Add a per-CPU recursion depth counter to netem_enqueue(). When netem duplicates a packet, the clone is re-enqueued at the root qdisc. If the tree contains other netem instances, this can recurse without bound, causing soft lockups and OOM. This approach was previously considered but rejected on the grounds that netem_dequeue calling enqueue on a child netem could bypass the depth check. That concern does not apply: the child netem's netem_enqueue() increments the same per-CPU counter, so the total nesting depth across all netem instances in the call chain is tracked correctly. A depth limit of 4 is generous for any legitimate configuration. Fixes: 0afb51e72855 ("[PKT_SCHED]: netem: reinsert for duplication") Link: https://bugzilla.kernel.org/show_bug.cgi?id=220774 Cc: stable@vger.kernel.org Reported-by: William Liu Reported-by: Savino Dicanosa Signed-off-by: Stephen Hemminger --- net/sched/sch_netem.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index 0ccf74a9cb82..085fa3ad6f83 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -21,6 +21,7 @@ #include #include #include +#include #include #include @@ -29,6 +30,15 @@ #define VERSION "1.3" +/* + * Limit for recursion from duplication. + * Duplicated packets are re-enqueued at the root qdisc, which may + * reach this or another netem instance, causing nested calls to + * netem_enqueue(). This per-CPU counter limits the total depth. + */ +static DEFINE_PER_CPU(unsigned int, netem_enqueue_depth); +#define NETEM_RECURSION_LIMIT 4 + /* Network Emulation Queuing algorithm. ==================================== @@ -460,6 +470,14 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, /* Do not fool qdisc_drop_all() */ skb->prev = NULL; + /* Guard against recursion from duplication re-injection. */ + if (unlikely(this_cpu_inc_return(netem_enqueue_depth) > + NETEM_RECURSION_LIMIT)) { + this_cpu_dec(netem_enqueue_depth); + qdisc_drop(skb, sch, to_free); + return NET_XMIT_DROP; + } + /* Random duplication */ if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor, &q->prng)) ++count; @@ -474,6 +492,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, if (count == 0) { qdisc_qstats_drop(sch); __qdisc_drop(skb, to_free); + this_cpu_dec(netem_enqueue_depth); return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; } @@ -529,6 +548,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, qdisc_drop_all(skb, sch, to_free); if (skb2) __qdisc_drop(skb2, to_free); + this_cpu_dec(netem_enqueue_depth); return NET_XMIT_DROP; } @@ -643,8 +663,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, /* Parent qdiscs accounted for 1 skb of size @prev_len */ qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len)); } else if (!skb) { + this_cpu_dec(netem_enqueue_depth); return NET_XMIT_DROP; } + this_cpu_dec(netem_enqueue_depth); return NET_XMIT_SUCCESS; } -- 2.51.0