[PATCH net] net: harden qdisc_pkt_len_segs_init() against malicious GSO packets

[PATCH net] net: harden qdisc_pkt_len_segs_init() against malicious GSO packets

[Eric Dumazet]

An SKB_GSO_DODGY packet can carry untrusted gso_size and headers.

For instance, gso_size=1 and hdr_len=65532 for a 524275-byte frame
makes qdisc_pkt_len_segs_init() compute an accounted length of
about 4,294,574,091 bytes (after gso_segs silently wrapped in a u16).

With DRR quantum 256, the dequeue path then needs ~16.8 million
deficit refills before it can dequeue the skb, keeping the CPU in
the qdisc path long enough to trigger the soft-lockup watchdog.

Commit 8f735d64382d ("net/sched: bound qdisc_pkt_len to prevent
qdisc soft lockup") added QDISC_PKT_LEN_MAX to bound size table
amplification. Use the same bound for DODGY packets:

- Make gso_segs a u32 and drop packets whose segment count does
  not fit GSO_MAX_SEGS, instead of silently truncating it.

- Drop packets whose estimated qdisc_pkt_len() would exceed
  QDISC_PKT_LEN_MAX.

Fixes: 15e5a0307164 ("net_sched: better precise estimation on packet length for untrusted packets")
Reported-by: shaos <shawnq1@163.com>
Closes: https://lore.kernel.org/netdev/20261022144755.65025-1-shawnq1@163.com/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
---
 net/core/dev.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index e76762e29360ea87ade0846e4a4f9016dca587d6..573bcc9d67b1b1e21e844f054f0b51a172713a90 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4175,7 +4175,7 @@ static enum skb_drop_reason qdisc_pkt_len_segs_init(struct sk_buff *skb)
 {
 	struct skb_shared_info *shinfo = skb_shinfo(skb);
 	unsigned int hdr_len, tlen;
-	u16 gso_segs;
+	u32 gso_segs;
 
 	qdisc_skb_cb(skb)->pkt_len = skb->len;
 	if (!shinfo->gso_size) {
@@ -4226,6 +4226,15 @@ static enum skb_drop_reason qdisc_pkt_len_segs_init(struct sk_buff *skb)
 		if (payload <= 0)
 			return SKB_DROP_REASON_SKB_BAD_GSO;
 		gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size);
+		/* shinfo->gso_segs is a 16bit field.
+		 * Also make sure untrusted gso_size/hdr_len can not inflate
+		 * qdisc_pkt_len() beyond QDISC_PKT_LEN_MAX, or deficit
+		 * schedulers could spin in their refill loops.
+		 */
+		if (unlikely(gso_segs > GSO_MAX_SEGS ||
+			     skb->len + (u64)(gso_segs - 1) * hdr_len >
+			     QDISC_PKT_LEN_MAX))
+			return SKB_DROP_REASON_SKB_BAD_GSO;
 		shinfo->gso_segs = gso_segs;
 		qdisc_skb_cb(skb)->pkt_segs = gso_segs;
 	}
-- 
2.53.0

Re: [PATCH net] net: harden qdisc_pkt_len_segs_init() against malicious GSO packets

[Michael S. Tsirkin]

On Thu, Oct 22, 2026 at 05:54:36PM +0200, Eric Dumazet wrote:
> An SKB_GSO_DODGY packet can carry untrusted gso_size and headers.
> 
> For instance, gso_size=1 and hdr_len=65532 for a 524275-byte frame
> makes qdisc_pkt_len_segs_init() compute an accounted length of
> about 4,294,574,091 bytes (after gso_segs silently wrapped in a u16).
> 
> With DRR quantum 256, the dequeue path then needs ~16.8 million
> deficit refills before it can dequeue the skb, keeping the CPU in
> the qdisc path long enough to trigger the soft-lockup watchdog.
> 
> Commit 8f735d64382d ("net/sched: bound qdisc_pkt_len to prevent
> qdisc soft lockup") added QDISC_PKT_LEN_MAX to bound size table
> amplification. Use the same bound for DODGY packets:
> 
> - Make gso_segs a u32 and drop packets whose segment count does
>   not fit GSO_MAX_SEGS, instead of silently truncating it.
> 
> - Drop packets whose estimated qdisc_pkt_len() would exceed
>   QDISC_PKT_LEN_MAX.
> 
> Fixes: 15e5a0307164 ("net_sched: better precise estimation on packet length for untrusted packets")
> Reported-by: shaos <shawnq1@163.com>
> Closes: https://lore.kernel.org/netdev/20261022144755.65025-1-shawnq1@163.com/
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> Cc: Jamal Hadi Salim <jhs@mojatatu.com>
> Cc: "Michael S. Tsirkin" <mst@redhat.com>

I'm all for stack being more resilient.

