* [PATCH net] selftests/tc-testing: Add tests that force multiq and taprio to enqueue to child's gso_skb
@ 2026-06-30 15:36 Victor Nogueira
2026-06-30 15:43 ` Pedro Tammela
0 siblings, 1 reply; 2+ messages in thread
From: Victor Nogueira @ 2026-06-30 15:36 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, jhs, jiri
Cc: netdev, hexlabsecurity, pctammela
Add test cases to reproduce scenarios fixed recently [1] where
multiqueue and taprio forced their children into enqueueing an skb to
gso_skb (during peek), but failed to dequeue from gso_skb because they
called the child's dequeue callback directly. This causes a desync in the
child's qlen/backlog and results in an eventual null-ptr-deref (with a
qfq or dualpi2 child).
Test cases are the following:
- Force multiq to dequeue from its child's gso_skb with qfq leaf (fb6c)
- Force multiq to dequeue from its child's gso_skb with dualpi2 leaf (1922)
- Force taprio to dequeue from its child's gso_skb with qfq leaf (476f)
- Force taprio to dequeue from its child's gso_skb with dualpi2 leaf (0235)
[1] https://lore.kernel.org/netdev/20260625-b4-disp-31bcb279-v1-0-85c40b83c529@proton.me/
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
---
.../tc-testing/tc-tests/infra/qdiscs.json | 164 ++++++++++++++++++
1 file changed, 164 insertions(+)
diff --git a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
index a1f97a4b606e..0cf12c50fb74 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
@@ -1540,5 +1540,169 @@
"$TC qdisc del dev $DUMMY root",
"$IP addr del 10.10.10.10/24 dev $DUMMY || true"
]
+ },
+ {
+ "id": "fb6c",
+ "name": "Force multiq to dequeue from its child's gso_skb with qfq leaf",
+ "category": [
+ "qdisc",
+ "tbf",
+ "multiq",
+ "qfq"
+ ],
+ "plugins": {
+ "requires": "nsPlugin"
+ },
+ "setup": [
+ "echo \"1 1 4\" > /sys/bus/netdevsim/new_device",
+ "$IP link set dev $ETH up || true",
+ "$IP l set addr 01:02:03:04:05:06 dev $ETH || true",
+ "$IP n add dev $ETH 10.10.11.1 lladdr 01:02:03:04:05:06 dev $ETH || true",
+ "$IP addr add 10.10.11.10/24 dev $ETH || true",
+ "$TC qdisc add dev $ETH root handle 1: tbf rate 88bit burst 1661b peakrate 2257333 minburst 1024 limit 7b",
+ "$TC qdisc add dev $ETH parent 1: handle 2: multiq",
+ "$TC qdisc add dev $ETH parent 2:1 handle 3: qfq",
+ "$TC class add dev $ETH classid 3:1 parent 3: qfq maxpkt 512 weight 1",
+ "$TC filter add dev $ETH parent 2: protocol all prio 1 matchall action skbedit queue_mapping 0",
+ "$TC filter add dev $ETH parent 3: protocol all prio 1 matchall classid 3:1 action ok"
+ ],
+ "cmdUnderTest": "ping -c 1 10.10.11.1 -W0.01 -I$ETH || true",
+ "expExitCode": "0",
+ "verifyCmd": "$TC -s -j qdisc ls dev $ETH parent 1:",
+ "matchJSON": [
+ {
+ "kind": "multiq",
+ "handle": "2:",
+ "bytes": 98,
+ "packets": 1,
+ "backlog": 0,
+ "qlen": 0
+ }
+ ],
+ "teardown": [
+ "$TC qdisc del dev $ETH handle 1: root",
