[Patch net v2 00/11] net_sched: make ->qlen_notify() idempotent

[Patch net v2 00/11] net_sched: make ->qlen_notify() idempotent

[Cong Wang]

Gerrard reported a vulnerability exists in fq_codel where manipulating
the MTU can cause codel_dequeue() to drop all packets. The parent qdisc's
sch->q.qlen is only updated via ->qlen_notify() if the fq_codel queue
remains non-empty after the drops. This discrepancy in qlen between
fq_codel and its parent can lead to a use-after-free condition.

Let's fix this by making all existing ->qlen_notify() idempotent so that
the sch->q.qlen check will be no longer necessary.

Patch 1~5 make all existing ->qlen_notify() idempotent to prepare for
patch 6 which removes the sch->q.qlen check. They are followed by 5
selftests for each type of Qdisc's we touch here.

All existing and new Qdisc selftests pass after this patchset.

Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")

---
v2: drop the unstable CODEL selftest

Cong Wang (11):
  sch_htb: make htb_qlen_notify() idempotent
  sch_drr: make drr_qlen_notify() idempotent
  sch_hfsc: make hfsc_qlen_notify() idempotent
  sch_qfq: make qfq_qlen_notify() idempotent
  sch_ets: make est_qlen_notify() idempotent
  codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  selftests/tc-testing: Add a test case for FQ_CODEL with HTB parent
  selftests/tc-testing: Add a test case for FQ_CODEL with QFQ parent
  selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent
  selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent
  selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

 net/sched/sch_codel.c                         |   5 +-
 net/sched/sch_drr.c                           |   7 +-
 net/sched/sch_ets.c                           |   8 +-
 net/sched/sch_fq_codel.c                      |   6 +-
 net/sched/sch_hfsc.c                          |   8 +-
 net/sched/sch_htb.c                           |   2 +
 net/sched/sch_qfq.c                           |   7 +-
 .../tc-testing/tc-tests/infra/qdiscs.json     | 155 ++++++++++++++++++
 8 files changed, 179 insertions(+), 19 deletions(-)

-- 
2.34.1

[Patch net v2 01/11] sch_htb: make htb_qlen_notify() idempotent

[Cong Wang]

htb_qlen_notify() always deactivates the HTB class and in fact could
trigger a warning if it is already deactivated. Therefore, it is not
idempotent and not friendly to its callers, like fq_codel_dequeue().

Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers'
life.

Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 net/sched/sch_htb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index c31bc5489bdd..4b9a639b642e 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1485,6 +1485,8 @@ static void htb_qlen_notify(struct Qdisc *sch, unsigned long arg)
 {
 	struct htb_class *cl = (struct htb_class *)arg;
 
+	if (!cl->prio_activity)
+		return;
 	htb_deactivate(qdisc_priv(sch), cl);
 }
 
-- 
2.34.1

[Patch net v2 02/11] sch_drr: make drr_qlen_notify() idempotent

[Cong Wang]

drr_qlen_notify() always deletes the DRR class from its active list
with list_del(), therefore, it is not idempotent and not friendly
to its callers, like fq_codel_dequeue().

Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers'
life. Also change other list_del()'s to list_del_init() just to be
extra safe.

Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 net/sched/sch_drr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index c69b999fae17..e0a81d313aa7 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -105,6 +105,7 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 		return -ENOBUFS;
 
 	gnet_stats_basic_sync_init(&cl->bstats);
+	INIT_LIST_HEAD(&cl->alist);
 	cl->common.classid = classid;
 	cl->quantum	   = quantum;
 	cl->qdisc	   = qdisc_create_dflt(sch->dev_queue,
@@ -229,7 +230,7 @@ static void drr_qlen_notify(struct Qdisc *csh, unsigned long arg)
 {
 	struct drr_class *cl = (struct drr_class *)arg;
 
-	list_del(&cl->alist);
+	list_del_init(&cl->alist);
 }
 
 static int drr_dump_class(struct Qdisc *sch, unsigned long arg,
@@ -390,7 +391,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
 			if (unlikely(skb == NULL))
 				goto out;
 			if (cl->qdisc->q.qlen == 0)
-				list_del(&cl->alist);
+				list_del_init(&cl->alist);
 
 			bstats_update(&cl->bstats, skb);
 			qdisc_bstats_update(sch, skb);
@@ -431,7 +432,7 @@ static void drr_reset_qdisc(struct Qdisc *sch)
 	for (i = 0; i < q->clhash.hashsize; i++) {
 		hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
 			if (cl->qdisc->q.qlen)
-				list_del(&cl->alist);
+				list_del_init(&cl->alist);
 			qdisc_reset(cl->qdisc);
 		}
 	}
-- 
2.34.1

[Patch net v2 03/11] sch_hfsc: make hfsc_qlen_notify() idempotent

[Cong Wang]

hfsc_qlen_notify() is not idempotent either and not friendly
to its callers, like fq_codel_dequeue(). Let's make it idempotent
to ease qdisc_tree_reduce_backlog() callers' life:

1. update_vf() decreases cl->cl_nactive, so we can check whether it is
non-zero before calling it.

