[Patch net 00/12] net_sched: make ->qlen_notify() idempotent

Cong Wang
2025-03-20T23:22:17Z

Gerrard reported a vulnerability exists in fq_codel where manipulating
the MTU can cause codel_dequeue() to drop all packets. The parent qdisc's
sch->q.qlen is only updated via ->qlen_notify() if the fq_codel queue
remains non-empty after the drops. This discrepancy in qlen between
fq_codel and its parent can lead to a use-after-free condition.

Let's fix this by making all existing ->qlen_notify() idempotent so that
the sch->q.qlen check is no longer necessary.

Patch 1~5 make all existing ->qlen_notify() idempotent to prepare for
patch 6 which removes the sch->q.qlen check. They are followed by 6
selftests for each type of Qdisc's we touch here.

All existing and new Qdisc selftests pass after this patchset.

Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")

---
Cong Wang (12):
sch_htb: make htb_qlen_notify() idempotent
sch_drr: make drr_qlen_notify() idempotent
sch_hfsc: make hfsc_qlen_notify() idempotent
sch_qfq: make qfq_qlen_notify() idempotent
sch_ets: make est_qlen_notify() idempotent
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
selftests/tc-testing: Add a test case for FQ_CODEL with HTB parent
selftests/tc-testing: Add a test case for CODEL with HTB parent
selftests/tc-testing: Add a test case for FQ_CODEL with QFQ parent
selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent
selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent
selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

net/sched/sch_codel.c | 5 +-
net/sched/sch_drr.c | 7 +-
net/sched/sch_ets.c | 8 +-
net/sched/sch_fq_codel.c | 6 +-
net/sched/sch_hfsc.c | 8 +-
net/sched/sch_htb.c | 2 +
net/sched/sch_qfq.c | 7 +-
.../tc-testing/tc-tests/infra/qdiscs.json | 188 +++++++++++++++++-
8 files changed, 211 insertions(+), 20 deletions(-)

--
2.34.1