tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net/sched: taprio: enforce minimum value for picos_per_byte

Syzbot reported a WARNING in taprio_get_start_time().

When link speed is 470,589 or greater, q->picos_per_byte becomes too
small, causing length_to_duration(q, ETH_ZLEN) to return zero.

This zero value leads to validation failures in fill_sched_entry() and
parse_taprio_schedule(), allowing arbitrary values to be assigned to
entry->interval and cycle_time. As a result, sched->cycle can become zero.

Since SPEED_800000 is the largest defined speed in
include/uapi/linux/ethtool.h, this issue can occur in realistic scenarios.

To ensure length_to_duration() returns a non-zero value for minimum-sized
Ethernet frames (ETH_ZLEN = 60), picos_per_byte must be at least 17
(60 * 17 > PSEC_PER_NSEC which is 1000).

This patch enforces a minimum value of 17 for picos_per_byte when the
calculated value would be lower, and adds a warning message to inform
users that scheduling accuracy may be affected at very high link speeds.

Fixes: fb66df20a720 ("net/sched: taprio: extend minimum interval restriction to entire cycle too")
Reported-by: syzbot+398e1ee4ca2cac05fddb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=398e1ee4ca2cac05fddb
Signed-off-by: Takamitsu Iwai <takamitz@amazon.co.jp>
Link: https://patch.msgid.link/20250728173149.45585-1-takamitz@amazon.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Takamitsu Iwai and committed by
Jakub Kicinski ae8508b2 d46e51f1

+18 -3
+18 -3
net/sched/sch_taprio.c
··· 43 43 #define TAPRIO_SUPPORTED_FLAGS \ 44 44 (TCA_TAPRIO_ATTR_FLAG_TXTIME_ASSIST | TCA_TAPRIO_ATTR_FLAG_FULL_OFFLOAD) 45 45 #define TAPRIO_FLAGS_INVALID U32_MAX 46 + /* Minimum value for picos_per_byte to ensure non-zero duration 47 + * for minimum-sized Ethernet frames (ETH_ZLEN = 60). 48 + * 60 * 17 > PSEC_PER_NSEC (1000) 49 + */ 50 + #define TAPRIO_PICOS_PER_BYTE_MIN 17 46 51 47 52 struct sched_entry { 48 53 /* Durations between this GCL entry and the GCL entry where the ··· 1289 1284 } 1290 1285 1291 1286 static void taprio_set_picos_per_byte(struct net_device *dev, 1292 - struct taprio_sched *q) 1287 + struct taprio_sched *q, 1288 + struct netlink_ext_ack *extack) 1293 1289 { 1294 1290 struct ethtool_link_ksettings ecmd; 1295 1291 int speed = SPEED_10; ··· 1306 1300 1307 1301 skip: 1308 1302 picos_per_byte = (USEC_PER_SEC * 8) / speed; 1303 + if (picos_per_byte < TAPRIO_PICOS_PER_BYTE_MIN) { 1304 + if (!extack) 1305 + pr_warn("Link speed %d is too high. Schedule may be inaccurate.\n", 1306 + speed); 1307 + NL_SET_ERR_MSG_FMT_MOD(extack, 1308 + "Link speed %d is too high. Schedule may be inaccurate.", 1309 + speed); 1310 + picos_per_byte = TAPRIO_PICOS_PER_BYTE_MIN; 1311 + } 1309 1312 1310 1313 atomic64_set(&q->picos_per_byte, picos_per_byte); 1311 1314 netdev_dbg(dev, "taprio: set %s's picos_per_byte to: %lld, linkspeed: %d\n", ··· 1339 1324 if (dev != qdisc_dev(q->root)) 1340 1325 continue; 1341 1326 1342 - taprio_set_picos_per_byte(dev, q); 1327 + taprio_set_picos_per_byte(dev, q, NULL); 1343 1328 1344 1329 stab = rtnl_dereference(q->root->stab); 1345 1330 ··· 1859 1844 q->flags = taprio_flags; 1860 1845 1861 1846 /* Needed for length_to_duration() during netlink attribute parsing */ 1862 - taprio_set_picos_per_byte(dev, q); 1847 + taprio_set_picos_per_byte(dev, q, extack); 1863 1848 1864 1849 err = taprio_parse_mqprio_opt(dev, mqprio, extack, q->flags); 1865 1850 if (err < 0)