* [PATCH net 0/2] Introduce CBS reset ops
@ 2026-05-05 13:16 Jamal Hadi Salim
0 siblings, 0 replies; only message in thread
From: Jamal Hadi Salim @ 2026-05-05 13:16 UTC (permalink / raw)
To: netdev
Cc: Jamal Hadi Salim, davem, kuba, edumazet, pabeni, jiri, horms,
vinicius.gomes, graypanda.inzag, victor
QFQ uses qlen to check whether it should reset pointer q->in_serv_agg.
When QFQ has a CBS child which has a netem child it is possible to create a
scenario where QFQ's qlen goes to 0 but the computation makes it underflow.
This then aggrevates a null pointer deref.
Jamal Hadi Salim (1):
net/sched: sch_cbs: Call qdisc_reset for child qdisc
Victor Nogueira (1):
selftests/tc-testing: Add QFQ/CBS qlen underflow test
net/sched/sch_cbs.c | 12 +++++-
.../tc-testing/tc-tests/infra/qdiscs.json | 41 +++++++++++++++++++
2 files changed, 52 insertions(+), 1 deletion(-)
--
2.34.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-05-05 13:16 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-05 13:16 [PATCH net 0/2] Introduce CBS reset ops Jamal Hadi Salim
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox