From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f176.google.com (mail-qk1-f176.google.com [209.85.222.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65EBD3E5585 for ; Fri, 26 Jun 2026 16:52:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782492732; cv=none; b=KJ3Z1LbM1i4cfhH1+FMWvUWzhfyK0v5JsQ13qc0Kfvc3H6wegHS6BGjAsgygVGbKFEJ5txvnI3qqGvJNHHAXnuAmSbRgKHXYg0J9IT6niPW0dv+wJO7NoDkKCbYGwBFln4eFuRfX3hOtlnNsnQWC85pZg+cabLQUV+CvnHZu6FA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782492732; c=relaxed/simple; bh=CQUwYczDqjfjuD5Q15kitxs30UGf97KDGIM1en49qEw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=L87bcQSwXlnlYfuWVKYGk6W6bphev+XnLPNpFwjtv82/pZdOOEjenLh3ByVCEZL0eBcttOFfdBDPffD9Ay7wPvS5Gga0HKEBe/e+KVDwj4nIBJIy7vM0tB7D34FEtpoDddGBb63shPGORkCNsTpqTkAYremeb3lqvLAFsFL4kCw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mojatatu.com; spf=none smtp.mailfrom=mojatatu.com; dkim=pass (1024-bit key) header.d=mojatatu.com header.i=@mojatatu.com header.b=sN1m6Fvs; arc=none smtp.client-ip=209.85.222.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mojatatu.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=mojatatu.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mojatatu.com header.i=@mojatatu.com header.b="sN1m6Fvs" Received: by mail-qk1-f176.google.com with SMTP id af79cd13be357-91588056619so79179085a.2 for ; Fri, 26 Jun 2026 09:52:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu.com; s=google; t=1782492729; x=1783097529; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=OsKglxlBPMR4V7jm2F4Wm5zFEniVI7fM3hmQKeKcxa8=; b=sN1m6FvsCA99E6ZBUTKqZ0N++F9NkLHiRrMc4KMo7FHN3HKxe+Unk3c3j1qeH6fhXt vpXxGmJgQLItomBrqHMqnrYcgMo4RowHTN38LFvM4eKa7ASK7lkK1YxTUOnGUCH1xXHu d3a9QCEusNHDlocJYi9jUQ5OWvtTDtnjaI/W4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782492729; x=1783097529; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=OsKglxlBPMR4V7jm2F4Wm5zFEniVI7fM3hmQKeKcxa8=; b=PG3g8Wkh7YHRYgcVNuMUmOoGat9AE1sAASYU9ymfLG7r7UVndlbhOxTxdm5UdKLg3O TFvS6XMLZHoY5mxoJcutRYO5fJRUw4FRsEDGZIhII2iRxuMcCfHfNVX93ufpaPas/5aS IGhwK9xJOArbVPrka5ovxDS8ysgTVXshVtqcxnTCk4NpD4Amp9r26hfjNdcVxb2PIyAE i+aQMQ4qK8GIPeZdNuV1Ld5KkN05q6AJ3x8ao9zz9StAbPjDKFA79tw99zweUWpXMXmy OgT/tJF7FhTsLJ/cysDUk5OPiBTkQ1qiQ61YEZXLz0yisCaYjzCclrqGD2vZs0lbiLod pj3w== X-Gm-Message-State: AOJu0YzKIvZ2R93HWJ8DFp+z7N+mbUmmSfrR699SHa51wGHaqaSyxp32 A0a3ZEc6UpRtZCJeqaaVwSuL9oRT4pO8ILcz05WNORhJ0gix4N272PhroRFHxrsPEEcIkF6Sk7q R7wwW/Q== X-Gm-Gg: AfdE7cki4ArAnCHUMIcGZcDTnRiNfWKpjKA9H90zVVsmjxCqAnjiC36olo9KUigHuBJ Bwzg0IkCeUEv/TVEAmWD2+5saPNfGgYP8y1Ykl86LPF2/+iucHNq1KO5mKRvq6woPX3riJ0YDTp