2. eltree_remove() always removes RB node cl->el_node, but we can use
   RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.

Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 net/sched/sch_hfsc.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index c287bf8423b4..ce5045eea065 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -203,7 +203,10 @@ eltree_insert(struct hfsc_class *cl)
 static inline void
 eltree_remove(struct hfsc_class *cl)
 {
-	rb_erase(&cl->el_node, &cl->sched->eligible);
+	if (!RB_EMPTY_NODE(&cl->el_node)) {
+		rb_erase(&cl->el_node, &cl->sched->eligible);
+		RB_CLEAR_NODE(&cl->el_node);
+	}
 }
 
 static inline void
@@ -1220,7 +1223,8 @@ hfsc_qlen_notify(struct Qdisc *sch, unsigned long arg)
 	/* vttree is now handled in update_vf() so that update_vf(cl, 0, 0)
 	 * needs to be called explicitly to remove a class from vttree.
 	 */
-	update_vf(cl, 0, 0);
+	if (cl->cl_nactive)
+		update_vf(cl, 0, 0);
 	if (cl->cl_flags & HFSC_RSC)
 		eltree_remove(cl);
 }
-- 
2.34.1

[Patch net v2 04/11] sch_qfq: make qfq_qlen_notify() idempotent

[Cong Wang]

qfq_qlen_notify() always deletes its class from its active list
with list_del_init() _and_ calls qfq_deactivate_agg() when the whole list
becomes empty.

To make it idempotent, just skip everything when it is not in the active
list.

Also change other list_del()'s to list_del_init() just to be extra safe.

Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 net/sched/sch_qfq.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 2cfbc977fe6d..687a932eb9b2 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -347,7 +347,7 @@ static void qfq_deactivate_class(struct qfq_sched *q, struct qfq_class *cl)
 	struct qfq_aggregate *agg = cl->agg;
 
 
-	list_del(&cl->alist); /* remove from RR queue of the aggregate */
+	list_del_init(&cl->alist); /* remove from RR queue of the aggregate */
 	if (list_empty(&agg->active)) /* agg is now inactive */
 		qfq_deactivate_agg(q, agg);
 }
@@ -474,6 +474,7 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 	gnet_stats_basic_sync_init(&cl->bstats);
 	cl->common.classid = classid;
 	cl->deficit = lmax;
+	INIT_LIST_HEAD(&cl->alist);
 
 	cl->qdisc = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
 				      classid, NULL);
@@ -982,7 +983,7 @@ static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg,
 	cl->deficit -= (int) len;
 
 	if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */
-		list_del(&cl->alist);
+		list_del_init(&cl->alist);
 	else if (cl->deficit < qdisc_pkt_len(cl->qdisc->ops->peek(cl->qdisc))) {
 		cl->deficit += agg->lmax;
 		list_move_tail(&cl->alist, &agg->active);
@@ -1415,6 +1416,8 @@ static void qfq_qlen_notify(struct Qdisc *sch, unsigned long arg)
 	struct qfq_sched *q = qdisc_priv(sch);
 	struct qfq_class *cl = (struct qfq_class *)arg;
 
+	if (list_empty(&cl->alist))
+		return;
 	qfq_deactivate_class(q, cl);
 }
 
-- 
2.34.1

[Patch net v2 05/11] sch_ets: make est_qlen_notify() idempotent

[Cong Wang]

est_qlen_notify() deletes its class from its active list with
list_del() when qlen is 0, therefore, it is not idempotent and
not friendly to its callers, like fq_codel_dequeue().

Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers'
life. Also change other list_del()'s to list_del_init() just to be
extra safe.

Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 net/sched/sch_ets.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c
index 516038a44163..c3bdeb14185b 100644
--- a/net/sched/sch_ets.c
+++ b/net/sched/sch_ets.c
@@ -293,7 +293,7 @@ static void ets_class_qlen_notify(struct Qdisc *sch, unsigned long arg)
 	 * to remove them.
 	 */
 	if (!ets_class_is_strict(q, cl) && sch->q.qlen)
-		list_del(&cl->alist);
+		list_del_init(&cl->alist);
 }
 
 static int ets_class_dump(struct Qdisc *sch, unsigned long arg,
@@ -488,7 +488,7 @@ static struct sk_buff *ets_qdisc_dequeue(struct Qdisc *sch)
 			if (unlikely(!skb))
 				goto out;
 			if (cl->qdisc->q.qlen == 0)
-				list_del(&cl->alist);
+				list_del_init(&cl->alist);
 			return ets_qdisc_dequeue_skb(sch, skb);
 		}
 
