From: Stephen Hemminger <stephen@networkplumber.org>
To: netdev@vger.kernel.org
Cc: Jamal Hadi Salim <hadi@mojatatu.com>, Eric Dumazet <edumazet@google.com>
Subject: Is current INET_ECN_set_ce() safe with cloned skb?
Date: Sat, 9 May 2026 10:01:29 -0700 [thread overview]
Message-ID: <20260509100129.479aec7e@phoenix.local> (raw)
While doing changes to netem, Sashiko flagged that INET_ECN_set_ce is not
safe on a cloned skb. This wasn't something that was in any of the patches
it was a "drive by" in the review.
But it got me thinking it may have found a pre-existing bug.
The function INET_ECN_set_ce() modifies the skb to set ECN;
but skb is likely a clone from TCP. So modifying the IP header
to set ECN will modify the version that TCP is holding as well.
The same pattern applies to cake, choke, dualpi2, fq, fq_pie, gred,
pie, red, sfb, sfq. I.e all the qdisc that do ECN.
Is this a real bug? Is TCP just working around it?
BPF is already has fix for this but qdisc usage does not.
next reply other threads:[~2026-05-09 17:01 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-09 17:01 Stephen Hemminger [this message]
2026-05-09 17:35 ` Is current INET_ECN_set_ce() safe with cloned skb? Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260509100129.479aec7e@phoenix.local \
--to=stephen@networkplumber.org \
--cc=edumazet@google.com \
--cc=hadi@mojatatu.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox