In cake_overhead(), packets with a single segment bypass multi-segment overhead calculations: if (segs == 1) return cake_calc_overhead(q, len, off); Commit c5d34f4583ea ("net_sched: cake: use qdisc_pkt_segs()") switched cake to retrieve the cached segmentation count via qdisc_pkt_segs(skb) instead of calculating it locally for dodgy GSO packets. If an skb with segs == 0 reaches cake_overhead(), it skips the segs == 1 early return and enters the multi-segment arithmetic: len = shinfo->gso_size + hdr_len; last_len = skb->len - shinfo->gso_size * (segs - 1); return (cake_calc_overhead(q, len, off) * (segs - 1) + cake_calc_overhead(q, last_len, off)); Because segs is an unsigned 16-bit integer, (segs - 1) underflows to 65535 (and is promoted to 4294967295 in the 32-bit unsigned arithmetic above). This multiplies the per-segment overhead by UINT32_MAX, so cake_overhead() returns a length close to 4.29 GB. cake_advance_shaper() then charges that length to the shaper, stalling the CAKE dequeue path for tens of seconds at 1 Gbit/s, and for minutes to hours at lower rates. Fix this by returning early with cake_calc_overhead(q, len, off) whenever segs <= 1. Fixes: c5d34f4583ea ("net_sched: cake: use qdisc_pkt_segs()") Cc: stable@vger.kernel.org Signed-off-by: Yuchao Zhang --- v3: - Split from v2 into a standalone patch with its own Fixes: tag (c5d34f4583ea) per Simon Horman and Sashiko review. - Link to v2: https://lore.kernel.org/netdev/20260922084124.36858-1-ndaugoing@gmail.com/ - Link to v1: https://lore.kernel.org/netdev/20260917122153.62722-1-ndaugoing@gmail.com/ net/sched/sch_cake.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index dc93267029e7..b0d604a7052a 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -1420,7 +1420,7 @@ static u32 cake_overhead(struct cake_sched_data *q, const struct sk_buff *skb) WRITE_ONCE(q->avg_netoff, cake_ewma(q->avg_netoff, off << 16, 8)); - if (segs == 1) + if (segs <= 1) return cake_calc_overhead(q, len, off); /* borrowed from qdisc_pkt_len_segs_init() */ -- 2.53.0