🛡️ CVE-2025-21647 — kernel

sched: sch_cake: add bounds checks to host bulk flow fairness counts

In the Linux kernel, the following vulnerability has been resolved:

sched: sch_cake: add bounds checks to host bulk flow fairness counts

Even though we fixed a logic error in the commit cited below, syzbot

still managed to trigger an underflow of the per-host bulk flow

counters, leading to an out of bounds memory access.

To avoid any such logic errors causing out of bounds memory accesses,

this commit factors out all accesses to the per-host bulk flow counters

to a series of helpers that perform bounds-checking before any

increments and decrements. This also has the benefit of improving

readability by moving the conditional checks for the flow mode into

these helpers, instead of having them spread out throughout the

code (which was the cause of the original logic error).

As part of this change, the flow quantum calculation is consolidated

into a helper function, which means that the dithering applied to the

ost load scaling is now applied both in the DRR rotation and when a

sparse flow's quantum is first initiated. The only user-visible effect

of this is that the maximum packet size that can be sent while a flow

stays sparse will now vary with +/- one byte in some cases. This should

not make a noticeable difference in practice, and thus it's not worth

complicating the code to preserve the old behaviour.