@@ -657,7 +657,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
 	}
 	for (i = q->nbands; i < oldbands; i++) {
 		if (i >= q->nstrict && q->classes[i].qdisc->q.qlen)
-			list_del(&q->classes[i].alist);
+			list_del_init(&q->classes[i].alist);
 		qdisc_tree_flush_backlog(q->classes[i].qdisc);
 	}
 	WRITE_ONCE(q->nstrict, nstrict);
@@ -713,7 +713,7 @@ static void ets_qdisc_reset(struct Qdisc *sch)
 
 	for (band = q->nstrict; band < q->nbands; band++) {
 		if (q->classes[band].qdisc->q.qlen)
-			list_del(&q->classes[band].alist);
+			list_del_init(&q->classes[band].alist);
 	}
 	for (band = 0; band < q->nbands; band++)
 		qdisc_reset(q->classes[band].qdisc);
-- 
2.34.1

[Patch net v2 06/11] codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()

[Cong Wang]

After making all ->qlen_notify() callbacks idempotent, now it is safe to
remove the check of qlen!=0 from both fq_codel_dequeue() and
codel_qdisc_dequeue().

Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 net/sched/sch_codel.c    | 5 +----
 net/sched/sch_fq_codel.c | 6 ++----
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
index 81189d02fee7..12dd71139da3 100644
--- a/net/sched/sch_codel.c
+++ b/net/sched/sch_codel.c
@@ -65,10 +65,7 @@ static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
 			    &q->stats, qdisc_pkt_len, codel_get_enqueue_time,
 			    drop_func, dequeue_func);
 
-	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
-	 * or HTB crashes. Defer it for next round.
-	 */
-	if (q->stats.drop_count && sch->q.qlen) {
+	if (q->stats.drop_count) {
 		qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
 		q->stats.drop_count = 0;
 		q->stats.drop_len = 0;
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 799f5397ad4c..6c9029f71e88 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -315,10 +315,8 @@ static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
 	}
 	qdisc_bstats_update(sch, skb);
 	flow->deficit -= qdisc_pkt_len(skb);
-	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
-	 * or HTB crashes. Defer it for next round.
-	 */
-	if (q->cstats.drop_count && sch->q.qlen) {
+
+	if (q->cstats.drop_count) {
 		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
 					  q->cstats.drop_len);
 		q->cstats.drop_count = 0;
-- 
2.34.1

[Patch net v2 07/11] selftests/tc-testing: Add a test case for FQ_CODEL with HTB parent

[Cong Wang]

Add a test case for FQ_CODEL with HTB parent to verify packet drop
behavior when the queue becomes empty. This helps ensure proper
notification mechanisms between qdiscs.

Note this is best-effort, it is hard to play with those parameters
perfectly to always trigger ->qlen_notify().

Cc: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
index 25454fd95537..545966b6adc6 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
@@ -158,5 +158,36 @@
             "$TC qdisc del dev $DUMMY handle 1: root",
             "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
         ]
+    },
+    {
+        "id": "a4bb",
+        "name": "Test FQ_CODEL with HTB parent - force packet drop with empty queue",
+        "category": [
+            "qdisc",
+            "fq_codel",
+            "htb"
+        ],
+        "plugins": {
+            "requires": "nsPlugin"
+        },
+        "setup": [
+            "$IP link set dev $DUMMY up || true",
+            "$IP addr add 10.10.10.10/24 dev $DUMMY || true",
+            "$TC qdisc add dev $DUMMY handle 1: root htb default 10",
+            "$TC class add dev $DUMMY parent 1: classid 1:10 htb rate 1kbit",
+            "$TC qdisc add dev $DUMMY parent 1:10 handle 10: fq_codel memory_limit 1 flows 1 target 0.1ms interval 1ms",
+            "$TC filter add dev $DUMMY parent 1: protocol ip prio 1 u32 match ip protocol 1 0xff flowid 1:10",
+            "ping -c 5 -f -I $DUMMY 10.10.10.1 > /dev/null || true",
+            "sleep 0.1"
+        ],
+        "cmdUnderTest": "$TC -s qdisc show dev $DUMMY",
+        "expExitCode": "0",
+        "verifyCmd": "$TC -s qdisc show dev $DUMMY | grep -A 5 'qdisc fq_codel'",
+        "matchPattern": "dropped [1-9][0-9]*",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DUMMY handle 1: root",
+            "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
+        ]
     }
 ]
-- 
2.34.1

[Patch net v2 08/11] selftests/tc-testing: Add a test case for FQ_CODEL with QFQ parent

[Cong Wang]

Add a test case for FQ_CODEL with QFQ parent to verify packet drop
behavior when the queue becomes empty. This helps ensure proper
notification mechanisms between qdiscs.

Note this is best-effort, it is hard to play with those parameters
perfectly to always trigger ->qlen_notify().