Acked-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  net/core/dev.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/dev.c b/net/core/dev.c
> index e76762e29360ea87ade0846e4a4f9016dca587d6..573bcc9d67b1b1e21e844f054f0b51a172713a90 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -4175,7 +4175,7 @@ static enum skb_drop_reason qdisc_pkt_len_segs_init(struct sk_buff *skb)
>  {
>  	struct skb_shared_info *shinfo = skb_shinfo(skb);
>  	unsigned int hdr_len, tlen;
> -	u16 gso_segs;
> +	u32 gso_segs;
>  
>  	qdisc_skb_cb(skb)->pkt_len = skb->len;
>  	if (!shinfo->gso_size) {
> @@ -4226,6 +4226,15 @@ static enum skb_drop_reason qdisc_pkt_len_segs_init(struct sk_buff *skb)
>  		if (payload <= 0)
>  			return SKB_DROP_REASON_SKB_BAD_GSO;
>  		gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size);
> +		/* shinfo->gso_segs is a 16bit field.
> +		 * Also make sure untrusted gso_size/hdr_len can not inflate
> +		 * qdisc_pkt_len() beyond QDISC_PKT_LEN_MAX, or deficit
> +		 * schedulers could spin in their refill loops.
> +		 */
> +		if (unlikely(gso_segs > GSO_MAX_SEGS ||
> +			     skb->len + (u64)(gso_segs - 1) * hdr_len >
> +			     QDISC_PKT_LEN_MAX))
> +			return SKB_DROP_REASON_SKB_BAD_GSO;
>  		shinfo->gso_segs = gso_segs;
>  		qdisc_skb_cb(skb)->pkt_segs = gso_segs;
>  	}
> -- 
> 2.53.0

Re: [PATCH net] net: harden qdisc_pkt_len_segs_init() against malicious GSO packets

[Willem de Bruijn]

Michael S. Tsirkin wrote:
> On Thu, Oct 22, 2026 at 05:54:36PM +0200, Eric Dumazet wrote:
> > An SKB_GSO_DODGY packet can carry untrusted gso_size and headers.
> > 
> > For instance, gso_size=1 and hdr_len=65532 for a 524275-byte frame
> > makes qdisc_pkt_len_segs_init() compute an accounted length of
> > about 4,294,574,091 bytes (after gso_segs silently wrapped in a u16).
> > 
> > With DRR quantum 256, the dequeue path then needs ~16.8 million
> > deficit refills before it can dequeue the skb, keeping the CPU in
> > the qdisc path long enough to trigger the soft-lockup watchdog.
> > 
> > Commit 8f735d64382d ("net/sched: bound qdisc_pkt_len to prevent
> > qdisc soft lockup") added QDISC_PKT_LEN_MAX to bound size table
> > amplification. Use the same bound for DODGY packets:
> > 
> > - Make gso_segs a u32 and drop packets whose segment count does
> >   not fit GSO_MAX_SEGS, instead of silently truncating it.
> > 
> > - Drop packets whose estimated qdisc_pkt_len() would exceed
> >   QDISC_PKT_LEN_MAX.
> > 
> > Fixes: 15e5a0307164 ("net_sched: better precise estimation on packet length for untrusted packets")
> > Reported-by: shaos <shawnq1@163.com>
> > Closes: https://lore.kernel.org/netdev/20261022144755.65025-1-shawnq1@163.com/
> > Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> > Cc: Jamal Hadi Salim <jhs@mojatatu.com>
> > Cc: "Michael S. Tsirkin" <mst@redhat.com>
> 
> I'm all for stack being more resilient.
> 
> Acked-by: Michael S. Tsirkin <mst@redhat.com>
 
Reviewed-by: Willem de Bruijn <willemb@google.com>

Re: [PATCH net] net: harden qdisc_pkt_len_segs_init() against malicious GSO packets

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 22 Oct 2026 17:54:36 +0200 you wrote:
> An SKB_GSO_DODGY packet can carry untrusted gso_size and headers.
> 
> For instance, gso_size=1 and hdr_len=65532 for a 524275-byte frame
> makes qdisc_pkt_len_segs_init() compute an accounted length of
> about 4,294,574,091 bytes (after gso_segs silently wrapped in a u16).
> 
> With DRR quantum 256, the dequeue path then needs ~16.8 million
> deficit refills before it can dequeue the skb, keeping the CPU in
> the qdisc path long enough to trigger the soft-lockup watchdog.
> 
> [...]

Here is the summary with links:
  - [net] net: harden qdisc_pkt_len_segs_init() against malicious GSO packets
    https://git.kernel.org/netdev/net/c/c6648c9f3b51

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html