Linux qdiscs clamp quantum paths that let namespaces soft-lock the host

Jamal Hadi Salim has posted a nine-part series that hardens several Linux traffic-control qdiscs against a local denial-of-service that earlier quantum bounds left open.

Earlier work clamped quantum values only on the create path for fair-queueing family schedulers. The same CAP_NET_ADMIN caller inside a user namespace could still run tc qdisc change with a quantum of 1, paired with a crafted size table that inflates reported packet length into the gigabyte range. The deficit-refill loop then spun on the order of 2^31 times while holding the qdisc lock, producing a soft lockup.

The new patches apply matching floors and ceilings on the change paths for fq, fq_pie, sfq, hhf, drr, and ets, and they clamp psched_mtu-derived values in dualpi2 and pie, two schedulers the original series never touched. Typical bounds land quantum in the 256 to 1 MiB range so tiny or overflowing values can no longer drive unbounded refill loops. Each fix carries its own Fixes tag so stable trees can take them independently.

The issue was reported by Vega. Toke Høiland-Jørgensen reviewed the series; Victor Nogueira tested it. A selftest for ets offload quanta was updated so it expects the clamped values rather than the old wrap-around inputs.

Anyone who can configure qdiscs in a namespace, a common container and cloud pattern, could previously force host scheduler stalls this way. Closing the change-path and missed-qdisc gaps removes that residual lever without changing normal fair-queue behaviour for sane quanta.