Cc: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
index 545966b6adc6..695522b00a3c 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
@@ -189,5 +189,36 @@
             "$TC qdisc del dev $DUMMY handle 1: root",
             "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
         ]
+    },
+    {
+        "id": "a4be",
+        "name": "Test FQ_CODEL with QFQ parent - force packet drop with empty queue",
+        "category": [
+            "qdisc",
+            "fq_codel",
+            "qfq"
+        ],
+        "plugins": {
+            "requires": "nsPlugin"
+        },
+        "setup": [
+            "$IP link set dev $DUMMY up || true",
+            "$IP addr add 10.10.10.10/24 dev $DUMMY || true",
+            "$TC qdisc add dev $DUMMY handle 1: root qfq",
+            "$TC class add dev $DUMMY parent 1: classid 1:10 qfq weight 1 maxpkt 1000",
+            "$TC qdisc add dev $DUMMY parent 1:10 handle 10: fq_codel memory_limit 1 flows 1 target 0.1ms interval 1ms",
+            "$TC filter add dev $DUMMY parent 1: protocol ip prio 1 u32 match ip protocol 1 0xff flowid 1:10",
+            "ping -c 10 -s 1000 -f -I $DUMMY 10.10.10.1 > /dev/null || true",
+            "sleep 0.1"
+        ],
+        "cmdUnderTest": "$TC -s qdisc show dev $DUMMY",
+        "expExitCode": "0",
+        "verifyCmd": "$TC -s qdisc show dev $DUMMY | grep -A 5 'qdisc fq_codel'",
+        "matchPattern": "dropped [1-9][0-9]*",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DUMMY handle 1: root",
+            "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
+        ]
     }
 ]
-- 
2.34.1

[Patch net v2 09/11] selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent

[Cong Wang]

Add a test case for FQ_CODEL with HFSC parent to verify packet drop
behavior when the queue becomes empty. This helps ensure proper
notification mechanisms between qdiscs.

Note this is best-effort, it is hard to play with those parameters
perfectly to always trigger ->qlen_notify().

Cc: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
index 695522b00a3c..0347b207fe6d 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
@@ -220,5 +220,36 @@
             "$TC qdisc del dev $DUMMY handle 1: root",
             "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
         ]
+    },
+    {
+        "id": "a4bf",
+        "name": "Test FQ_CODEL with HFSC parent - force packet drop with empty queue",
+        "category": [
+            "qdisc",
+            "fq_codel",
+            "hfsc"
+        ],
+        "plugins": {
+            "requires": "nsPlugin"
+        },
+        "setup": [
+            "$IP link set dev $DUMMY up || true",
+            "$IP addr add 10.10.10.10/24 dev $DUMMY || true",
+            "$TC qdisc add dev $DUMMY handle 1: root hfsc default 10",
+            "$TC class add dev $DUMMY parent 1: classid 1:10 hfsc sc rate 1kbit ul rate 1kbit",
+            "$TC qdisc add dev $DUMMY parent 1:10 handle 10: fq_codel memory_limit 1 flows 1 target 0.1ms interval 1ms",
+            "$TC filter add dev $DUMMY parent 1: protocol ip prio 1 u32 match ip protocol 1 0xff flowid 1:10",
+            "ping -c 5 -f -I $DUMMY 10.10.10.1 > /dev/null || true",
+            "sleep 0.1"
+        ],
+        "cmdUnderTest": "$TC -s qdisc show dev $DUMMY",
+        "expExitCode": "0",
+        "verifyCmd": "$TC -s qdisc show dev $DUMMY | grep -A 5 'qdisc fq_codel'",
+        "matchPattern": "dropped [1-9][0-9]*",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DUMMY handle 1: root",
+            "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
+        ]
     }
 ]
-- 
2.34.1

[Patch net v2 10/11] selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent

[Cong Wang]

Add a test case for FQ_CODEL with DRR parent to verify packet drop
behavior when the queue becomes empty. This helps ensure proper
notification mechanisms between qdiscs.

Note this is best-effort, it is hard to play with those parameters
perfectly to always trigger ->qlen_notify().

Cc: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
index 0347b207fe6d..4a45fedad876 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
@@ -251,5 +251,36 @@
             "$TC qdisc del dev $DUMMY handle 1: root",
             "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
         ]
+    },
+    {
+        "id": "a4c0",
+        "name": "Test FQ_CODEL with DRR parent - force packet drop with empty queue",
+        "category": [
+            "qdisc",
+            "fq_codel",
+            "drr"
+        ],
+        "plugins": {
+            "requires": "nsPlugin"
+        },
+        "setup": [
+            "$IP link set dev $DUMMY up || true",
+            "$IP addr add 10.10.10.10/24 dev $DUMMY || true",
+            "$TC qdisc add dev $DUMMY handle 1: root drr",
+            "$TC class add dev $DUMMY parent 1: classid 1:10 drr quantum 1500",
+            "$TC qdisc add dev $DUMMY parent 1:10 handle 10: fq_codel memory_limit 1 flows 1 target 0.1ms interval 1ms",
+            "$TC filter add dev $DUMMY parent 1: protocol ip prio 1 u32 match ip protocol 1 0xff flowid 1:10",
+            "ping -c 5 -f -I $DUMMY 10.10.10.1 > /dev/null || true",
+            "sleep 0.1"
+        ],
+        "cmdUnderTest": "$TC -s qdisc show dev $DUMMY",
+        "expExitCode": "0",
+        "verifyCmd": "$TC -s qdisc show dev $DUMMY | grep -A 5 'qdisc fq_codel'",
+        "matchPattern": "dropped [1-9][0-9]*",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DUMMY handle 1: root",
+            "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
+        ]
     }
 ]
-- 
2.34.1

[Patch net v2 11/11] selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

[Cong Wang]

Add a test case for FQ_CODEL with ETS parent to verify packet drop
behavior when the queue becomes empty. This helps ensure proper
notification mechanisms between qdiscs.

