Commit 5d17af9e authored Mar 26, 2026 by Xiang Mei Committed by Jakub Kicinski Mar 27, 2026

selftests/tc-testing: add test for HFSC divide-by-zero in rtsc_min()



Add a regression test for the divide-by-zero in rtsc_min() triggered
when m2sm() converts a large m1 value (e.g. 32gbit) to a u64 scaled
slope reaching 2^32. rtsc_min() stores the difference of two such u64
values (sm1 - sm2) in a u32 variable `dsm`, truncating 2^32 to zero
and causing a divide-by-zero oops in the concave-curve intersection
path. The test configures an HFSC class with m1=32gbit d=1ms m2=0bit,
sends a packet to activate the class, waits for it to drain and go
idle, then sends another packet to trigger reactivation through
rtsc_min().

Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260326204310.1549327-2-xmei5@asu.edu


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent 4576100b

tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json

+25 −0

Original line number	Diff line number	Diff line
		@@ -1111,5 +1111,30 @@
		"teardown": [
		"$TC qdisc del dev $DUMMY root handle 1:"
		]
		},
		{
		"id": "a3d7",
		"name": "HFSC with large m1 - no divide-by-zero on class reactivation",
		"category": [
		"qdisc",
		"hfsc"
		],
		"plugins": {
		"requires": "nsPlugin"
		},
		"setup": [
		"$TC qdisc replace dev $DUMMY root handle 1: hfsc default 1",
		"$TC class replace dev $DUMMY parent 1: classid 1:1 hfsc rt m1 32gbit d 1ms m2 0bit ls m1 32gbit d 1ms m2 0bit",
		"ping -I$DUMMY -f -c1 -s64 -W1 10.10.10.1 \|\| true",
		"sleep 1"
		],
		"cmdUnderTest": "ping -I$DUMMY -f -c1 -s64 -W1 10.10.10.1 \|\| true",
		"expExitCode": "0",
		"verifyCmd": "$TC qdisc show dev $DUMMY",
		"matchPattern": "qdisc hfsc 1: root",
		"matchCount": "1",
		"teardown": [
		"$TC qdisc del dev $DUMMY handle 1: root"
		]
		}
		]