+ "echo \"1\" > /sys/bus/netdevsim/del_device"
+ ]
+ },
+ {
+ "id": "1922",
+ "name": "Force multiq to dequeue from its child's gso_skb with dualpi2 leaf",
+ "category": [
+ "qdisc",
+ "tbf",
+ "multiq",
+ "dualpi2"
+ ],
+ "plugins": {
+ "requires": "nsPlugin"
+ },
+ "setup": [
+ "echo \"1 1 4\" > /sys/bus/netdevsim/new_device",
+ "$IP link set dev $ETH up || true",
+ "$IP l set addr 01:02:03:04:05:06 dev $ETH || true",
+ "$IP n add dev $ETH 10.10.11.1 lladdr 01:02:03:04:05:06 dev $ETH || true",
+ "$IP addr add 10.10.11.10/24 dev $ETH || true",
+ "$TC qdisc add dev $ETH root handle 1: tbf rate 88bit burst 1661b peakrate 2257333 minburst 1024 limit 7b",
+ "$TC qdisc add dev $ETH parent 1: handle 2: multiq",
+ "$TC qdisc add dev $ETH parent 2:1 handle 3: dualpi2",
+ "$TC filter add dev $ETH parent 2: protocol ip prio 1 u32 match ip dst 10.10.11.1 action skbedit queue_mapping 0",
+ "$TC filter add dev $ETH parent 3: protocol ip prio 1 u32 match ip dst 10.10.11.1 classid 3:1 action ok"
+ ],
+ "cmdUnderTest": "ping -c 1 10.10.11.1 -W0.01 -I$ETH || true",
+ "expExitCode": "0",
+ "verifyCmd": "$TC -j -s qdisc ls dev $ETH handle 3:",
+ "matchJSON": [
+ {
+ "kind": "dualpi2",
+ "handle": "3:",
+ "bytes": 98,
+ "packets": 1,
+ "backlog": 0,
+ "qlen": 0
+ }
+ ],
+ "teardown": [
+ "$TC qdisc del dev $ETH handle 1: root",
+ "echo \"1\" > /sys/bus/netdevsim/del_device"
+ ]
+ },
+ {
+ "id": "476f",
+ "name": "Force taprio to dequeue from its child's gso_skb with qfq leaf",
+ "category": [
+ "qdisc",
+ "tbf",
+ "multiq",
+ "qfq"
+ ],
+ "plugins": {
+ "requires": "nsPlugin"
+ },
+ "setup": [
+ "echo \"1 1 4\" > /sys/bus/netdevsim/new_device",
+ "$IP link set dev $ETH up || true",
+ "$IP l set addr 01:02:03:04:05:06 dev $ETH || true",
+ "$IP n add dev $ETH 10.10.11.1 lladdr 01:02:03:04:05:06 dev $ETH || true",
+ "$TC qdisc add dev $ETH root handle 1: taprio num_tc 2 map 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 queues 1@0 1@1 base-time 9000000000000000000 sched-entry S 03 200000 flags 0x0 clockid CLOCK_TAI",
+ "$TC qdisc add dev $ETH parent 1:1 handle 3: qfq",
+ "$TC class add dev $ETH classid 3:1 parent 3: qfq maxpkt 512 weight 1",
+ "$TC filter add dev $ETH parent 3: protocol all prio 1 matchall classid 3:1 action ok"
+ ],
+ "cmdUnderTest": "ping -c 1 10.10.11.1 -W0.01 -I$ETH || true",
+ "expExitCode": "0",
+ "verifyCmd": "$TC -s -j qdisc ls dev $ETH",
+ "matchJSON": [
+ {
+ "kind": "taprio",
+ "handle": "1:",
+ "bytes": 98,
+ "packets": 1,
+ "backlog": 0,
+ "qlen": 0
+ }
+ ],
+ "teardown": [
+ "$TC qdisc del dev $ETH handle 1: root",
+ "echo \"1\" > /sys/bus/netdevsim/del_device"
+ ]
+ },
+ {
+ "id": "0235",
+ "name": "Force taprio to dequeue from its child's gso_skb with dualpi2 leaf",
+ "category": [
+ "qdisc",
+ "tbf",
+ "taprio",
+ "dualpi2"
+ ],
+ "plugins": {
+ "requires": "nsPlugin"
+ },
+ "setup": [
+ "echo \"1 1 4\" > /sys/bus/netdevsim/new_device",