CkwkJYupP7AxSr38d9EHZYPSgKt3IIziv8f98TNuhGfG6apWDV0FUKw76VR7ecd6YzJqMAavneK 75iJzHRSl5ZEjMbyaJX+5dKf8687jJOB0OMNz+BYfcWX49Gef2BC4gotkrv/VnWZkYnuv+NYNBt +7wmsvGtuJUzNs8S5xb3oQdK1Z9LRTmf2hhbkV8BQIGzv+MG7++HUc0J3YhLlYqA1jq+D1bgVJK UoK/i2RcFbNQFvfSOR4tSGIdJoS+wLK/E0nFOyl6DteFKNBDqdFvSDb0XEY2/WIXgx2Cr5XviIe v6oR3x7A== X-Received: by 2002:a05:620a:4483:b0:926:f317:7c75 with SMTP id af79cd13be357-9293ddadbd2mr1179157585a.42.1782492729206; Fri, 26 Jun 2026 09:52:09 -0700 (PDT) Received: from majuu.waya ([184.144.29.222]) by smtp.gmail.com with ESMTPSA id af79cd13be357-926004abe29sm1216957385a.33.2026.06.26.09.52.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jun 2026 09:52:08 -0700 (PDT) From: Jamal Hadi Salim To: netdev@vger.kernel.org, bpf@vger.kernel.org Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, toke@toke.dk, jiri@resnulli.us, bigeasy@linutronix.de, clrkwllms@kernel.org, rostedt@goodmis.org, kuniyu@google.com, sdf.kernel@gmail.com, skhawaja@google.com, liuhangbin@gmail.com, krikku@gmail.com, mkarsten@uwaterloo.ca, victor@mojatatu.com, ast@kernel.org, hawk@kernel.org, john.fastabend@gmail.com, daniel@iogearbox.net, Jamal Hadi Salim Subject: [PATCH net 3/3] selftests/tc-testing: Verify bpf redirect on RED block with preceding clsact (egress) classifier Date: Fri, 26 Jun 2026 12:51:56 -0400 Message-Id: <20260626165156.169012-4-jhs@mojatatu.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260626165156.169012-1-jhs@mojatatu.com> References: <20260626165156.169012-1-jhs@mojatatu.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Victor Nogueira The bpf_net_context used by sch_handle_egress() is stack-allocated and torn down in that function. By the time tcf_qevent_handle() runs current->bpf_net_context is NULL. When a filter attached to a qevent block (e.g. RED's early_drop or mark qevents, which always uses shared blocks) returns TC_ACT_REDIRECT, tcf_qevent_handle() calls skb_do_redirect(), which in turn calls bpf helper bpf_net_ctx_get_ri(). That helper unconditionally dereferences current->bpf_net_context resulting in a NULL pointer dereference. Add a test case that reproduces this scenario by attaching a filter to clsact (egress) and a bpf filter to a block attached to RED. Use TBF as red's parent, so that a traffic burst builds backlog and RED early-drops triggers the block filter. Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira --- .../testing/selftests/tc-testing/action-ebpf | Bin 856 -> 9072 bytes tools/testing/selftests/tc-testing/action.c | 5 +++ .../tc-testing/tc-tests/infra/qdiscs.json | 32 ++++++++++++++++++ 3 files changed, 37 insertions(+) diff --git a/tools/testing/selftests/tc-testing/action-ebpf b/tools/testing/selftests/tc-testing/action-ebpf index 4879479b2ee5c046279be0fe8f9ca313dfb7e618..52c47e42bf0af024a073cacc823c8270f906a8df 100644 GIT binary patch literal 9072 zcmb<-^>JfjWMqH=MuzVU2p&w7fnkFTg6#liIxt8xFfwchvl$qsLh0>H5Js}1514@= z&%nUI&VW$w9^k{kD9EU)D$L5PS|lzYF0Cra7^++>ULwxGz+}R}tm-LjFKNYX&CMji zz`)GN=qb#=z@o_DDQwQoz`&})z^rP=&CSigzy@M+bK7w|o?)VBi;H@Dzra$G{)}QwmZi2vf(vAS4Xc!oa}rf|-GVm4T51 z6i$o`vQQQS0|PV&85kHqay%drW;2i~8K#8{%uWmp3@mOSf`OHVjggI&gPomGfPsO5 zF^Y|WX9`Fc7X!}>ka~6|1+X{=gCIzplQEEsK@cLt4AH^KAP$n@;9?L5i?gz`vT)61 zU|`@5Il#13f`?m*iGhJ>nFIq5ADFdVf`x}4%vvGA!6N`>t(4&55d^bVNeJ)=fmy31 zM0kY3tThr6JR)G$S_v5*Q7~(rgaVHkn6+L)g-0CB+9099BLQY@l+fXkR0G+&Ny30f z3M{r+!i7f~%-SO1!6O4^ZI$rhkp;81Nd)l7fmz!nLU`oCtX&cjJPKgeZiyHkMKEiR zL;{bJ5y<4d5-B{&VAei~5*`(>?0$(B9#t^wfJ6t68kluhqK9`QBLf4|5ebe7d>kN( zN8Ju&!Vw7u1|EBRW(EePqY^WCoWRPDNi5)T2D6S!Ea80x(s)9GV+9`v(+LR<9v5$r z>JuQ1fnY@^B{uK`DT4%0No?T>1{-!pVh01i5)%UhFQYUo4?7DpNF_MFSs4&)76vY7 zCI$v>I}4^~GCUgMATyrJFz{%DSubRmcyz$5moh9ox?me#$*}PlfLX6)*m(@WtT!?o zJVs#FTNzFsV||b*?_{`mOu?-8GCVwHVAcm2K7nl@Pk)pV5L96LC?jwL#QP+}AjHA+ zNruPV9HjHJ3+7#P?X85p=3 z85l$u85m?385ooq85r~!85k@W85o=y85n#S85klN85mL+85r^y85k-U85rsq85nvQ z85kxrGBC_!WMEjr$iT3Mk%3_sBLl;JMh1qnj0_Cd7#SGuGcqtdXJlY_$H>6&g^_{b z7b61$GZO;?7ZU@6FcSlV3=;!`DiZ^PHWLGb850A83ljr_HxmOx91{aW3KIiEE)xSo z8509TB@+Wf8xsRVHxmQHWF`iN*-Q)!OPClK)-o|LY-M6#*vrJgaF~gK;R+K2!!0HT zhQ~|{3~!hi7=AD@FfcMRFeK+B=A|o?r4|)u=I1FG8R;47nKC3Mmt^MW=_NDhF~sL& zCa2~Vr!pjGBo;Bm$2$fEIY!0@dq%m&heQUr#>Yby$LD7=WagE?c-i?dR#9q7W>IQ# z2}3bMPHG-QX)d`V?NDno8!Q8q(iX=-U|d~RYvL1tb$ zLqSn~Nq%yE4ntW^VqSbfQEG8&UI~O#lAH-)fYmS*6lLZYWtLPjWagz8r4|>*XQpN5 zrKDCc!03|Xc!)r95<^B}aRx(4a(r@5VsUY13PVa_Ng|ktPt8kV$V)89jL%GANK4Gk z%&BB3O3lqLNsZ4eFk#5aPfpAMv*3bea6vPe%7Xl&5~wJc2{JuCH?<^@AuT7rJU%p&3Il#64g#v!Ki*zPKnEEN5)Q0OqF@mw*^% zV2R9vGP8J)NLo%}dNIWDIf+TBISfe!Y4HfZloXdF<`y8Fmy@5Dt^gt!;^RxrOc=^D zi&Eo3k)K|iA77lBUd&LO&5)E|nwJuvl3Es@nZ^K){^Fu!aL__%GX@Y1c4`w-U21W*kCaAaq69Yp#l+Jv7uh^(P!+;Tk~2IHW8u&IT3d7KmaVTniN=*ZTR{&{|(NKbt{MAKr}MEJ`gYEy_~} zagKL%4vF{owuY*Uhqn`Svq6RTMYJ9wgMsX^*8KR*CF-JE$UrAG^v^X_I zQxnvBP=E->XXk4amlTyImnguCas{noO$N?lT{}?Ct6-~OP+85tP1f%;Dt5WV2c#=yV;62A-5=mO~-gZQ9k zB$p2Z1IP>zAFM9`)eew&G!p{@M+(SB1_n@B`v3p`|11m~3>-Dw3?Mf_WFRESED#G_ z9OiFyahQ5gbDNccgP{&ocrh~m=Hq2xWCRuJpi+vFkrC9nf%Nb}r6e<>JQF{w91EzS z&)_R@sm`yAaZAD<73VVx=lwJX6-zq=J{1((2_#EytNSW+OeGK09bh`wvnwt9_@k2y z0!I>LJ>^b$fQASTtbMp}G3T|;oM#+dfr~D(vM{hRaWQa0$`?@0!^_CT#J~uu1&{;< z8Ckiw6j_-Rp>nJoD0(Cydh{6dON)#2GxL&jN>ftx6N__o(^Km}EF9C6o z?5{xM*P!u1?Rbz7%={J*2T6Yi8Xq)N0TP0#p8(<@sRyNFkPu8BJSvGKKL;d<#D~>6 zF!f8&1?-!