Note this is best-effort, it is hard to play with those parameters
perfectly to always trigger ->qlen_notify().

Cc: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
index 4a45fedad876..d4ea9cd845a3 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
@@ -282,5 +282,36 @@
             "$TC qdisc del dev $DUMMY handle 1: root",
             "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
         ]
+    },
+    {
+        "id": "a4c1",
+        "name": "Test FQ_CODEL with ETS parent - force packet drop with empty queue",
+        "category": [
+            "qdisc",
+            "fq_codel",
+            "ets"
+        ],
+        "plugins": {
+            "requires": "nsPlugin"
+        },
+        "setup": [
+            "$IP link set dev $DUMMY up || true",
+            "$IP addr add 10.10.10.10/24 dev $DUMMY || true",
+            "$TC qdisc add dev $DUMMY handle 1: root ets bands 2 strict 1",
+            "$TC class change dev $DUMMY parent 1: classid 1:1 ets",
+            "$TC qdisc add dev $DUMMY parent 1:1 handle 10: fq_codel memory_limit 1 flows 1 target 0.1ms interval 1ms",
+            "$TC filter add dev $DUMMY parent 1: protocol ip prio 1 u32 match ip protocol 1 0xff flowid 1:1",
+            "ping -c 5 -f -I $DUMMY 10.10.10.1 > /dev/null || true",
+            "sleep 0.1"
+        ],
+        "cmdUnderTest": "$TC -s qdisc show dev $DUMMY",
+        "expExitCode": "0",
+        "verifyCmd": "$TC -s qdisc show dev $DUMMY | grep -A 5 'qdisc fq_codel'",
+        "matchPattern": "dropped [1-9][0-9]*",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DUMMY handle 1: root",
+            "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
+        ]
     }
 ]
-- 
2.34.1

Re: [Patch net v2 07/11] selftests/tc-testing: Add a test case for FQ_CODEL with HTB parent

[Victor Nogueira]

On 03/04/2025 18:16, Cong Wang wrote:
> Add a test case for FQ_CODEL with HTB parent to verify packet drop
> behavior when the queue becomes empty. This helps ensure proper
> notification mechanisms between qdiscs.
> 
> Note this is best-effort, it is hard to play with those parameters
> perfectly to always trigger ->qlen_notify().
> 
> Cc: Pedro Tammela <pctammela@mojatatu.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
>   .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
>   1 file changed, 31 insertions(+)

Reviewed-by: Victor Nogueira <victor@mojatatu.com>

Re: [Patch net v2 08/11] selftests/tc-testing: Add a test case for FQ_CODEL with QFQ parent

[Victor Nogueira]

On 03/04/2025 18:16, Cong Wang wrote:
> Add a test case for FQ_CODEL with QFQ parent to verify packet drop
> behavior when the queue becomes empty. This helps ensure proper
> notification mechanisms between qdiscs.
> 
> Note this is best-effort, it is hard to play with those parameters
> perfectly to always trigger ->qlen_notify().
> 
> Cc: Pedro Tammela <pctammela@mojatatu.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
>   .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
>   1 file changed, 31 insertions(+)

Reviewed-by: Victor Nogueira <victor@mojatatu.com>

Re: [Patch net v2 09/11] selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent

[Victor Nogueira]

On 03/04/2025 18:16, Cong Wang wrote:
> Add a test case for FQ_CODEL with HFSC parent to verify packet drop
> behavior when the queue becomes empty. This helps ensure proper
> notification mechanisms between qdiscs.
> 
> Note this is best-effort, it is hard to play with those parameters
> perfectly to always trigger ->qlen_notify().
> 
> Cc: Pedro Tammela <pctammela@mojatatu.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
>   .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
>   1 file changed, 31 insertions(+)

Reviewed-by: Victor Nogueira <victor@mojatatu.com>

Re: [Patch net v2 10/11] selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent

[Victor Nogueira]

On 03/04/2025 18:16, Cong Wang wrote:
> Add a test case for FQ_CODEL with DRR parent to verify packet drop
> behavior when the queue becomes empty. This helps ensure proper
> notification mechanisms between qdiscs.
> 
> Note this is best-effort, it is hard to play with those parameters
> perfectly to always trigger ->qlen_notify().
> 
> Cc: Pedro Tammela <pctammela@mojatatu.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
>   .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
>   1 file changed, 31 insertions(+)

