Kernel clamps qdisc quantum paths that let admins soft-lock hosts

Linux networking maintainers are closing a hole in eight packet schedulers where a namespace admin could still force the kernel into a long spin under the qdisc lock, soft-locking the host.

Jamal Hadi Salim posted the fix series on the netdev list. It follows earlier work that bounded quantum values on the Fair Queue family at creation time. Those bounds did not apply when the same parameters were rewritten afterward with tc qdisc change. A holder of CAP_NET_ADMIN inside a user namespace could therefore put the tiny quantum back, pair it with a crafted size table that inflates reported packet length toward roughly 2 GiB, and drive the deficit-refill loop through on the order of two billion iterations while holding the lock.

The same pattern, and in some cases no clamp at all on MTU-derived values, affected Fair Queue, FQ-PIE, SFQ, Heavy-Hitter Filter, DualPI2, PIE, DRR, and ETS. DualPI2 and PIE had been missed entirely by the earlier round; unclamped MTU math there could also overflow signed calculations or zero out AQM drop probability. Salim split the work into one patch per qdisc, each carrying its own Fixes tag, so stable trees can take them independently where the original commits landed at different points.

The issue was reported by vega@nebusec.ai. Reproduction needs only a local net admin capability and a size table; no remote packet flood is required. Once merged and backported, change-time quantum and MTU-derived defaults are forced into the same safe band the init paths already used, blocking the lock-spin DoS without removing legitimate scheduler tuning.