[PATCH net v2] net/sched: cake: reject overhead values that underflow length

[PATCH net v2] net/sched: cake: reject overhead values that underflow length

[Samuel Moelius]

CAKE accepts overhead values that can make adjusted packet length
arithmetic underflow.  A negative effective length can wrap through
unsigned arithmetic and become a large value.

Such configurations make rate accounting depend on integer wraparound
rather than on the packet size userspace intended to model.

Validate overhead settings before using them in adjusted length
calculations.

Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
---
Changes in v2:
  - Add fixes tag

 net/sched/sch_cake.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 5862933be8d7..03972e5525b5 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -2308,12 +2308,18 @@ static void cake_reset(struct Qdisc *sch)
 		cake_clear_tin(sch, c);
 }
 
+static const struct netlink_range_validation_signed cake_overhead_range = {
+	.min = -64,
+	.max = 256,
+};
+
 static const struct nla_policy cake_policy[TCA_CAKE_MAX + 1] = {
 	[TCA_CAKE_BASE_RATE64]   = { .type = NLA_U64 },
 	[TCA_CAKE_DIFFSERV_MODE] = { .type = NLA_U32 },
 	[TCA_CAKE_ATM]		 = { .type = NLA_U32 },
 	[TCA_CAKE_FLOW_MODE]     = { .type = NLA_U32 },
-	[TCA_CAKE_OVERHEAD]      = { .type = NLA_S32 },
+	[TCA_CAKE_OVERHEAD]      =
+		NLA_POLICY_FULL_RANGE_SIGNED(NLA_S32, &cake_overhead_range),
 	[TCA_CAKE_RTT]		 = { .type = NLA_U32 },
 	[TCA_CAKE_TARGET]	 = { .type = NLA_U32 },
 	[TCA_CAKE_AUTORATE]      = { .type = NLA_U32 },
-- 
2.43.0

Re: [PATCH net v2] net/sched: cake: reject overhead values that underflow length

[Jakub Kicinski]

On Tue,  9 Jun 2026 23:29:36 +0000 Samuel Moelius wrote:
> CAKE accepts overhead values that can make adjusted packet length
> arithmetic underflow.  A negative effective length can wrap through
> unsigned arithmetic and become a large value.

Sorry, why are you posting more patches? You were told to stop
yesterday. And you received an email which said:

Here are a few ground rules which are frequently broken by newcomers:

 - You must wait at least 24 hours before posting a new version to give
   reviewers time to respond. This is a hard rule, no matter what your
   reason to repost is.

 - Each new version of your series should be a fresh / separate thread
   Add a https://lore.kernel.org/.. link to the previous version to
   the cover letter or changelog, instead of threading the submissions.

 - Until you gain experience submit one of two patches at a time,
   do not send multiple changes at once until some of your changes
   were accepted. This avoids reviewers having to provide the same
   feedback on multiple patches.

 - Avoid changing the subject of the changes or cover letter unless
   necessary, it breaks our patch tracking.

 - If you're submitting changes for issues discovered using automated
   tools - commit message should explain the discovery and testing
   process (for drivers explicitly mention that you don't have access
   to the device, it's not a blocker).


You broke at least 2 of these already.

If you keep ignoring direct maintainer feedback you will be banned.

Re: [PATCH net v2] net/sched: cake: reject overhead values that underflow length

[Samuel Moelius]

On Tue, Jun 9, 2026 at 8:45 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Tue,  9 Jun 2026 23:29:36 +0000 Samuel Moelius wrote:
> > CAKE accepts overhead values that can make adjusted packet length
> > arithmetic underflow.  A negative effective length can wrap through
> > unsigned arithmetic and become a large value.
>
> Sorry, why are you posting more patches? You were told to stop
> yesterday. And you received an email which said:
>
> Here are a few ground rules which are frequently broken by newcomers:
>
>  - You must wait at least 24 hours before posting a new version to give
>    reviewers time to respond. This is a hard rule, no matter what your
>    reason to repost is.
>
>  - Each new version of your series should be a fresh / separate thread
>    Add a https://lore.kernel.org/.. link to the previous version to
>    the cover letter or changelog, instead of threading the submissions.
>
>  - Until you gain experience submit one of two patches at a time,
>    do not send multiple changes at once until some of your changes
>    were accepted. This avoids reviewers having to provide the same
>    feedback on multiple patches.
>
>  - Avoid changing the subject of the changes or cover letter unless
>    necessary, it breaks our patch tracking.
>
>  - If you're submitting changes for issues discovered using automated
>    tools - commit message should explain the discovery and testing
>    process (for drivers explicitly mention that you don't have access
>    to the device, it's not a blocker).
>
>
> You broke at least 2 of these already.
>
> If you keep ignoring direct maintainer feedback you will be banned.

I'm sorry for my misunderstanding. When should I resume submitting patches?

Re: [PATCH net v2] net/sched: cake: reject overhead values that underflow length

[Jakub Kicinski]

On Tue, 9 Jun 2026 20:55:35 -0400 Samuel Moelius wrote:
> On Tue, Jun 9, 2026 at 8:45 PM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > On Tue,  9 Jun 2026 23:29:36 +0000 Samuel Moelius wrote:  
> > > CAKE accepts overhead values that can make adjusted packet length
> > > arithmetic underflow.  A negative effective length can wrap through
> > > unsigned arithmetic and become a large value.  
> >
> > Sorry, why are you posting more patches? You were told to stop
> > yesterday. And you received an email which said:
> >
> > Here are a few ground rules which are frequently broken by newcomers:
> >
> >  - You must wait at least 24 hours before posting a new version to give
> >    reviewers time to respond. This is a hard rule, no matter what your
> >    reason to repost is.
> >
> >  - Each new version of your series should be a fresh / separate thread
> >    Add a https://lore.kernel.org/.. link to the previous version to
> >    the cover letter or changelog, instead of threading the submissions.
> >
> >  - Until you gain experience submit one of two patches at a time,
> >    do not send multiple changes at once until some of your changes
> >    were accepted. This avoids reviewers having to provide the same
> >    feedback on multiple patches.
> >
> >  - Avoid changing the subject of the changes or cover letter unless
> >    necessary, it breaks our patch tracking.
> >
> >  - If you're submitting changes for issues discovered using automated
> >    tools - commit message should explain the discovery and testing
> >    process (for drivers explicitly mention that you don't have access
> >    to the device, it's not a blocker).
> >
> >
> > You broke at least 2 of these already.
> >
> > If you keep ignoring direct maintainer feedback you will be banned.  
> 
> I'm sorry for my misunderstanding. When should I resume submitting patches?

Please wait until your outstanding submissions get reviewed, here is
the patch review queue for netdev filtered down to your email:

https://patchwork.kernel.org/project/netdevbpf/list/?submitter=222403

Once that's empty you can resume but again please try to go slow.
4 patches under review at a time, start from the most impactful ones.
After you get >20 patches accepted (in networking specifically!) you 
can open up the faucet a bit and go to 10 outstanding patches.

Re: [PATCH net v2] net/sched: cake: reject overhead values that underflow length

[Toke Høiland-Jørgensen]

Samuel Moelius <sam.moelius@trailofbits.com> writes:

> CAKE accepts overhead values that can make adjusted packet length
> arithmetic underflow.  A negative effective length can wrap through
> unsigned arithmetic and become a large value.
>
> Such configurations make rate accounting depend on integer wraparound
> rather than on the packet size userspace intended to model.
>
> Validate overhead settings before using them in adjusted length
> calculations.
>
> Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper")
> Assisted-by: Codex:gpt-5.5-cyber-preview
> Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>

Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>