From: shaos <shawnq1@163.com>
To: jhs@mojatatu.com
Cc: Jiri Pirko <jiri@resnulli.us>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [BUG] net/sched: GRED VQ shrink can orphan queued packets and wrap backlog
Date: Thu, 22 Oct 2026 14:48:11 +0000 [thread overview]
Message-ID: <20261022144811.66149-1-shawnq1@163.com> (raw)
Hello,
Queue packets on GRED virtual queue 5, shrink the table from eight VQs to one, re-expand it and recreate VQ 5. The queued skbs retain the DP number but the old per-VQ accounting object has been freed; dequeue subtracts from the new zeroed u32 backlog.
HEAD commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree: 30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler: gcc 11.4.0, GNU ld 2.38
console output:
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/82b323a9f5e2dce8b71893aeb0bf841eb019e691/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/ac2ef52ac9d01812eef68d5a10de2fb3e5e8be4c/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/e3f8a8dbb72be235d802784cb4265435f82de27d/poc-init
auxiliary reproducer (sender.c):
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/7028d32b386af449ac9097ae336dfa2d520b3e51/sender.c
auxiliary reproducer (run-qemu.sh):
https://gist.githubusercontent.com/shaos26/160abad19ad184cfbb6ef6c9be204b80/raw/abe3ba54cf34d873da1378b66ed0a1e3524e70b0/run-qemu.sh
Build the tested kernel with the attached test configuration and boot a disposable QEMU guest with a minimal BusyBox initramfs. poc-init configures TBF/GRED and the VQ resize sequence; sender.c generates the AF_PACKET traffic. The run-qemu.sh wrapper in this bundle records a complete run.
Impact and prerequisites:
The new VQ reports backlog 2^32-3000 and rejects subsequent packets assigned to it. This requires CAP_NET_ADMIN and CAP_NET_RAW in the network namespace and affects the configured qdisc; it is not a privilege escalation.
Validation: Two fresh-boot positives produced VQ 5 backlog 4294964296b and additional drops; a no-resize control drained to zero and transmitted the probe.
Thanks,
shaos
reply other threads:[~2026-10-22 14:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261022144811.66149-1-shawnq1@163.com \
--to=shawnq1@163.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox