Commit 59afae20 authored by Victor Nogueira's avatar Victor Nogueira Committed by Jakub Kicinski
Browse files

selftests/tc-testing: Add QFQ/CBS qlen underflow test 



Since CBS was not calling reset for its child qdisc, there are scenarios
where it could cause an underflow on its parent's qlen/backlog. When the
parent is QFQ, a null-ptr deref could occur.

Add a test case that reproduces the underflow followed by a null-ptr
deref scenario.

Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: default avatarVictor Nogueira <victor@mojatatu.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 320fb29e

tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json

+41 −0
Original line number Diff line number Diff line
@@ -1284,5 +1284,46 @@ 
        "teardown": [

            "$TC qdisc del dev $DUMMY handle 1: root"

        ]

    },

    {

        "id": "3a62",

        "name": "Try to create a qlen underflow with QFQ/CBS",

        "category": [

            "qdisc",

            "qfq",

            "cbs"

        ],

        "plugins": {

            "requires": "nsPlugin"

        },

        "setup": [

            "$IP link set dev $DUMMY up || true",

            "$IP addr add 10.10.10.10/24 dev $DUMMY || true",

            "$TC qdisc add dev $DUMMY root handle 1: qfq",

            "$TC class add dev $DUMMY classid 1:1 parent 1: qfq",

            "$TC class add dev $DUMMY classid 1:2 parent 1: qfq",

            "$TC qdisc add dev $DUMMY handle 2: parent 1:1 cbs",

            "$TC qdisc add dev $DUMMY handle 3: parent 2: netem delay 5000000000",

            "$TC filter add dev $DUMMY parent 1: prio 1 u32 match ip dst 10.10.10.1 classid 1:1 action ok",

            "$TC filter add dev $DUMMY parent 1: prio 2 u32 match ip dst 10.10.10.2 classid 1:2 action ok",

            "ping -c 1 10.10.10.1 -W0.01 -I$DUMMY || true",

            "$IP l set $DUMMY down",

            "$IP l set $DUMMY up",

            "$TC qdisc replace dev $DUMMY handle 4: parent 2: pfifo"

        ],

        "cmdUnderTest": "ping -c 1 10.10.10.2 -W0.01 -I$DUMMY",

        "expExitCode": "1",

        "verifyCmd": "$TC -s -j qdisc ls dev $DUMMY parent 1:1",

        "matchJSON": [

            {

                "kind": "cbs",

                "handle": "2:",

                "bytes": 0,

                "packets": 0

            }

        ],

        "teardown": [

            "$TC qdisc del dev $DUMMY handle 1: root"

        ]

    }

]