+ "$IP link set dev $ETH up || true",
+ "$IP l set addr 01:02:03:04:05:06 dev $ETH || true",
+ "$IP n add dev $ETH 10.10.11.1 lladdr 01:02:03:04:05:06 dev $ETH || true",
+ "$TC qdisc add dev $ETH root handle 1: taprio num_tc 2 map 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 queues 1@0 1@1 base-time 9000000000000000000 sched-entry S 03 200000 flags 0x0 clockid CLOCK_TAI",
+ "$TC qdisc replace dev $ETH parent 1:1 handle 3: dualpi2",
+ "$TC filter add dev $ETH parent 3: protocol ip prio 1 u32 match ip dst 10.10.11.1 classid 3:1 action ok"
+ ],
+ "cmdUnderTest": "ping -c 1 10.10.11.1 -W0.01 -I$ETH || true",
+ "expExitCode": "0",
+ "verifyCmd": "$TC -j -s qdisc ls dev $ETH handle 3:",
+ "matchJSON": [
+ {
+ "kind": "dualpi2",
+ "handle": "3:",
+ "bytes": 98,
+ "packets": 1,
+ "backlog": 0,
+ "qlen": 0
+ }
+ ],
+ "teardown": [
+ "$TC qdisc del dev $ETH handle 1: root",
+ "echo \"1\" > /sys/bus/netdevsim/del_device"
+ ]
}
]
--
2.54.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH net] selftests/tc-testing: Add tests that force multiq and taprio to enqueue to child's gso_skb
2026-06-30 15:36 [PATCH net] selftests/tc-testing: Add tests that force multiq and taprio to enqueue to child's gso_skb Victor Nogueira
@ 2026-06-30 15:43 ` Pedro Tammela
0 siblings, 0 replies; 2+ messages in thread
From: Pedro Tammela @ 2026-06-30 15:43 UTC (permalink / raw)
To: Victor Nogueira, davem, edumazet, kuba, pabeni, jhs, jiri
Cc: netdev, hexlabsecurity
On 30/06/2026 12:36, Victor Nogueira wrote:
> Add test cases to reproduce scenarios fixed recently [1] where
> multiqueue and taprio forced their children into enqueueing an skb to
> gso_skb (during peek), but failed to dequeue from gso_skb because they
> called the child's dequeue callback directly. This causes a desync in the
> child's qlen/backlog and results in an eventual null-ptr-deref (with a
> qfq or dualpi2 child).
>
> Test cases are the following:
>
> - Force multiq to dequeue from its child's gso_skb with qfq leaf (fb6c)
> - Force multiq to dequeue from its child's gso_skb with dualpi2 leaf (1922)
> - Force taprio to dequeue from its child's gso_skb with qfq leaf (476f)
> - Force taprio to dequeue from its child's gso_skb with dualpi2 leaf (0235)
>
> [1] https://lore.kernel.org/netdev/20260625-b4-disp-31bcb279-v1-0-85c40b83c529@proton.me/
>
> Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
> ---
> .../tc-testing/tc-tests/infra/qdiscs.json | 164 ++++++++++++++++++
> 1 file changed, 164 insertions(+)
>
> diff --git a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
> index a1f97a4b606e..0cf12c50fb74 100644
> --- a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
> +++ b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
> @@ -1540,5 +1540,169 @@
> "$TC qdisc del dev $DUMMY root",
> "$IP addr del 10.10.10.10/24 dev $DUMMY || true"
> ]
> + },
> + {
> + "id": "fb6c",
