Patch "net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-sched-sch_netem-fix-arithmetic-in-netem_dump-for.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 25bd214c1b949ad1911561aff474c9a01690bae0
Author: Peilin Ye <peilin.ye@xxxxxxxxxxxxx>
Date:   Thu Jun 16 16:43:36 2022 -0700

    net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
    
    [ Upstream commit a2b1a5d40bd12b44322c2ccd40bb0ec1699708b6 ]
    
    As reported by Yuming, currently tc always show a latency of UINT_MAX
    for netem Qdisc's on 32-bit platforms:
    
        $ tc qdisc add dev dummy0 root netem latency 100ms
        $ tc qdisc show dev dummy0
        qdisc netem 8001: root refcnt 2 limit 1000 delay 275s  275s
                                                   ^^^^^^^^^^^^^^^^
    
    Let us take a closer look at netem_dump():
    
            qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency,
                                 UINT_MAX);
    
    qopt.latency is __u32, psched_tdiff_t is signed long,
    (psched_tdiff_t)(UINT_MAX) is negative for 32-bit platforms, so
    qopt.latency is always UINT_MAX.
    
    Fix it by using psched_time_t (u64) instead.
    
    Note: confusingly, users have two ways to specify 'latency':
    
      1. normally, via '__u32 latency' in struct tc_netem_qopt;
      2. via the TCA_NETEM_LATENCY64 attribute, which is s64.
    
    For the second case, theoretically 'latency' could be negative.  This
    patch ignores that corner case, since it is broken (i.e. assigning a
    negative s64 to __u32) anyways, and should be handled separately.
    
    Thanks Ted Lin for the analysis [1] .
    
    [1] https://github.com/raspberrypi/linux/issues/3512
    
    Reported-by: Yuming Chen <chenyuming.junnan@xxxxxxxxxxxxx>
    Fixes: 112f9cb65643 ("netem: convert to qdisc_watchdog_schedule_ns")
    Reviewed-by: Cong Wang <cong.wang@xxxxxxxxxxxxx>
    Signed-off-by: Peilin Ye <peilin.ye@xxxxxxxxxxxxx>
    Acked-by: Stephen Hemminger <stephen@xxxxxxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20220616234336.2443-1-yepeilin.cs@xxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 0c345e43a09a..adc5407fd5d5 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -1146,9 +1146,9 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
 	struct tc_netem_rate rate;
 	struct tc_netem_slot slot;
 
-	qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency),
+	qopt.latency = min_t(psched_time_t, PSCHED_NS2TICKS(q->latency),
 			     UINT_MAX);
-	qopt.jitter = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->jitter),
+	qopt.jitter = min_t(psched_time_t, PSCHED_NS2TICKS(q->jitter),
 			    UINT_MAX);
 	qopt.limit = q->limit;
 	qopt.loss = q->loss;