[BUG] net: sched: cls_flow perturb period wraps when scaled

[BUG] net: sched: cls_flow perturb period wraps when scaled

[shaos]

Hello,

cls_flow multiplies the user-provided TCA_FLOW_PERTURB seconds by HZ in 32-bit arithmetic without a range check, both when creating and changing a filter.  Large values wrap to a very short perturb timer or to zero, changing the filter's timing behavior.

HEAD commit:    fe2ec83746e501645709761605c2464a44fd2929
git tree:       upstream Linux checkout, local branch master
source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
compiler:       gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)

console output:
https://gist.githubusercontent.com/shaos26/e00f090da98036578d357a8ca70b6e3d/raw/fa14843487b13fb553ca73b2b16ed3db507c1439/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/e00f090da98036578d357a8ca70b6e3d/raw/6e1af5fc2bf4af2bafb39e23f087c47e62ea3ff4/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/e00f090da98036578d357a8ca70b6e3d/raw/2cac1c5dd9e3ba3a9bdd55e803f3cd72088b9bbf/poc.c

Build and run the PoC on the target kernel.  It creates a private user and network namespace; the first command exercises a value that wraps to zero at HZ=100, the second exercises a nonzero wrap, and the third asks SFQ to reject the same oversized period:

    gcc -static -O2 -Wall -Wextra -o cls_flow_poc poc.c
    ./cls_flow_poc --hz 100 --userns 42949673 1
    ./cls_flow_poc --hz 100 --userns 42949674 2
    ./cls_flow_poc --hz 100 --userns --sfq 42949673 3

With HZ=100, setting 42949673 seconds dumped as 0 and 42949674 dumped as 1; 1073741824 disabled the timer.  The boundary value 42949672 remained unchanged.  Three fresh boots reproduced the matrix, and the SFQ implementation rejected the same overflowing range.

Impact and prerequisites:
This is a network-classifier timing and resource-control defect.  It requires CAP_NET_ADMIN in the target netns or an unprivileged user namespace.  The evidence shows unexpectedly frequent or disabled perturbation, not memory corruption or privilege escalation.

Validation: Three fresh boots reproduced the wraparound matrix, including the uid 1000 user-namespace run.  SFQ rejected the same overflowing range.

Thanks,

shaos