> + "name": "Force multiq to dequeue from its child's gso_skb with qfq leaf",
> + "category": [
> + "qdisc",
> + "tbf",
> + "multiq",
> + "qfq"
> + ],
> + "plugins": {
> + "requires": "nsPlugin"
> + },
> + "setup": [
> + "echo \"1 1 4\" > /sys/bus/netdevsim/new_device",
> + "$IP link set dev $ETH up || true",
> + "$IP l set addr 01:02:03:04:05:06 dev $ETH || true",
> + "$IP n add dev $ETH 10.10.11.1 lladdr 01:02:03:04:05:06 dev $ETH || true",
> + "$IP addr add 10.10.11.10/24 dev $ETH || true",
> + "$TC qdisc add dev $ETH root handle 1: tbf rate 88bit burst 1661b peakrate 2257333 minburst 1024 limit 7b",
> + "$TC qdisc add dev $ETH parent 1: handle 2: multiq",
> + "$TC qdisc add dev $ETH parent 2:1 handle 3: qfq",
> + "$TC class add dev $ETH classid 3:1 parent 3: qfq maxpkt 512 weight 1",
> + "$TC filter add dev $ETH parent 2: protocol all prio 1 matchall action skbedit queue_mapping 0",
> + "$TC filter add dev $ETH parent 3: protocol all prio 1 matchall classid 3:1 action ok"
> + ],
> + "cmdUnderTest": "ping -c 1 10.10.11.1 -W0.01 -I$ETH || true",
> + "expExitCode": "0",
> + "verifyCmd": "$TC -s -j qdisc ls dev $ETH parent 1:",
> + "matchJSON": [
> + {
> + "kind": "multiq",
> + "handle": "2:",
> + "bytes": 98,
> + "packets": 1,
> + "backlog": 0,
> + "qlen": 0
> + }
> + ],
> + "teardown": [
> + "$TC qdisc del dev $ETH handle 1: root",
> + "echo \"1\" > /sys/bus/netdevsim/del_device"
> + ]
> + },
> + {
> + "id": "1922",
> + "name": "Force multiq to dequeue from its child's gso_skb with dualpi2 leaf",
> + "category": [
> + "qdisc",
> + "tbf",
> + "multiq",
> + "dualpi2"
> + ],
> + "plugins": {
> + "requires": "nsPlugin"
> + },
> + "setup": [
> + "echo \"1 1 4\" > /sys/bus/netdevsim/new_device",
> + "$IP link set dev $ETH up || true",
> + "$IP l set addr 01:02:03:04:05:06 dev $ETH || true",
> + "$IP n add dev $ETH 10.10.11.1 lladdr 01:02:03:04:05:06 dev $ETH || true",
> + "$IP addr add 10.10.11.10/24 dev $ETH || true",
> + "$TC qdisc add dev $ETH root handle 1: tbf rate 88bit burst 1661b peakrate 2257333 minburst 1024 limit 7b",
> + "$TC qdisc add dev $ETH parent 1: handle 2: multiq",
> + "$TC qdisc add dev $ETH parent 2:1 handle 3: dualpi2",
> + "$TC filter add dev $ETH parent 2: protocol ip prio 1 u32 match ip dst 10.10.11.1 action skbedit queue_mapping 0",
> + "$TC filter add dev $ETH parent 3: protocol ip prio 1 u32 match ip dst 10.10.11.1 classid 3:1 action ok"
> + ],
> + "cmdUnderTest": "ping -c 1 10.10.11.1 -W0.01 -I$ETH || true",
> + "expExitCode": "0",
> + "verifyCmd": "$TC -j -s qdisc ls dev $ETH handle 3:",
> + "matchJSON": [
> + {
> + "kind": "dualpi2",
> + "handle": "3:",
> + "bytes": 98,
> + "packets": 1,
> + "backlog": 0,
> + "qlen": 0
> + }
> + ],
> + "teardown": [
> + "$TC qdisc del dev $ETH handle 1: root",
> + "echo \"1\" > /sys/bus/netdevsim/del_device"
> + ]
> + },
> + {
> + "id": "476f",