}1%555mahJ*W?i?0%5>F!zDX2Fb(9YmgjB47t1o$-~N9kUYqIQ2hrA zACOv5-J=HLK+_|LuZ6}3&$A%Od!xz2{0}p)6ips9wg3_W*$=|YK^#!?3~J^vBtFP} zynOru40YGK^f`~m^gZRlx4&oejlLr z!@>z~ zhxHd=PJro$@j+97*z9irS;)Y^0IT0XTu_pN>4zH6@En?cVCKQ-0BA??8cYC6qr3Gn zj`aHgWFcrA8>$b)1&s@#+YjoWfXqZsziObsVqjo^l?uWH&07wxN(*OVf delta 317 zcmez1c7tt#hG+yM0~|PjSq=;w6K#!|-2;3kf8>;vbYoy(U}5<9A1sGNNKf7A_P3=9lR YATu>8pmH!86gW%_3=AAlaS1350I>8ljQ{`u diff --git a/tools/testing/selftests/tc-testing/action.c b/tools/testing/selftests/tc-testing/action.c index c32b99b80e19..350f2d36a773 100644 --- a/tools/testing/selftests/tc-testing/action.c +++ b/tools/testing/selftests/tc-testing/action.c @@ -20,4 +20,9 @@ __attribute__((section("action-ko"),used)) int action_ko(struct __sk_buff *s) return TC_ACT_OK; } +__attribute__((section("action-redirect"), used)) int action_redirect(struct __sk_buff *s) +{ + return TC_ACT_REDIRECT; +} + char _license[] __attribute__((section("license"),used)) = "GPL"; diff --git a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json index a1f97a4b606e..762f86ceab1c 100644 --- a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json +++ b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json @@ -1540,5 +1540,37 @@ "$TC qdisc del dev $DUMMY root", "$IP addr del 10.10.10.10/24 dev $DUMMY || true" ] + }, + { + "id": "fb8d", + "name": "Verify bpf redirect on RED block with preceding clsact (egress) classifier", + "category": [ + "qdisc", + "red", + "qevent", + "clsact" + ], + "plugins": { + "requires": "nsPlugin" + }, + "setup": [ + "$IP addr add 10.10.10.1/24 dev $DUMMY", + "$IP neigh add 10.10.10.2 lladdr 02:00:00:00:00:01 dev $DUMMY nud permanent", + "$TC qdisc add dev $DUMMY handle 1: root tbf rate 1Mbit burst 10K limit 1M", + "$TC qdisc add dev $DUMMY parent 1:1 handle 11: red limit 1M avpkt 1400 probability 1 burst 38 harddrop min 30000 max 30001 qevent early_drop block 10", + "$TC qdisc add dev $DUMMY clsact", + "$TC filter add dev $DUMMY egress protocol ip prio 1 matchall action gact pass", + "$TC filter add block 10 protocol ip prio 1 matchall action bpf obj action-ebpf sec action-redirect" + ], + "cmdUnderTest": "bash -c 'data=$(head -c 1400 /dev/zero | tr \"\\0\" \"x\"); exec 3>/dev/udp/10.10.10.2/12345; for i in $(seq 1 8000); do printf \"%s\" \"$data\" >&3; done; exit 0'", + "expExitCode": "0", + "verifyCmd": "$TC -s filter show block 10", + "matchPattern": "Sent [1-9][0-9]* bytes [1-9][0-9]* pkt", + "matchCount": "1", + "teardown": [ + "$TC qdisc del dev $DUMMY clsact", + "$TC qdisc del dev $DUMMY handle 1: root", + "$IP addr del 10.10.10.1/24 dev $DUMMY" + ] } ] -- 2.54.0