Re: [PATCH net v3 4/7] net/sched: netem: restructure dequeue to avoid re-entrancy with child qdisc

Jakub Kicinski
2026-04-06T15:41:35Z

On Sat, 4 Apr 2026 10:49:46 +0100 Simon Horman wrote:
> On Thu, Apr 02, 2026 at 01:19:32PM -0700, Stephen Hemminger wrote:
> > netem_dequeue() enqueues packets into its child qdisc while being
> > called from the parent's dequeue path. This causes two problems:
> >
> > - HFSC tracks class active/inactive state on qlen transitions.
> > A child enqueue during dequeue causes double-insertion into
> > the eltree (CVE-2025-37890, CVE-2025-38001).
> >
> > - Non-work-conserving children like TBF may refuse to dequeue
> > packets just enqueued, causing netem to return NULL despite
> > having backlog. Parents like DRR then incorrectly deactivate
> > the class.
> >
> > Split the dequeue into helpers:
> >
> > netem_pull_tfifo() - remove head packet from tfifo
> > netem_slot_account() - update slot pacing counters
> > netem_dequeue_child() - batch-transfer ready packets to the
> > child, then dequeue from the child
> > netem_dequeue_direct()- dequeue from tfifo when no child
> >
> > When a child qdisc is present, all time-ready packets are moved
> > into the child before calling its dequeue. This separates the
> > enqueue and dequeue phases so the parent sees consistent qlen
> > transitions.
> >
> > Fixes: 50612537e9ab ("netem: fix classful handling")
> > Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> > ---
> > net/sched/sch_netem.c | 201 +++++++++++++++++++++++++++---------------
> > 1 file changed, 128 insertions(+), 73 deletions(-)
>
> Hi Stephen,
>
> As a fix this is a large and complex patch.
> Could it be split up somehow to aid review?

+1, FWIW it's perfectly fine to have refactoring patch in a net series
(without a Fixes tag) if it makes the fix a lot easier to review.