kernel/linux.git/net/shaper, branch v7.2-rc1

net: shaper: add a note that we expect cap dumps to be tiny

2026-06-11T10:55:23+00:00

Various AI scan tools may complain that we don't support resuming the cap dump. This is true, but the cap dumps are tiny. net_shaper_nl_cap_pre_dumpit() sets up the dump for just one device, so the size of the dump scales with NET_SHAPER_SCOPE_MAX (3). We don't expect them to ever need more than a 4kB page. Document this. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260609183224.1108521-5-kuba@kernel.org Signed-off-by: Paolo Abeni

net: shaper: add a comment why we don't need kfree_rcu() in flush

2026-06-11T10:55:23+00:00

We keep getting misguided patches to fix the flush. Add a comment. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260609183224.1108521-4-kuba@kernel.org Signed-off-by: Paolo Abeni

net: shaper: drop unnecessary kfree_rcu in pre_insert

2026-06-11T10:55:23+00:00

If we fail to insert a node into the XArray in net_shaper_pre_insert() we can free it directly - it was never visible to the RCU readers. Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260609183224.1108521-3-kuba@kernel.org Signed-off-by: Paolo Abeni

net: shaper: drop redundant xa_lock() bracketing

2026-06-11T10:55:23+00:00

The shaper insertion and update code takes xa_lock() explicitly. Paolo explained that the locking was purely to avoid re-taking the lock in loops. But it may be mis-read as if it was expecting readers to be fenced off by xa_lock. Readers of XArray are purely under RCU. Remove explicit taking of xa_lock(). All writers to hierarchy->shapers are serialized by the netdev instance lock (or run after netdev is made inaccessible to readers). Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260609183224.1108521-2-kuba@kernel.org Signed-off-by: Paolo Abeni

net: shaper: rework the VALID marking (again)

2026-05-20T23:34:20+00:00

Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing a VALID mark for a slot, getting interrupted, writer replacing the entry with a different one, reader continuing, fetching the entry which is now a different pointer than the pointer for which VALID was meant. The biggest consequence of this is that we may see a UAF since net_shaper_rollback() assumed that entries without VALID can be freed without observing RCU. Looks like the XArray marks are buying us nothing at this point. Let's convert the code to an explicit valid field. The smp_load_acquire() / smp_store_release() barriers are marginally cleaner. Reported-by: Sashiko Fixes: 93954b40f6a4 ("net-shapers: implement NL set and delete operations") Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260515221325.1685455-3-kuba@kernel.org Signed-off-by: Jakub Kicinski

net: shaper: annotate the data races

2026-05-20T23:34:20+00:00

As previously discussed we don't care about making the shaper state fully RCU-compliant because the hierarchy itself can't be dumped in one go over Netlink. Let's annotate the reads and writes to make that clear. The field-by-field assignments will also be useful for the next commit which adds explicit "valid" field (which we don't want to override with the current full struct assignment). Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260515221325.1685455-2-kuba@kernel.org Signed-off-by: Jakub Kicinski

net: shaper: reject QUEUE scope handle with missing id

2026-05-12T14:15:00+00:00

net_shaper_parse_handle() does not enforce that the user provides the handle ID. For NODE the ID defaults to UNSPEC for all other cases it defaults to 0. For NETDEV 0 is the only option. For QUEUE defaulting to 0 makes less intuitive sense. Specifically because the behavior should (IMHO) be the same for all cases where there may be more than one ID (QUEUE and NODE). We should either document this as intentional or reject. I picked the latter with no strong conviction. Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-11-kuba@kernel.org Signed-off-by: Paolo Abeni

net: shaper: enforce singleton NETDEV scope with id 0

2026-05-12T14:15:00+00:00

The NETDEV scope represents a singleton root shaper in the per-device hierarchy. All code assumes NETDEV shapers have id 0: net_shaper_default_parent() hardcodes parent->id = 0 when returning the NETDEV parent for QUEUE/NODE children, and the UAPI documentation describes NETDEV scope as "the main shaper" (singular, not plural). Make sure we reject non-0 IDs. Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-10-kuba@kernel.org Signed-off-by: Paolo Abeni

net: shaper: reject handle IDs exceeding internal bit-width

2026-05-12T14:15:00+00:00

net_shaper_parse_handle() reads the user-supplied handle ID via nla_get_u32(), accepting the full u32 range. However, the xarray key is built by net_shaper_handle_to_index() using FIELD_PREP(NET_SHAPER_ID_MASK, handle->id), where NET_SHAPER_ID_MASK is GENMASK(25, 0) - only 26 bits wide. FIELD_PREP silently masks off the upper bits at runtime. A user-supplied NODE id like 0x04000123 becomes id 0x123. Additionally, a user-supplied id equal to NET_SHAPER_ID_UNSPEC (0x03FFFFFF, which is NET_SHAPER_ID_MASK itself) would collide with the sentinel used internally by the group operation to signal "allocate a new NODE id". Reject user-supplied IDs >= NET_SHAPER_ID_MASK (i.e., >= 0x03FFFFFF) in the policy. Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-9-kuba@kernel.org Signed-off-by: Paolo Abeni

net: shaper: fix undersized reply skb allocation in GROUP command

2026-05-12T14:14:59+00:00

net_shaper_group_send_reply() writes both the NET_SHAPER_A_IFINDEX attribute (via net_shaper_fill_binding()) and the nested NET_SHAPER_A_HANDLE attribute (via net_shaper_fill_handle()), but the reply skb at the call site in net_shaper_nl_group_doit() is allocated using net_shaper_handle_size(), which only accounts for the nested handle. The allocation is therefore short by nla_total_size(sizeof(u32)) (8 bytes) for the IFINDEX attribute. In practice the slab allocator rounds up the small allocation so the bug is latent, but the size accounting is wrong and could bite if the reply grew further. Introduce net_shaper_group_reply_size() that accounts for the full reply payload and use it both at the genlmsg_new() call site and in the defensive WARN_ONCE message. Fixes: 5d5d4700e75d ("net-shapers: implement NL group operation") Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20260510192904.3987113-7-kuba@kernel.org Signed-off-by: Paolo Abeni