Kernel clamps qdisc quantum to stop lockups from huge MTUs

Jamal Hadi Salim has posted a fix for integer overflows in five Linux traffic-control qdiscs that could soft-lock the kernel or trigger a NULL pointer dereference when given an extremely large MTU or a crafted packet-size table.

The fair queue (fq), fq_codel, fq_pie, heavy-hitter filter (hhf), and stochastic fair queueing (sfq) schedulers all derive a per-flow quantum from the device MTU without an overflow or zero clamp. A huge MTU can wrap that value into the sign bit or to zero, so credit-refill and deficit loops in dequeue never terminate. In fq_codel, accumulating inflated packet lengths into a 32-bit per-flow backlog can wrap the counter to zero; the drop path then picks an empty flow and dereferences NULL. Unbounded quantum settings at change time create the same class of failure.

Reports and proof-of-concept triggers came from vega@nebusec.ai. Reproducing the bugs needs CAP_NET_ADMIN in a user namespace to configure the qdisc and MTU (for example on a dummy device that accepts a large MTU), so the practical impact is local denial of service, not remote code execution.

The fix clamps quantum to a sane range in the init and change paths only, adding no cost on the packet fast path. Eric Dumazet reviewed the change on the netdev list; Salim, the net/sched maintainer, is shipping it as one patch unless others insist on splitting by qdisc.