public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
* [Patch net 00/12] net_sched: make ->qlen_notify() idempotent
@ 2025-03-20 23:21 Cong Wang
  2025-03-20 23:25 ` [Patch net 01/12] sch_htb: make htb_qlen_notify() idempotent Cong Wang
  0 siblings, 1 reply; 20+ messages in thread
From: Cong Wang @ 2025-03-20 23:21 UTC (permalink / raw)
  To: netdev; +Cc: jhs, jiri, edumazet, gerrard.tai, Cong Wang

Gerrard reported a vulnerability exists in fq_codel where manipulating
the MTU can cause codel_dequeue() to drop all packets. The parent qdisc's
sch->q.qlen is only updated via ->qlen_notify() if the fq_codel queue
remains non-empty after the drops. This discrepancy in qlen between
fq_codel and its parent can lead to a use-after-free condition.

Let's fix this by making all existing ->qlen_notify() idempotent so that
the sch->q.qlen check is no longer necessary.

Patch 1~5 make all existing ->qlen_notify() idempotent to prepare for
patch 6 which removes the sch->q.qlen check. They are followed by 6
selftests for each type of Qdisc's we touch here.

All existing and new Qdisc selftests pass after this patchset.

Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")

---
Cong Wang (12):
  sch_htb: make htb_qlen_notify() idempotent
  sch_drr: make drr_qlen_notify() idempotent
  sch_hfsc: make hfsc_qlen_notify() idempotent
  sch_qfq: make qfq_qlen_notify() idempotent
  sch_ets: make est_qlen_notify() idempotent
  codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  selftests/tc-testing: Add a test case for FQ_CODEL with HTB parent
  selftests/tc-testing: Add a test case for CODEL with HTB parent
  selftests/tc-testing: Add a test case for FQ_CODEL with QFQ parent
  selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent
  selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent
  selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

 net/sched/sch_codel.c                         |   5 +-
 net/sched/sch_drr.c                           |   7 +-
 net/sched/sch_ets.c                           |   8 +-
 net/sched/sch_fq_codel.c                      |   6 +-
 net/sched/sch_hfsc.c                          |   8 +-
 net/sched/sch_htb.c                           |   2 +
 net/sched/sch_qfq.c                           |   7 +-
 .../tc-testing/tc-tests/infra/qdiscs.json     | 188 +++++++++++++++++-
 8 files changed, 211 insertions(+), 20 deletions(-)

-- 
2.34.1


^ permalink raw reply	[flat|nested] 20+ messages in thread

end of thread, other threads:[~2025-04-03 19:33 UTC | newest]

Thread overview: 20+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-20 23:21 [Patch net 00/12] net_sched: make ->qlen_notify() idempotent Cong Wang
2025-03-20 23:25 ` [Patch net 01/12] sch_htb: make htb_qlen_notify() idempotent Cong Wang
2025-03-20 23:25   ` [Patch net 02/12] sch_drr: make drr_qlen_notify() idempotent Cong Wang
2025-03-20 23:25   ` [Patch net 03/12] sch_hfsc: make hfsc_qlen_notify() idempotent Cong Wang
2025-03-20 23:25   ` [Patch net 04/12] sch_qfq: make qfq_qlen_notify() idempotent Cong Wang
2025-03-20 23:25   ` [Patch net 05/12] sch_ets: make est_qlen_notify() idempotent Cong Wang
2025-03-20 23:25   ` [Patch net 06/12] codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() Cong Wang
2025-03-20 23:25   ` [Patch net 07/12] selftests/tc-testing: Add a test case for FQ_CODEL with HTB parent Cong Wang
2025-03-20 23:25   ` [Patch net 08/12] selftests/tc-testing: Add a test case for CODEL " Cong Wang
2025-03-23 22:48     ` Victor Nogueira
2025-03-28 20:35       ` Cong Wang
2025-03-30 21:05         ` Victor Nogueira
2025-03-30 23:32           ` Cong Wang
2025-04-03  0:40             ` Cong Wang
2025-04-03  1:23               ` Victor Nogueira
2025-04-03 19:32                 ` Cong Wang
2025-03-20 23:25   ` [Patch net 09/12] selftests/tc-testing: Add a test case for FQ_CODEL with QFQ parent Cong Wang
2025-03-20 23:25   ` [Patch net 10/12] selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent Cong Wang
2025-03-20 23:25   ` [Patch net 11/12] selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent Cong Wang
2025-03-20 23:25   ` [Patch net 12/12] selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent Cong Wang

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox