Re: [PATCH net v3 4/7] net/sched: netem: restructure dequeue to avoid re-entrancy with child qdisc

Simon Horman
2026-04-04T09:49:51Z

On Thu, Apr 02, 2026 at 01:19:32PM -0700, Stephen Hemminger wrote:
> netem_dequeue() enqueues packets into its child qdisc while being
> called from the parent's dequeue path. This causes two problems:
>
> - HFSC tracks class active/inactive state on qlen transitions.
> A child enqueue during dequeue causes double-insertion into
> the eltree (CVE-2025-37890, CVE-2025-38001).
>
> - Non-work-conserving children like TBF may refuse to dequeue
> packets just enqueued, causing netem to return NULL despite
> having backlog. Parents like DRR then incorrectly deactivate
> the class.
>
> Split the dequeue into helpers:
>
> netem_pull_tfifo() - remove head packet from tfifo
> netem_slot_account() - update slot pacing counters
> netem_dequeue_child() - batch-transfer ready packets to the
> child, then dequeue from the child
> netem_dequeue_direct()- dequeue from tfifo when no child
>
> When a child qdisc is present, all time-ready packets are moved
> into the child before calling its dequeue. This separates the
> enqueue and dequeue phases so the parent sees consistent qlen
> transitions.
>
> Fixes: 50612537e9ab ("netem: fix classful handling")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> ---
> net/sched/sch_netem.c | 201 +++++++++++++++++++++++++++---------------
> 1 file changed, 128 insertions(+), 73 deletions(-)

Hi Stephen,

As a fix this is a large and complex patch.
Could it be split up somehow to aid review?

...