From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv2-f12.google.com (mail-qv2-f12.google.com [74.125.230.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB3253E8342 for ; Mon, 14 Sep 2026 08:07:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.230.140 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789373224; cv=none; b=HRCL5ddWlzOYm37uygr3L9hgsJ8b9mkY3ELPBMfBovVEDsdxDOyHoBsG0Vn40Y1eQLPKjNHBBXeJVJor7uoO5M1McdXI6hBlmtJ/fyshpbuPF0U+I4VJdHolwinyeykvRUXQKmv56orj5QSd18P1fP/QLC/trY3mXjcgZeFkiZE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789373224; c=relaxed/simple; bh=0rpz5RcfyLg/UdQ9j0n/J8aYvsCqteq/E6T+2rgP4EI=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type; b=Hq+GjgNWbI4NgDTmDoK9kmBtlYNOd9ekLC+U5vKKnjpEHDhDg0dTtqKpP8ZVRjS5aDJP1OC9RvLeY4b0DVJHqB+Q1XZhn3lo6sDG6au+BEWu4LjEnhvJ+YYkgnMytpK+0TenTRbUH073K6xifZy+INvAwXxUXtxZCwfjsmhqYN8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mojatatu.com; spf=none smtp.mailfrom=mojatatu.com; dkim=pass (1024-bit key) header.d=mojatatu.com header.i=@mojatatu.com header.b=nHvPkgvw; arc=none smtp.client-ip=74.125.230.140 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mojatatu.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=mojatatu.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mojatatu.com header.i=@mojatatu.com header.b="nHvPkgvw" Received: by mail-qv2-f12.google.com with SMTP id 6a1803df08f44-90cdfc6db0bso24663756d6.3 for ; Mon, 14 Sep 2026 01:07:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu.com; s=google; t=1789373221; x=1789978021; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=7pT3kEPEgpbWBj+9NNyMg+ukyMM8ao5jiiq0DN4Mn8A=; b=nHvPkgvwrtg/l3l6ShWepyXGQ6YfbIJp4dhIHLL2SvZ8ZKxfTBGmrpId9NDQSSJ0v1 Zv8eOSra/j0lpOS0PRINQs4b8E9wZAm1B7Dq+kFidJNNdNpYuCBiOck3oN7BC4UAflUi KUseDPT8LQbl8QUs0IVjNqibXsycNqRAYt87Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1789373221; x=1789978021; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=7pT3kEPEgpbWBj+9NNyMg+ukyMM8ao5jiiq0DN4Mn8A=; b=QXsJ1eggPRmZ41h9SwWMcD6KXt6a94vWF2EWiDvEdPSArp09D58KRBD8J4oECzDWuJ QYmDI1AFqw9SPMaG4T+qTgh8pfjg10HBOBX6BfrAp7zvbc1UDleNBynGVAuFhyHVZH8n F1gufEGeyzSQ3K0JPhKQ5pfFwl7B5l3oxvGkZUAa6nnZBVRNEVNt+2g93fWkDv6ybDox Tv3wY8sUzLh28dXhHIge3OlqjfVxSkSE2EbiK2CWa6SfRA9Ecav5hM85Yk6kuKm0hSIt L4hgsWC1/L5FL/crAvStXq/5l/OOm9rkDHHfeggdkUKqloSzLT9hI8Vs21a8nBTDPq4X dqtg== X-Gm-Message-State: AFuF++mSHsNYWIxxrPQh6NFs+Z4xNtFDtzoY/0mESJXuiji3fc0qT5qx Gvc7h5eHvxMAhiLE41GebUwDh52HfuamrIf+UghRVdNSmDsOjEfdOSnZq5Z/CXbC1hzWxeQvXmb eJcE+1g== X-Gm-Gg: AYBFou3JzxS63O81E/+Ty/0SmuXNsSEMf/VW7rv9WDupJ8m7wYldqfRtNCbCNjJRliM BL4g3KHKlTEaMXi2ig2Jif5TheY89Tk6ZkqtyqHsHPtnEP+VjxKxM0Awc4kqzdbMWhkFfII6ijA Q0AkNo6g4LmSaaaFVI1s2rhiSKeN96Bm2HDLojelRIP1o4uRga6ykiI+RuHMrhjwpMch2GB9y0z bR7LnrHyxneb9BvT4amrhIjX9lRPQ9smpQKXCzIW+SJhNdSCYFDzTMfiVVyZcoo4LycfB0YGLLZ r6W1BhZza1KH18IMJlZRx5U+7EAPjvPmLeU3r0C3gnLDpUPlF9MvhZxUvAMIUIQM+uZKykAN/Xw /OmROWMNaLSbO8J5ns6ZudxNv468oFdZZ3NIVKKkos2xCcNyhhy0lRdp/YC1YbVsy+WsfO2iYH4 vEDbOw74gqSeb5rGvwp8lK4sFLXAF6qQoiedWl9+2qOy6MHE11sDNywvIvtmyzXabeVMXsASd9c TC8NXyUf1IsCQBF4LNZGMi0cB2xNKchcBGO/G3wPySReztOaCzxqk/fVf3i3Aecsz2pTHTbqT3P HKjifyO3AcDzEcaxUR6+JSM= X-Received: by 2002:a05:6214:1945:b0:910:34c8:ac46 with SMTP id 6a1803df08f44-9122e657768mr23016236d6.25.1789373221522; Mon, 14 Sep 2026 01:07:01 -0700 (PDT) Received: from majuu.waya (pool-174-112-106-84.cpe.net.cable.rogers.com. [174.112.106.84]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-9120f4d51ffsm90187336d6.45.2026.09.14.01.06.