mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-15 21:21:49 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/tc-testing: Add QFQ/CBS qlen underflow test

Browse Source 
Since CBS was not calling reset for its child qdisc, there are scenarios
where it could cause an underflow on its parent's qlen/backlog. When the
parent is QFQ, a null-ptr deref could occur.

Add a test case that reproduces the underflow followed by a null-ptr
deref scenario.

Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Victor Nogueira
2026-05-11 14:30:58 -04:00
committed by Jakub Kicinski
parent 320fb29ea2
commit 59afae2008
1 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
View File

@@ -1284,5 +1284,46 @@
"teardown": [
"$TC qdisc del dev $DUMMY handle 1: root"
]
},
{
"id": "3a62",
"name": "Try to create a qlen underflow with QFQ/CBS",
"category": [
"qdisc",
"qfq",
"cbs"
],
"plugins": {
"requires": "nsPlugin"
},
"setup": [
"$IP link set dev $DUMMY up || true",
"$IP addr add 10.10.10.10/24 dev $DUMMY || true",
"$TC qdisc add dev $DUMMY root handle 1: qfq",
"$TC class add dev $DUMMY classid 1:1 parent 1: qfq",
"$TC class add dev $DUMMY classid 1:2 parent 1: qfq",
"$TC qdisc add dev $DUMMY handle 2: parent 1:1 cbs",
"$TC qdisc add dev $DUMMY handle 3: parent 2: netem delay 5000000000",
"$TC filter add dev $DUMMY parent 1: prio 1 u32 match ip dst 10.10.10.1 classid 1:1 action ok",
"$TC filter add dev $DUMMY parent 1: prio 2 u32 match ip dst 10.10.10.2 classid 1:2 action ok",
"ping -c 1 10.10.10.1 -W0.01 -I$DUMMY || true",
"$IP l set $DUMMY down",
"$IP l set $DUMMY up",
"$TC qdisc replace dev $DUMMY handle 4: parent 2: pfifo"
],
"cmdUnderTest": "ping -c 1 10.10.10.2 -W0.01 -I$DUMMY",
"expExitCode": "1",
"verifyCmd": "$TC -s -j qdisc ls dev $DUMMY parent 1:1",
"matchJSON": [
{
"kind": "cbs",
"handle": "2:",
"bytes": 0,
"packets": 0
}
],
"teardown": [
"$TC qdisc del dev $DUMMY handle 1: root"
]
}
]