Commit 02b71dc1 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'net_sched-two-security-bug-fixes-and-test-cases' 

Cong Wang says:

====================
net_sched: two security bug fixes and test cases

This patchset contains two bug fixes reported in security mailing list,
and test cases for both of them.
====================

Link: https://patch.msgid.link/20250204005841.223511-1-xiyou.wangcong@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 5368a673 91aadc16

net/sched/sch_fifo.c

+3 −0
Original line number Diff line number Diff line
@@ -40,6 +40,9 @@ static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch, 
{

	unsigned int prev_backlog;



	if (unlikely(READ_ONCE(sch->limit) == 0))

		return qdisc_drop(skb, sch, to_free);



	if (likely(sch->q.qlen < READ_ONCE(sch->limit)))

		return qdisc_enqueue_tail(skb, sch);

net/sched/sch_netem.c

+1 −1
Original line number Diff line number Diff line
@@ -749,9 +749,9 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) 
				if (err != NET_XMIT_SUCCESS) {

					if (net_xmit_drop_count(err))

						qdisc_qstats_drop(sch);

					qdisc_tree_reduce_backlog(sch, 1, pkt_len);

					sch->qstats.backlog -= pkt_len;

					sch->q.qlen--;

					qdisc_tree_reduce_backlog(sch, 1, pkt_len);

				}

				goto tfifo_dequeue;

			}

tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json

+33 −1
Original line number Diff line number Diff line
@@ -94,5 +94,37 @@ 
            "$TC qdisc del dev $DUMMY ingress",

            "$IP addr del 10.10.10.10/24 dev $DUMMY"

        ]

    },

    {

	"id": "a4b9",

	"name": "Test class qlen notification",

	"category": [

	    "qdisc"

	],

	"plugins": {

	    "requires": "nsPlugin"

	},

	"setup": [

            "$IP link set dev $DUMMY up || true",

            "$IP addr add 10.10.10.10/24 dev $DUMMY || true",

            "$TC qdisc add dev $DUMMY root handle 1: drr",

            "$TC filter add dev $DUMMY parent 1: basic classid 1:1",

            "$TC class add dev $DUMMY parent 1: classid 1:1 drr",

            "$TC qdisc add dev $DUMMY parent 1:1 handle 2: netem",

            "$TC qdisc add dev $DUMMY parent 2: handle 3: drr",

            "$TC filter add dev $DUMMY parent 3: basic action drop",

            "$TC class add dev $DUMMY parent 3: classid 3:1 drr",

            "$TC class del dev $DUMMY classid 1:1",

            "$TC class add dev $DUMMY parent 1: classid 1:1 drr"

        ],

        "cmdUnderTest": "ping -c1 -W0.01 -I $DUMMY 10.10.10.1",

        "expExitCode": "1",

        "verifyCmd": "$TC qdisc ls dev $DUMMY",

        "matchPattern": "drr 1: root",

        "matchCount": "1",

        "teardown": [

            "$TC qdisc del dev $DUMMY root handle 1: drr",

            "$IP addr del 10.10.10.10/24 dev $DUMMY"

        ]

   }

]

tools/testing/selftests/tc-testing/tc-tests/qdiscs/fifo.json

+23 −0
Original line number Diff line number Diff line
@@ -314,5 +314,28 @@ 
        "matchCount": "0",

        "teardown": [

	]

    },

    {

        "id": "d774",

        "name": "Check pfifo_head_drop qdisc enqueue behaviour when limit == 0",

        "category": [

            "qdisc",

            "pfifo_head_drop"

        ],

        "plugins": {

            "requires": "nsPlugin"

        },

        "setup": [

            "$IP addr add 10.10.10.10/24 dev $DUMMY || true",

            "$TC qdisc add dev $DUMMY root handle 1: pfifo_head_drop limit 0",

            "$IP link set dev $DUMMY up || true"

        ],

        "cmdUnderTest": "ping -c2 -W0.01 -I $DUMMY 10.10.10.1",

        "expExitCode": "1",

        "verifyCmd": "$TC -s qdisc show dev $DUMMY",

        "matchPattern": "dropped 2",

        "matchCount": "1",

        "teardown": [

        ]

    }

]