Reviewed-by: Victor Nogueira <victor@mojatatu.com>

Re: [Patch net v2 11/11] selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

[Victor Nogueira]

On 03/04/2025 18:16, Cong Wang wrote:
> Add a test case for FQ_CODEL with ETS parent to verify packet drop
> behavior when the queue becomes empty. This helps ensure proper
> notification mechanisms between qdiscs.
> 
> Note this is best-effort, it is hard to play with those parameters
> perfectly to always trigger ->qlen_notify().
> 
> Cc: Pedro Tammela <pctammela@mojatatu.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
>   .../tc-testing/tc-tests/infra/qdiscs.json     | 31 +++++++++++++++++++
>   1 file changed, 31 insertions(+)

Reviewed-by: Victor Nogueira <victor@mojatatu.com>

Re: [Patch net v2 11/11] selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

[Jakub Kicinski]

On Fri, 4 Apr 2025 13:59:39 -0300 Victor Nogueira wrote:
> On 03/04/2025 18:16, Cong Wang wrote:
> > Add a test case for FQ_CODEL with ETS parent to verify packet drop
> > behavior when the queue becomes empty. This helps ensure proper
> > notification mechanisms between qdiscs.
> > 
> > Note this is best-effort, it is hard to play with those parameters
> > perfectly to always trigger ->qlen_notify().
> > 
> > Cc: Pedro Tammela <pctammela@mojatatu.com>
> > Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
>
> Reviewed-by: Victor Nogueira <victor@mojatatu.com>

Hi!

Any ideas what is causing the IFE failure? Looks like it started
happening when this series landed in the testing tree but I don't
see how it could be related ?

Re: [Patch net v2 11/11] selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

[Victor Nogueira]

On 04/04/2025 15:41, Jakub Kicinski wrote:
> On Fri, 4 Apr 2025 13:59:39 -0300 Victor Nogueira wrote:
>> On 03/04/2025 18:16, Cong Wang wrote:
>>> Add a test case for FQ_CODEL with ETS parent to verify packet drop
>>> behavior when the queue becomes empty. This helps ensure proper
>>> notification mechanisms between qdiscs.
>>>
>>> Note this is best-effort, it is hard to play with those parameters
>>> perfectly to always trigger ->qlen_notify().
>>>
>>> Cc: Pedro Tammela <pctammela@mojatatu.com>
>>> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
>>
>> Reviewed-by: Victor Nogueira <victor@mojatatu.com>
> 
> Hi!
> 
> Any ideas what is causing the IFE failure? Looks like it started
> happening when this series landed in the testing tree but I don't
> see how it could be related ?

Yes, I saw that, but since it succeeded on retry and, as you said,
it doesn't seem to be related to this series, it looks more like
those IFE tests are a bit unstable. I talked to Pedro and we are
taking a look at it.

cheers,
Victor

Re: [Patch net v2 05/11] sch_ets: make est_qlen_notify() idempotent

[Simon Horman]

On Thu, Apr 03, 2025 at 02:10:27PM -0700, Cong Wang wrote:
> est_qlen_notify() deletes its class from its active list with

nit: ets_class_qlen_notify()

> list_del() when qlen is 0, therefore, it is not idempotent and
> not friendly to its callers, like fq_codel_dequeue().
> 
> Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers'
> life. Also change other list_del()'s to list_del_init() just to be
> extra safe.
> 
> Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
>  net/sched/sch_ets.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c
> index 516038a44163..c3bdeb14185b 100644
> --- a/net/sched/sch_ets.c
> +++ b/net/sched/sch_ets.c
> @@ -293,7 +293,7 @@ static void ets_class_qlen_notify(struct Qdisc *sch, unsigned long arg)
>  	 * to remove them.
>  	 */
>  	if (!ets_class_is_strict(q, cl) && sch->q.qlen)
> -		list_del(&cl->alist);
> +		list_del_init(&cl->alist);
>  }
>  
>  static int ets_class_dump(struct Qdisc *sch, unsigned long arg,
> @@ -488,7 +488,7 @@ static struct sk_buff *ets_qdisc_dequeue(struct Qdisc *sch)
>  			if (unlikely(!skb))
>  				goto out;
>  			if (cl->qdisc->q.qlen == 0)
> -				list_del(&cl->alist);
> +				list_del_init(&cl->alist);
>  			return ets_qdisc_dequeue_skb(sch, skb);
>  		}
>  
> @@ -657,7 +657,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
>  	}
>  	for (i = q->nbands; i < oldbands; i++) {
>  		if (i >= q->nstrict && q->classes[i].qdisc->q.qlen)
> -			list_del(&q->classes[i].alist);
> +			list_del_init(&q->classes[i].alist);
>  		qdisc_tree_flush_backlog(q->classes[i].qdisc);
>  	}
>  	WRITE_ONCE(q->nstrict, nstrict);
> @@ -713,7 +713,7 @@ static void ets_qdisc_reset(struct Qdisc *sch)
>  
>  	for (band = q->nstrict; band < q->nbands; band++) {
>  		if (q->classes[band].qdisc->q.qlen)
> -			list_del(&q->classes[band].alist);
> +			list_del_init(&q->classes[band].alist);
>  	}
>  	for (band = 0; band < q->nbands; band++)
>  		qdisc_reset(q->classes[band].qdisc);
> -- 
> 2.34.1
> 
> 

