[BUG] net/sched: CBS slope conversion wraps on 32-bit kernels

[BUG] net/sched: CBS slope conversion wraps on 32-bit kernels

[shaos]

Hello,

On an ILP32 kernel, a successful CBS qdisc request converts a signed 32-bit slope to unsigned long and multiplies by 125 before widening to s64. This wraps values above UINT32_MAX/125 and turns a negative send slope into a positive dumped value.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       Clang/LLVM 20 and LLD, i386 build

console output:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/d2c0239d34db2dd28138fe0f267a96263d06c8c1/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/bb3de79c6447b2180acb836fd229584486405419/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/9b82c23a085560adab3f89894fe0847d324be1f6/poc.c
32-bit compatibility header:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/16b578cf6d1de2e13f157406d9b1a55bf15725b1/shim32-sys-socket.h
reproduction instructions:
https://gist.githubusercontent.com/shaos26/dbaa4a3726bde3bc54298b094d1c13ff/raw/28cf51867cfa9e7586e7bb6f2062bb3db9bd31c6/reproduction.md

Build the tested kernel for i386 from the exact commit using the attached configuration, install kernel headers, compile poc.c as a freestanding static i386 binary, and boot it in qemu-system-i386. Use the attached reproduction.md for the exact i386 build and boot commands. The i386 compatibility header is supplied separately; the PoC intentionally rejects 64-bit builds.

Impact and prerequisites:
CBS installs and reports incorrect shaping parameters on 32-bit kernels; the same requests round-trip on x86-64. CAP_NET_ADMIN is required. No memory safety, crash, information leak or privilege escalation is demonstrated.

Validation: Two fresh i386 QEMU boots reproduced the modulo-2^32 values for boundary, negative and large slopes; x86-64 controls round-tripped the same large values.

Thanks,

shaos