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 14 Sep 2026 01:07:01 -0700 (PDT) From: Jamal Hadi Salim To: netdev@vger.kernel.org Cc: Jamal Hadi Salim , Jiri Pirko , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Victor Nogueira , Sashiko , hybris , stable@vger.kernel.org Subject: [PATCH net v2 1/2] net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget Date: Mon, 14 Sep 2026 04:06:55 -0400 Message-Id: X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hfsc_classify() applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowid gets res.class set once at bind time, so the check never runs for it during classification. hfsc_adjust_levels() can later raise a class's level without revalidating existing bindings, leaving two binds that were each legal at bind time pointing at each other; the classify walk then bounces between two interior classes forever with the qdisc lock held and BH disabled — a soft lockup from a single packet. Bound the traversal, mirroring HTB: count only the non-descending hops, which a legitimate walked tree can only take by level drift after bind time; anything beyond a small budget is a cycle. Drop the packet with a rate-limited warning when the budget is exhausted. Descending hops never consume budget, so legitimately deep trees are unaffected, and a terminating lateral chain (the level-drift false-positive family) still classifies normally. Conditions to recreate the bug: - CONFIG_NET_SCHED, CONFIG_NET_SCH_HFSC, CONFIG_NET_CLS_U32, CONFIG_LOCKUP_DETECTOR. - Build a cycle with two legal-at-bind-time flowid binds and a level drift: class X 1:1 (child of root) with leaf child 1:10; class Y 1:2 (sibling of X) with children 1:20 and 1:200; root u32 filter flowid 1:1; filter on X flowid 1:2 (legal when Y is a leaf); after Y's level rises to 2, filter on Y flowid 1:1 (legal then). Send one packet (ping on the device). Unfixed kernel: classify spins with the qdisc lock held; with softlockup_panic=1 it panics. - Reachable from unprivileged user via unshare -Urn (CAP_NET_ADMIN). Fixes: a2f79227138c ("net_sched: sch_hfsc: fix classification loops") Reported-by: Sashiko (gemini + nipa) Link: https://sashiko.dev/#/patchset/QDISC-CTUU.v1.20260908094501@mojatatu.com Cc: stable@vger.kernel.org Reviewed-by: Victor Nogueira Tested-by: hybris Signed-off-by: Jamal Hadi Salim --- v2 changes: - Replace the absolute hop bound (root->level) with a budget that counts only non-descending hops, so a legal lateral level chain still classifies. (Sashiko) - Reword the "strict descent" changelog claim (Sashiko). net/sched/sch_hfsc.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c index e87f5021a199..b073efaf2bf5 100644 --- a/net/sched/sch_hfsc.c +++ b/net/sched/sch_hfsc.c @@ -386,6 +386,12 @@ cftree_update(struct hfsc_class *cl) #define SM_MASK ((1ULL << SM_SHIFT) - 1) #define ISM_MASK ((1ULL << ISM_SHIFT) - 1) +/* + * bound on consecutive non-descending (lateral / upward) hops in a + * classify walk, mirroring htb's TC_HTB_MAXDEPTH headroom + */ +#define HFSC_CLASSIFY_MAX_DRIFT 8 + static inline u64 seg_x2y(u64 x, u64 sm) { @@ -1133,6 +1139,7 @@ hfsc_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr) struct hfsc_class *head, *cl; struct tcf_result res; struct tcf_proto *tcf; + unsigned int drift; int result; if (TC_H_MAJ(skb->priority ^ sch->handle) == 0 && @@ -1142,6 +1149,7 @@ hfsc_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr) *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; head = &q->root; + drift = HFSC_CLASSIFY_MAX_DRIFT; tcf = rcu_dereference_bh(q->root.filter_list); while (tcf && (result = tcf_classify_qdisc(skb, tcf, &res, false)) >= 0) { #ifdef CONFIG_NET_CLS_ACT @@ -1167,6 +1175,16 @@ hfsc_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr) if (cl->level == 0) return cl; /* hit leaf class */ + /* + * flowid binds skip the level check above (res.class is set + * at bind time and levels drift after), so a walk can follow + * lateral hops without descending; bound them here. + */ + if (cl->level >= head->level && drift-- == 0) { + pr_warn_ratelimited("hfsc: classify loop detected, dropping packet\n"); + return NULL; + } + /* apply inner filter chain */ tcf = rcu_dereference_bh(cl->filter_list); head = cl; -- 2.43.0