Re: [PATCH net v2] net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue

[Simon Horman <horms@kernel.org>]

On Tue, Aug 18, 2026 at 05:59:27AM -0400, Jamal Hadi Salim wrote:
> gred_enqueue(), bfifo_enqueue() and plug_enqueue() admit a packet when the
> current backlog plus the packet length fits within the queue limit:
> 
>   sch->qstats.backlog + qdisc_pkt_len(skb) <= sch->limit (gred default VQ)
>   gred_backlog+qdisc_pkt_len(skb) <= q->limit  (gred configured VQ)
>   sch->qstats.backlog + qdisc_pkt_len(skb) <= sch->limit (bfifo)
>   sch->qstats.backlog + skb->len <= q->limit             (plug)
> 
> sch->qstats.backlog and q->backlog are u32, and qdisc_pkt_len()/skb->len
> are unsigned int, so all sums are computed in 32 bits and wrap at 2^32.
> Once the true backlog exceeds 4 GiB the wrapped sum becomes small and
> admission keeps succeeding, so the queue grows without bound and the kernel
> can be driven to OOM.
> 
> Promote the sums to u64 so admission stops once the true backlog exceeds
> the limit.  The limit is u32, so the bounded queue stays below 2^32 and
> the stored u32 backlog never wraps.
> 
> The bug can only be reproduced as root (albeit with ridiculous setup):
>  attach a gred (or bfifo/plug) qdisc with a limit near 4 GiB,
>  leaving the default VQ unconfigured (for gred), and drive >4 GiB of
>  queued traffic (e.g. via a size table / stab to inflate qdisc_pkt_len,
>  or sustained high-rate traffic). The u32 backlog+len sum wraps at 2^32,
>  admission keeps succeeding, and the queue grows unboundedly to OOM.
> 
> Fixes: a3eb95f891d6 ("net_sched: gred: add TCA_GRED_LIMIT attribute")
> Reported-by: vega@nebusec.ai
> Tested-by: Victor Nogueira <victor@mojatatu.com>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
> ---
> v1->v2:
> 
> 1. Added bfifo+plug into the same patch as gred since it is the same
>    pattern. Flagged by Zhan Xusheng and Sashiko[1][2].
> 2. Starting this patch, and for the rest of AI found bugs,  i will start
>    adding the conditions required to reproduce the patch (see the
>    above commentary "The bug can only be reproduced as root...").
> 
> [1] https://sashiko.dev/#/patchset/20260809091657.879929-1-jhs@mojatatu.com
> [2] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260809091657.879929-1-jhs@mojatatu.com

Reviewed-by: Simon Horman <horms@kernel.org>