Re: [Patch net v2 01/11] sch_htb: make htb_qlen_notify() idempotent

[Simon Horman]

On Thu, Apr 03, 2025 at 02:10:23PM -0700, Cong Wang wrote:
> htb_qlen_notify() always deactivates the HTB class and in fact could
> trigger a warning if it is already deactivated. Therefore, it is not
> idempotent and not friendly to its callers, like fq_codel_dequeue().
> 
> Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers'
> life.
> 
> Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [Patch net v2 02/11] sch_drr: make drr_qlen_notify() idempotent

[Simon Horman]

On Thu, Apr 03, 2025 at 02:10:24PM -0700, Cong Wang wrote:
> drr_qlen_notify() always deletes the DRR class from its active list
> with list_del(), therefore, it is not idempotent and not friendly
> to its callers, like fq_codel_dequeue().
> 
> Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers'
> life. Also change other list_del()'s to list_del_init() just to be
> extra safe.
> 
> Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [Patch net v2 03/11] sch_hfsc: make hfsc_qlen_notify() idempotent

[Simon Horman]

On Thu, Apr 03, 2025 at 02:10:25PM -0700, Cong Wang wrote:
> hfsc_qlen_notify() is not idempotent either and not friendly
> to its callers, like fq_codel_dequeue(). Let's make it idempotent
> to ease qdisc_tree_reduce_backlog() callers' life:
> 
> 1. update_vf() decreases cl->cl_nactive, so we can check whether it is
> non-zero before calling it.
> 
> 2. eltree_remove() always removes RB node cl->el_node, but we can use
>    RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.
> 
> Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [Patch net v2 04/11] sch_qfq: make qfq_qlen_notify() idempotent

[Simon Horman]

On Thu, Apr 03, 2025 at 02:10:26PM -0700, Cong Wang wrote:
> qfq_qlen_notify() always deletes its class from its active list
> with list_del_init() _and_ calls qfq_deactivate_agg() when the whole list
> becomes empty.
> 
> To make it idempotent, just skip everything when it is not in the active
> list.
> 
> Also change other list_del()'s to list_del_init() just to be extra safe.
> 
> Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [Patch net v2 06/11] codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()

[Simon Horman]

On Thu, Apr 03, 2025 at 02:16:31PM -0700, Cong Wang wrote:
> After making all ->qlen_notify() callbacks idempotent, now it is safe to
> remove the check of qlen!=0 from both fq_codel_dequeue() and
> codel_qdisc_dequeue().
> 
> Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [Patch net v2 11/11] selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

[Jakub Kicinski]

On Fri, 4 Apr 2025 16:03:26 -0300 Victor Nogueira wrote:
> > Any ideas what is causing the IFE failure? Looks like it started
> > happening when this series landed in the testing tree but I don't
> > see how it could be related ?  
> 
> Yes, I saw that, but since it succeeded on retry and, as you said,
> it doesn't seem to be related to this series, it looks more like
> those IFE tests are a bit unstable. I talked to Pedro and we are
> taking a look at it.

I dropped this set from the queue temporarily, and the failure
went away (net-next-2025-04-07--18-00). 
Now I'm less inclined to think the IFE failure is not related to 
the series. But since the retry passes I'm not sure if Cong will 
be able to debug this. 

Could someone on Mojatatu side take a closer look please?

Re: [Patch net v2 11/11] selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

[Victor Nogueira]

On 4/7/25 17:09, Jakub Kicinski wrote:
> On Fri, 4 Apr 2025 16:03:26 -0300 Victor Nogueira wrote:
>>> Any ideas what is causing the IFE failure? Looks like it started
>>> happening when this series landed in the testing tree but I don't
>>> see how it could be related ?
>>
>> Yes, I saw that, but since it succeeded on retry and, as you said,
>> it doesn't seem to be related to this series, it looks more like
>> those IFE tests are a bit unstable. I talked to Pedro and we are
>> taking a look at it.
> 
> I dropped this set from the queue temporarily, and the failure
> went away (net-next-2025-04-07--18-00).
> Now I'm less inclined to think the IFE failure is not related to
> the series. But since the retry passes I'm not sure if Cong will
> be able to debug this.
> 
> Could someone on Mojatatu side take a closer look please?

We reached a different conclusion here.

