u32 and drop packets whose segment count does
> >   not fit GSO_MAX_SEGS, instead of silently truncating it.
> > 
> > - Drop packets whose estimated qdisc_pkt_len() would exceed
> >   QDISC_PKT_LEN_MAX.
> > 
> > Fixes: 15e5a0307164 ("net_sched: better precise estimation on packet length for untrusted packets")
> > Reported-by: shaos <shawnq1@163.com>
> > Closes: https://lore.kernel.org/netdev/20261022144755.65025-1-shawnq1@163.com/
> > Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> > Cc: Jamal Hadi Salim <jhs@mojatatu.com>
> > Cc: "Michael S. Tsirkin" <mst@redhat.com>
> 
> I'm all for stack being more resilient.
> 
> Acked-by: Michael S. Tsirkin <mst@redhat.com>
 
Reviewed-by: Willem de Bruijn <willemb@google.com>