* Is current INET_ECN_set_ce() safe with cloned skb?
@ 2026-05-09 17:01 Stephen Hemminger
2026-05-09 17:35 ` Eric Dumazet
0 siblings, 1 reply; 2+ messages in thread
From: Stephen Hemminger @ 2026-05-09 17:01 UTC (permalink / raw)
To: netdev; +Cc: Jamal Hadi Salim, Eric Dumazet
While doing changes to netem, Sashiko flagged that INET_ECN_set_ce is not
safe on a cloned skb. This wasn't something that was in any of the patches
it was a "drive by" in the review.
But it got me thinking it may have found a pre-existing bug.
The function INET_ECN_set_ce() modifies the skb to set ECN;
but skb is likely a clone from TCP. So modifying the IP header
to set ECN will modify the version that TCP is holding as well.
The same pattern applies to cake, choke, dualpi2, fq, fq_pie, gred,
pie, red, sfb, sfq. I.e all the qdisc that do ECN.
Is this a real bug? Is TCP just working around it?
BPF is already has fix for this but qdisc usage does not.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Is current INET_ECN_set_ce() safe with cloned skb?
2026-05-09 17:01 Is current INET_ECN_set_ce() safe with cloned skb? Stephen Hemminger
@ 2026-05-09 17:35 ` Eric Dumazet
0 siblings, 0 replies; 2+ messages in thread
From: Eric Dumazet @ 2026-05-09 17:35 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: netdev, Jamal Hadi Salim
On Sat, May 9, 2026 at 10:01 AM Stephen Hemminger
<stephen@networkplumber.org> wrote:
>
> While doing changes to netem, Sashiko flagged that INET_ECN_set_ce is not
> safe on a cloned skb. This wasn't something that was in any of the patches
> it was a "drive by" in the review.
>
> But it got me thinking it may have found a pre-existing bug.
> The function INET_ECN_set_ce() modifies the skb to set ECN;
> but skb is likely a clone from TCP. So modifying the IP header
> to set ECN will modify the version that TCP is holding as well.
>
> The same pattern applies to cake, choke, dualpi2, fq, fq_pie, gred,
> pie, red, sfb, sfq. I.e all the qdisc that do ECN.
>
> Is this a real bug? Is TCP just working around it?
>
> BPF is already has fix for this but qdisc usage does not.
TCP does not care, all headers can be changed freely by lower layers.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-05-09 17:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-09 17:01 Is current INET_ECN_set_ce() safe with cloned skb? Stephen Hemminger
2026-05-09 17:35 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox