netdev - Re: [PATCH net 5/6] net/sched: fix packet loop on netem when duplicate is on

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <xJqddWWQEUAQtUVQo1auHMfOxgaRO1ix2L7j9yR9iGPNdbNFlMNjeojDvutQ40tKfzCH9ZkI1Uaeq7e4EhIDLVRz3TisS8fo0rsNcQKS7mg=@willsroot.io>
Date: Sun, 11 Jan 2026 20:22:41 +0000
From: William Liu <will@...lsroot.io>
To: Jamal Hadi Salim <jhs@...atatu.com>
Cc: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, horms@...nel.org, andrew+netdev@...n.ch, netdev@...r.kernel.org, xiyou.wangcong@...il.com, jiri@...nulli.us, victor@...atatu.com, dcaratti@...hat.com, lariel@...dia.com, daniel@...earbox.net, pablo@...filter.org, kadlec@...filter.org, fw@...len.de, phil@....cc, netfilter-devel@...r.kernel.org, coreteam@...filter.org, zyc199902@...omail.cn, lrGerlinde@...lfence.com, jschung2@...ton.me, Savino Dicanosa <savy@...t3mfailure.io>
Subject: Re: [PATCH net 5/6] net/sched: fix packet loop on netem when duplicate is on

On Sunday, January 11th, 2026 at 4:40 PM, Jamal Hadi Salim <jhs@...atatu.com> wrote:

>
>
> As stated by William [1]:
>
> "netem_enqueue's duplication prevention logic breaks when a netem
> resides in a qdisc tree with other netems - this can lead to a
> soft lockup and OOM loop in netem_dequeue, as seen in [2].
> Ensure that a duplicating netem cannot exist in a tree with other
> netems."
>
> In this patch, we use the first approach suggested in [1] (the skb
> ttl field) to detect and stop a possible netem duplicate infinite loop.
>
> [1] https://lore.kernel.org/netdev/20250708164141.875402-1-will@willsroot.io/
> [2] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/
>
> Fixes: 0afb51e72855 ("[PKT_SCHED]: netem: reinsert for duplication")
> Reported-by: William Liu will@...lsroot.io
>
> Reported-by: Savino Dicanosa savy@...t3mfailure.io
>
> Closes: https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/
> Co-developed-by: Victor Nogueira victor@...atatu.com
>
> Signed-off-by: Victor Nogueira victor@...atatu.com
>
> Signed-off-by: Jamal Hadi Salim jhs@...atatu.com
>
> ---
> net/sched/sch_netem.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
> index a9ea40c13527..4a65fb841a98 100644
> --- a/net/sched/sch_netem.c
> +++ b/net/sched/sch_netem.c
> @@ -461,7 +461,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
> skb->prev = NULL;
>
>
> /* Random duplication */
> - if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor, &q->prng))
>
> + if (q->duplicate && !skb->ttl &&
>
> + q->duplicate >= get_crandom(&q->dup_cor, &q->prng))
>
> ++count;
>
> /* Drop packet? */
> @@ -539,11 +540,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
> */
> if (skb2) {
> struct Qdisc rootq = qdisc_root_bh(sch);
> - u32 dupsave = q->duplicate; / prevent duplicating a dup... */
>
>
> - q->duplicate = 0;
>
> + skb2->ttl++; /* prevent duplicating a dup... */
>
> rootq->enqueue(skb2, rootq, to_free);
>
> - q->duplicate = dupsave;
>
> skb2 = NULL;
> }
>
> --
> 2.34.1

Reviewed-by: William Liu <will@...lsroot.io>