From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB60134F497; Sat, 12 Sep 2026 19:16:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789240574; cv=none; b=Aqw8cFZm5Li1IJ/by2qw4AQqBbcbehHphIL+lkLhxjRa1yTFBknsSOrhlXnaz4erHLhJtVz5gLVobDNLZcWGBarbqMM5GWonTxP7NZ3biY0prU9Pr6cadd0YUYWxVTN9RRjSivT7zBMfp++d2qnt1SzSAxkjBEpB+fHnxd/X5f4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789240574; c=relaxed/simple; bh=BKGue/l+53AyETsTxU2tJdZh18TqzHUSNyZS2ez2xRQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=D+LFriDWkqGU6vbkG7h9bFwpzw60CUZkv/Gm693cTaJye0hPm4LP/C/nSnCVbBbwsNYXT0Nz4kbg5AF4JHLAfmW/XjfqnM56I9qLL2dsGFYiiLUxXowaitSooVei3WTgcOUmsJHkEhDHimq8/KSB7OccfTsTuz1dpawW2cjwg2g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WGdBqQJE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="WGdBqQJE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3797E1F000FF; Sat, 12 Sep 2026 19:16:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789240572; bh=1QB+XB408uyaDoX0JYWfCxe7laSh36jOijwuAsAiwww=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=WGdBqQJECq9+zmlpW9c3yspCxlYm8onyd2tuei0PnJOFlLWewrvpyOHPGPkgrPCju TmdEunbNCQIN/vv+Ctn8E2yetB/tRkssFXaFdbxh7x8GZmwgtaM6qFJjIhm+uGZGq8 sXckVwP5tfbQFsXhpN7FAIzzRLXiv6p2nLO6x+Gw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, vega@nebusec.ai, Victor Nogueira , Jamal Hadi Salim , Paolo Abeni , Sasha Levin Subject: [PATCH 5.15 895/935] net/sched: sch_codel: clamp default mtu to avoid disabling CoDel Date: Sat, 12 Sep 2026 09:05:25 +0200 Message-ID: <20260912065547.341039428@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065526.833703348@linuxfoundation.org> References: <20260912065526.833703348@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jamal Hadi Salim [ Upstream commit 6439461f1618ae176c048673ad28bdb6c68efbfc ] codel_init() sets q->params.mtu = psched_mtu(qdisc_dev(sch)) without clamping. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000. In codel_should_drop() the test "*backlog <= params->mtu" then compares the backlog against ~2 GiB; with the default sch->limit of DEFAULT_CODEL_LIMIT (1000) packets the backlog can never reach it, so the test is always true and CoDel is silently and completely disabled i.e no drops, no ECN marking, codel degrades to a tail-drop FIFO. codel_change() never updates params.mtu, so the init path is the only place to clamp it. Constrain to [256, 1 << 20], matching the fq_codel bound; 256 is a sane floor that only makes CoDel slightly more willing to act on very small queues, which is the safe direction. Conditions to recreate the bug: a device whose MTU (plus hard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace. Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM") Reported-by: vega@nebusec.ai Tested-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260822195509.112717-4-jhs@mojatatu.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- net/sched/sch_codel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c index 1cd09d3fe5efe..9e4e9b1a7ed88 100644 --- a/net/sched/sch_codel.c +++ b/net/sched/sch_codel.c @@ -231,7 +231,7 @@ static int codel_init(struct Qdisc *sch, struct nlattr *opt, codel_params_init(&q->params); codel_vars_init(&q->vars); codel_stats_init(&q->stats); - q->params.mtu = psched_mtu(qdisc_dev(sch)); + q->params.mtu = clamp_t(u32, psched_mtu(qdisc_dev(sch)), 256, 1 << 20); if (opt) { int err = codel_change(sch, opt, extack); -- 2.53.0