Went through it during the weekend and today with Pedro.
IFE relies on some "sub-modules" for it to work (like
act_meta_skbprio and act_meta_skbtcindex). The issue is that
when running tdc in parallel (with more than 16 cores), the
act_meta_skbtcindex module is not loaded in time, which causes,
for example, the failure in test 219f.
Likely there might be a recent change in rwlock? not sure.
When we fix tdc.sh to pre load these modules, that tests
succeeded again. Will send a patch

cheers,
Victor

PS: It may have worked for you (in net-next-2025-04-07--18-00)
because we applied the patch we are going to send earlier.

Re: [Patch net v2 00/11] net_sched: make ->qlen_notify() idempotent

[Jamal Hadi Salim]

On Thu, Apr 3, 2025 at 5:10 PM Cong Wang <xiyou.wangcong@gmail.com> wrote:
>
> Gerrard reported a vulnerability exists in fq_codel where manipulating
> the MTU can cause codel_dequeue() to drop all packets. The parent qdisc's
> sch->q.qlen is only updated via ->qlen_notify() if the fq_codel queue
> remains non-empty after the drops. This discrepancy in qlen between
> fq_codel and its parent can lead to a use-after-free condition.
>
> Let's fix this by making all existing ->qlen_notify() idempotent so that
> the sch->q.qlen check will be no longer necessary.
>
> Patch 1~5 make all existing ->qlen_notify() idempotent to prepare for
> patch 6 which removes the sch->q.qlen check. They are followed by 5
> selftests for each type of Qdisc's we touch here.
>
> All existing and new Qdisc selftests pass after this patchset.
>
> Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
> Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
>

For the patches:
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>

cheers,
jamal

Re: [Patch net v2 00/11] net_sched: make ->qlen_notify() idempotent

[Paolo Abeni]

On 4/3/25 11:10 PM, Cong Wang wrote:
> Gerrard reported a vulnerability exists in fq_codel where manipulating
> the MTU can cause codel_dequeue() to drop all packets. The parent qdisc's
> sch->q.qlen is only updated via ->qlen_notify() if the fq_codel queue
> remains non-empty after the drops. This discrepancy in qlen between
> fq_codel and its parent can lead to a use-after-free condition.
> 
> Let's fix this by making all existing ->qlen_notify() idempotent so that
> the sch->q.qlen check will be no longer necessary.
> 
> Patch 1~5 make all existing ->qlen_notify() idempotent to prepare for
> patch 6 which removes the sch->q.qlen check. They are followed by 5
> selftests for each type of Qdisc's we touch here.
> 
> All existing and new Qdisc selftests pass after this patchset.
> 
> Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
> Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")

FTR, I think it would be better to include the fixes tag in the relevant
commit message, as such I propagated the above tags in patch 6.

/P

Re: [Patch net v2 00/11] net_sched: make ->qlen_notify() idempotent

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Thu,  3 Apr 2025 14:10:22 -0700 you wrote:
> Gerrard reported a vulnerability exists in fq_codel where manipulating
> the MTU can cause codel_dequeue() to drop all packets. The parent qdisc's
> sch->q.qlen is only updated via ->qlen_notify() if the fq_codel queue
> remains non-empty after the drops. This discrepancy in qlen between
> fq_codel and its parent can lead to a use-after-free condition.
> 
> Let's fix this by making all existing ->qlen_notify() idempotent so that
> the sch->q.qlen check will be no longer necessary.
> 
> [...]

Here is the summary with links:
  - [net,v2,01/11] sch_htb: make htb_qlen_notify() idempotent
    https://git.kernel.org/netdev/net/c/5ba8b837b522
  - [net,v2,02/11] sch_drr: make drr_qlen_notify() idempotent
    https://git.kernel.org/netdev/net/c/df008598b3a0
  - [net,v2,03/11] sch_hfsc: make hfsc_qlen_notify() idempotent
    https://git.kernel.org/netdev/net/c/51eb3b65544c
  - [net,v2,04/11] sch_qfq: make qfq_qlen_notify() idempotent
    https://git.kernel.org/netdev/net/c/55f9eca4bfe3
  - [net,v2,05/11] sch_ets: make est_qlen_notify() idempotent
    https://git.kernel.org/netdev/net/c/a7a15f39c682
  - [net,v2,06/11] codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
    https://git.kernel.org/netdev/net/c/342debc12183
  - [net,v2,07/11] selftests/tc-testing: Add a test case for FQ_CODEL with HTB parent
    https://git.kernel.org/netdev/net/c/cbe9588b12d0
  - [net,v2,08/11] selftests/tc-testing: Add a test case for FQ_CODEL with QFQ parent
    https://git.kernel.org/netdev/net/c/4cb1837ac537
  - [net,v2,09/11] selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent
    https://git.kernel.org/netdev/net/c/72b05c1bf7ea
  - [net,v2,10/11] selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent
    https://git.kernel.org/netdev/net/c/0d5c27ecb60c
  - [net,v2,11/11] selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent
    https://git.kernel.org/netdev/net/c/ce94507f5fe0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html