Commit 9552b11e authored by Jamal Hadi Salim's avatar Jamal Hadi Salim Committed by Paolo Abeni
Browse files

net/sched: fix packet loop on netem when duplicate is on 



When netem duplicates a packet it re-enqueues the copy at the root qdisc.
If another netem sits in the tree the copy can be duplicated
again, recursing until the stack or memory is exhausted.

The original duplication guard temporarily zeroed q->duplicate around
the re-enqueue, but that does not cover all cases because it is
per-qdisc state shared across all concurrent enqueue paths
and is not safe without additional locking.

Use the skb tc_depth field introduced in an earlier patch:
 - increment it on the duplicate before re-enqueue
 - skip duplication for any skb whose tc_depth is already non-zero.

This marks the packet itself rather than mutating qdisc state,
therefore it is safe regardless of tree topology or concurrency.

Fixes: 0afb51e7 ("[PKT_SCHED]: netem: reinsert for duplication")
Reported-by: default avatarWilliam Liu <will@willsroot.io>
Reported-by: default avatarSavino Dicanosa <savy@syst3mfailure.io>
Closes: https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/


Co-developed-by: default avatarVictor Nogueira <victor@mojatatu.com>
Signed-off-by: default avatarVictor Nogueira <victor@mojatatu.com>
Reviewed-by: default avatarWilliam Liu <will@willsroot.io>
Reviewed-by: default avatarStephen Hemminger <stephen@networkplumber.org>
Signed-off-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260525122556.973584-5-jhs@mojatatu.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent b213a4c6

net/sched/sch_netem.c

+3 −4
Original line number Diff line number Diff line
@@ -461,7 +461,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, 
	skb->prev = NULL;



	/* Random duplication */

	if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor, &q->prng))

	if (q->duplicate && skb->tc_depth == 0 &&

	    q->duplicate >= get_crandom(&q->dup_cor, &q->prng))

		++count;



	/* Drop packet? */
@@ -540,11 +541,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, 
	 */

	if (skb2) {

		struct Qdisc *rootq = qdisc_root_bh(sch);

		u32 dupsave = q->duplicate; /* prevent duplicating a dup... */



		q->duplicate = 0;

		skb2->tc_depth++; /* prevent duplicating a dup... */

		rootq->enqueue(skb2, rootq, to_free);

		q->duplicate = dupsave;

		skb2 = NULL;

	}