From: shaos <shawnq1@163.com>
To: vinicius.gomes@intel.com
Cc: Jamal Hadi Salim <jhs@mojatatu.com>,
Jiri Pirko <jiri@resnulli.us>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [BUG] net/sched: CBS slope conversion wraps on 32-bit kernels
Date: Thu, 22 Oct 2026 14:47:42 +0000 [thread overview]
Message-ID: <20261022144742.63456-1-shawnq1@163.com> (raw)
Hello,
On an ILP32 kernel, a successful CBS qdisc request converts a signed 32-bit slope to unsigned long and multiplies by 125 before widening to s64. This wraps values above UINT32_MAX/125 and turns a negative send slope into a positive dumped value.
HEAD commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree: 30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler: Clang/LLVM 20 and LLD, i386 build
console output:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/d2c0239d34db2dd28138fe0f267a96263d06c8c1/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/bb3de79c6447b2180acb836fd229584486405419/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/9b82c23a085560adab3f89894fe0847d324be1f6/poc.c
32-bit compatibility header:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/16b578cf6d1de2e13f157406d9b1a55bf15725b1/shim32-sys-socket.h
reproduction instructions:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/28cf51867cfa9e7586e7bb6f2062bb3db9bd31c6/reproduction.md
Build the tested kernel for i386 from the exact commit using the attached configuration, install kernel headers, compile poc.c as a freestanding static i386 binary, and boot it in qemu-system-i386. Use the attached reproduction.md for the exact i386 build and boot commands. The i386 compatibility header is supplied separately; the PoC intentionally rejects 64-bit builds.
Impact and prerequisites:
CBS installs and reports incorrect shaping parameters on 32-bit kernels; the same requests round-trip on x86-64. CAP_NET_ADMIN is required. No memory safety, crash, information leak or privilege escalation is demonstrated.
Validation: Two fresh i386 QEMU boots reproduced the modulo-2^32 values for boundary, negative and large slopes; x86-64 controls round-tripped the same large values.
Thanks,
shaos
reply other threads:[~2026-10-22 14:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261022144742.63456-1-shawnq1@163.com \
--to=shawnq1@163.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=vinicius.gomes@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox