Commit a469feed authored Apr 23, 2026 by Weiming Shi Committed by Jakub Kicinski Apr 27, 2026

selftests/tc-testing: add taprio test for class dump after child delete



Add a regression test for the NULL pointer dereference fixed in the
previous commit. Before the fix, taprio_graft() stored NULL into
q->qdiscs[cl - 1] when an explicitly grafted child qdisc was deleted
via RTM_DELQDISC; the next RTM_GETTCLASS dump then crashed the kernel
in taprio_dump_class() while reading child->handle.

The test installs a taprio root qdisc on a multi-queue netdevsim
device, grafts a pfifo child onto class 8001:1, deletes that child,
and then performs a class dump. On a fixed kernel the dump succeeds
and all eight taprio classes are listed; on an unpatched kernel the
class dump crashes, which surfaces as a test failure.

Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260422161958.2517539-4-bestswngs@gmail.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent 3d07ca5c

tools/testing/selftests/tc-testing/tc-tests/qdiscs/taprio.json

+26 −0

Original line number	Diff line number	Diff line
		@@ -302,5 +302,31 @@
		"$TC qdisc del dev $ETH root",
		"echo \"1\" > /sys/bus/netdevsim/del_device"
		]
		},
		{
		"id": "c7e1",
		"name": "Class dump after graft and delete of explicit child qdisc",
		"category": [
		"qdisc",
		"taprio"
		],
		"plugins": {
		"requires": "nsPlugin"
		},
		"setup": [
		"echo \"1 1 8\" > /sys/bus/netdevsim/new_device",
		"$TC qdisc replace dev $ETH handle 8001: parent root taprio num_tc 8 map 0 1 2 3 4 5 6 7 queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 sched-entry S ff 20000000 clockid CLOCK_TAI",
		"$TC qdisc add dev $ETH parent 8001:1 handle 8002: pfifo",
		"$TC qdisc del dev $ETH parent 8001:1 handle 8002:"
		],
		"cmdUnderTest": "$TC class show dev $ETH",
		"expExitCode": "0",
		"verifyCmd": "$TC class show dev $ETH",
		"matchPattern": "class taprio 8001:[0-9]+ root",
		"matchCount": "8",
		"teardown": [
		"$TC qdisc del dev $ETH root",
		"echo \"1\" > /sys/bus/netdevsim/del_device"
		]
		}
		]