In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: codel: bound the dropping loop per dequeue call<\/p>\n
The CoDel control law schedules the next drop one interval\/sqrt(count)
\nafter the previous drop, using the configured interval
\n(codel_params.interval). For very small intervals the scheduled step
\nrounds down to zero, so the dropping loop in codel_dequeue() never
\nadvances and drains the entire backlog under the qdisc lock in one
\ncall – an unprivileged user can trigger a soft lockup this way.<\/p>\n
Fix in the shared codel code used by both codel and fq_codel:<\/p>\n
1. Make the control-law step at least 1 tick so the dropping loop
\n always moves forward.<\/p>\n
2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops
\n per codel_dequeue() call, resyncing drop_next to now when the cap
\n is hit: the catch-up owed to the loop grows with the idle gap and
\n the backlog, which no interval threshold can bound. This is a
\n deliberate behaviour change after long idle gaps.<\/p>\n
The cap applies to fq_codel (4b549a2ef4be) and the mac80211 TXQ path
\n(fixed interval, cap only).<\/p>\n
The target sojourn delay (codel_params.target) is not validated: it
\ndoes not feed the control law, so a sub-tick value is aggressive
\nrather than deadlock-prone.<\/p>\n
Conditions to recreate the bug:
\n – tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000
\n – tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel)
\n – unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf
\n soft-lockups (watchdog: BUG: soft lockup) while one
\n codel_dequeue() call drops the backlog under the qdisc lock
\n – patched kernel: same setup, at most 256 drops per dequeue call,
\n no soft lockup<\/p>\n
Testing: claim reproducer and interval 2us\/3us variants run clean;
\ntdc qdisc category passes (see the selftests patch).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: codel: bound the dropping loop per dequeue call<\/p>\n
The CoDel control law schedules the next drop one interval\/sqrt(count)<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-39098","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/39098","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=39098"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=39098"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=39098"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}