> + "name": "Force taprio to dequeue from its child's gso_skb with qfq leaf",
> + "category": [
> + "qdisc",
> + "tbf",
> + "multiq",
> + "qfq"
> + ],
> + "plugins": {
> + "requires": "nsPlugin"
> + },
> + "setup": [
> + "echo \"1 1 4\" > /sys/bus/netdevsim/new_device",
> + "$IP link set dev $ETH up || true",
> + "$IP l set addr 01:02:03:04:05:06 dev $ETH || true",
> + "$IP n add dev $ETH 10.10.11.1 lladdr 01:02:03:04:05:06 dev $ETH || true",
> + "$TC qdisc add dev $ETH root handle 1: taprio num_tc 2 map 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 queues 1@0 1@1 base-time 9000000000000000000 sched-entry S 03 200000 flags 0x0 clockid CLOCK_TAI",
> + "$TC qdisc add dev $ETH parent 1:1 handle 3: qfq",
> + "$TC class add dev $ETH classid 3:1 parent 3: qfq maxpkt 512 weight 1",
> + "$TC filter add dev $ETH parent 3: protocol all prio 1 matchall classid 3:1 action ok"
> + ],
> + "cmdUnderTest": "ping -c 1 10.10.11.1 -W0.01 -I$ETH || true",
> + "expExitCode": "0",
> + "verifyCmd": "$TC -s -j qdisc ls dev $ETH",
> + "matchJSON": [
> + {
> + "kind": "taprio",
> + "handle": "1:",
> + "bytes": 98,
> + "packets": 1,
> + "backlog": 0,
> + "qlen": 0
> + }
> + ],
> + "teardown": [
> + "$TC qdisc del dev $ETH handle 1: root",
> + "echo \"1\" > /sys/bus/netdevsim/del_device"
> + ]
> + },
> + {
> + "id": "0235",
> + "name": "Force taprio to dequeue from its child's gso_skb with dualpi2 leaf",
> + "category": [
> + "qdisc",
> + "tbf",
> + "taprio",
> + "dualpi2"
> + ],
> + "plugins": {
> + "requires": "nsPlugin"
> + },
> + "setup": [
> + "echo \"1 1 4\" > /sys/bus/netdevsim/new_device",
> + "$IP link set dev $ETH up || true",
> + "$IP l set addr 01:02:03:04:05:06 dev $ETH || true",
> + "$IP n add dev $ETH 10.10.11.1 lladdr 01:02:03:04:05:06 dev $ETH || true",
> + "$TC qdisc add dev $ETH root handle 1: taprio num_tc 2 map 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 queues 1@0 1@1 base-time 9000000000000000000 sched-entry S 03 200000 flags 0x0 clockid CLOCK_TAI",
> + "$TC qdisc replace dev $ETH parent 1:1 handle 3: dualpi2",
> + "$TC filter add dev $ETH parent 3: protocol ip prio 1 u32 match ip dst 10.10.11.1 classid 3:1 action ok"
> + ],
> + "cmdUnderTest": "ping -c 1 10.10.11.1 -W0.01 -I$ETH || true",
> + "expExitCode": "0",
> + "verifyCmd": "$TC -j -s qdisc ls dev $ETH handle 3:",
> + "matchJSON": [
> + {
> + "kind": "dualpi2",
> + "handle": "3:",
> + "bytes": 98,
> + "packets": 1,
> + "backlog": 0,
> + "qlen": 0
> + }
> + ],
> + "teardown": [
> + "$TC qdisc del dev $ETH handle 1: root",
> + "echo \"1\" > /sys/bus/netdevsim/del_device"
> + ]
> }
> ]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-30 15:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-30 15:36 [PATCH net] selftests/tc-testing: Add tests that force multiq and taprio to enqueue to child's gso_skb Victor Nogueira
2026-06-30 15:43 ` Pedro Tammela
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox