linux/net/sched/sch_cbs.c
Jamal Hadi Salim 320fb29ea2 net/sched: sch_cbs: Call qdisc_reset for child qdisc
During a reset, CBS is not calling reset on its child qdisc, which
might cause qlen/backlog accounting issues. For example, if we have CBS
with a QFQ parent and a netem child with delay, we can create a scenario
where the parent's qlen underflows. QFQ, specifically, uses qlen to
check whether it should deference a pointer, so this scenario may cause
a null-ptr deref in QFQ:

[   43.875639][  T319] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
[   43.876124][  T319] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
[   43.876417][  T319] CPU: 10 UID: 0 PID: 319 Comm: ping Not tainted 7.0.0-13039-ge728258debd5 #773 PREEMPT(full)
[   43.876751][  T319] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   43.876949][  T319] RIP: 0010:qfq_dequeue+0x35c/0x1650
[   43.877123][  T319] Code: 00 fc ff df 80 3c 02 00 0f 85 17 0e 00 00 4c 8d 73 48 48 89 9d b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 0c 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b
[   43.877648][  T319] RSP: 0018:ffff8881017ef4f0 EFLAGS: 00010216
[   43.877845][  T319] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000
[   43.878073][  T319] RDX: 0000000000000009 RSI: 0000000c40000000 RDI: ffff88810eef02b0
[   43.878306][  T319] RBP: ffff88810eef0000 R08: ffff88810eef0280 R09: 1ffff1102120fd63
[   43.878523][  T319] R10: 1ffff1102120fd66 R11: 1ffff1102120fd67 R12: 0000000c40000000
[   43.878742][  T319] R13: ffff88810eef02b8 R14: 0000000000000048 R15: 0000000020000000
[   43.878959][  T319] FS:  00007f9c51c47c40(0000) GS:ffff88817a0be000(0000) knlGS:0000000000000000
[   43.879214][  T319] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   43.879403][  T319] CR2: 000055e69a2230a8 CR3: 000000010c07a000 CR4: 0000000000750ef0
[   43.879621][  T319] PKRU: 55555554
[   43.879735][  T319] Call Trace:
[   43.879844][  T319]  <TASK>
[   43.879924][  T319]  __qdisc_run+0x169/0x1900
[   43.880075][  T319]  ? dev_qdisc_enqueue+0x8b/0x210
[   43.880222][  T319]  __dev_queue_xmit+0x2346/0x37a0
[   43.880376][  T319]  ? register_lock_class+0x3f/0x800
[   43.880531][  T319]  ? srso_alias_return_thunk+0x5/0xfbef5
[   43.880684][  T319]  ? __pfx___dev_queue_xmit+0x10/0x10
[   43.880834][  T319]  ? srso_alias_return_thunk+0x5/0xfbef5
[   43.880977][  T319]  ? __lock_acquire+0x819/0x1df0
[   43.881124][  T319]  ? srso_alias_return_thunk+0x5/0xfbef5
[   43.881275][  T319]  ? srso_alias_return_thunk+0x5/0xfbef5
[   43.881418][  T319]  ? __asan_memcpy+0x3c/0x60
[   43.881563][  T319]  ? srso_alias_return_thunk+0x5/0xfbef5
[   43.881708][  T319]  ? eth_header+0x165/0x1a0
[   43.881853][  T319]  ? lockdep_hardirqs_on_prepare+0xdb/0x1a0
[   43.882031][  T319]  ? srso_alias_return_thunk+0x5/0xfbef5
[   43.882174][  T319]  ? neigh_resolve_output+0x3cc/0x7e0
[   43.882325][  T319]  ? srso_alias_return_thunk+0x5/0xfbef5
[   43.882471][  T319]  ip_finish_output2+0x6b6/0x1e10

Fix this by calling qdisc_reset for CBS' child qdisc.
Sashiko caught an issue which could result in a null ptr deref if
qdisc_create_dflt() is invoked on an unitialised cbs qdisc which is exposed
by this patch. We add an early return if the qdisc is null to address this.
This is a similar approach used by two other fixes[1][2].

The proper fix for this specific issue elucidated by sashiko is to remove
the call to qdisc_reset when qdisc_create_dflt fails. Since the dflt qdisc
isn't attached anywhere yet at that point, calling the reset callback doesn't
make much sense (and as stated has been a source of two other bugs).
We plan on  submitting this fix in a later patch.
[1] https://lore.kernel.org/netdev/20221018063201.306474-2-shaozhengchao@huawei.com/
[2] https://lore.kernel.org/netdev/20221018063201.306474-4-shaozhengchao@huawei.com/

Fixes: 585d763af0 ("net/sched: Introduce Credit Based Shaper (CBS) qdisc")
Reported-by: Junyoung Jang <graypanda.inzag@gmail.com>
Tested-by: Junyoung Jang <graypanda.inzag@gmail.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-13 17:53:39 -07:00

593 lines
14 KiB
C

// SPDX-License-Identifier: GPL-2.0-or-later
/*
* net/sched/sch_cbs.c Credit Based Shaper
*
* Authors: Vinicius Costa Gomes <vinicius.gomes@intel.com>
*/
/* Credit Based Shaper (CBS)
* =========================
*
* This is a simple rate-limiting shaper aimed at TSN applications on
* systems with known traffic workloads.
*
* Its algorithm is defined by the IEEE 802.1Q-2014 Specification,
* Section 8.6.8.2, and explained in more detail in the Annex L of the
* same specification.
*
* There are four tunables to be considered:
*
* 'idleslope': Idleslope is the rate of credits that is
* accumulated (in kilobits per second) when there is at least
* one packet waiting for transmission. Packets are transmitted
* when the current value of credits is equal or greater than
* zero. When there is no packet to be transmitted the amount of
* credits is set to zero. This is the main tunable of the CBS
* algorithm.
*
* 'sendslope':
* Sendslope is the rate of credits that is depleted (it should be a
* negative number of kilobits per second) when a transmission is
* ocurring. It can be calculated as follows, (IEEE 802.1Q-2014 Section
* 8.6.8.2 item g):
*
* sendslope = idleslope - port_transmit_rate
*
* 'hicredit': Hicredit defines the maximum amount of credits (in
* bytes) that can be accumulated. Hicredit depends on the
* characteristics of interfering traffic,
* 'max_interference_size' is the maximum size of any burst of
* traffic that can delay the transmission of a frame that is
* available for transmission for this traffic class, (IEEE
* 802.1Q-2014 Annex L, Equation L-3):
*
* hicredit = max_interference_size * (idleslope / port_transmit_rate)
*
* 'locredit': Locredit is the minimum amount of credits that can
* be reached. It is a function of the traffic flowing through
* this qdisc (IEEE 802.1Q-2014 Annex L, Equation L-2):
*
* locredit = max_frame_size * (sendslope / port_transmit_rate)
*/
#include <linux/ethtool.h>
#include <linux/module.h>
#include <linux/types.h>
#include <linux/kernel.h>
#include <linux/string.h>
#include <linux/errno.h>
#include <linux/skbuff.h>
#include <linux/units.h>
#include <net/netevent.h>
#include <net/netlink.h>
#include <net/sch_generic.h>
#include <net/pkt_sched.h>
static LIST_HEAD(cbs_list);
static DEFINE_SPINLOCK(cbs_list_lock);
struct cbs_sched_data {
bool offload;
int queue;
atomic64_t port_rate; /* in bytes/s */
s64 last; /* timestamp in ns */
s64 credits; /* in bytes */
s32 locredit; /* in bytes */
s32 hicredit; /* in bytes */
s64 sendslope; /* in bytes/s */
s64 idleslope; /* in bytes/s */
struct qdisc_watchdog watchdog;
int (*enqueue)(struct sk_buff *skb, struct Qdisc *sch,
struct sk_buff **to_free);
struct sk_buff *(*dequeue)(struct Qdisc *sch);
struct Qdisc *qdisc;
struct list_head cbs_list;
};
static int cbs_child_enqueue(struct sk_buff *skb, struct Qdisc *sch,
struct Qdisc *child,
struct sk_buff **to_free)
{
unsigned int len = qdisc_pkt_len(skb);
int err;
err = child->ops->enqueue(skb, child, to_free);
if (err != NET_XMIT_SUCCESS)
return err;
sch->qstats.backlog += len;
sch->q.qlen++;
return NET_XMIT_SUCCESS;
}
static int cbs_enqueue_offload(struct sk_buff *skb, struct Qdisc *sch,
struct sk_buff **to_free)
{
struct cbs_sched_data *q = qdisc_priv(sch);
struct Qdisc *qdisc = q->qdisc;
return cbs_child_enqueue(skb, sch, qdisc, to_free);
}
static int cbs_enqueue_soft(struct sk_buff *skb, struct Qdisc *sch,
struct sk_buff **to_free)
{
struct cbs_sched_data *q = qdisc_priv(sch);
struct Qdisc *qdisc = q->qdisc;
if (sch->q.qlen == 0 && q->credits > 0) {
/* We need to stop accumulating credits when there's
* no enqueued packets and q->credits is positive.
*/
q->credits = 0;
q->last = ktime_get_ns();
}
return cbs_child_enqueue(skb, sch, qdisc, to_free);
}
static int cbs_enqueue(struct sk_buff *skb, struct Qdisc *sch,
struct sk_buff **to_free)
{
struct cbs_sched_data *q = qdisc_priv(sch);
return q->enqueue(skb, sch, to_free);
}
/* timediff is in ns, slope is in bytes/s */
static s64 timediff_to_credits(s64 timediff, s64 slope)
{
return div64_s64(timediff * slope, NSEC_PER_SEC);
}
static s64 delay_from_credits(s64 credits, s64 slope)
{
if (unlikely(slope == 0))
return S64_MAX;
return div64_s64(-credits * NSEC_PER_SEC, slope);
}
static s64 credits_from_len(unsigned int len, s64 slope, s64 port_rate)
{
if (unlikely(port_rate == 0))
return S64_MAX;
return div64_s64(len * slope, port_rate);
}
static struct sk_buff *cbs_child_dequeue(struct Qdisc *sch, struct Qdisc *child)
{
struct sk_buff *skb;
skb = child->ops->dequeue(child);
if (!skb)
return NULL;
qdisc_qstats_backlog_dec(sch, skb);
qdisc_bstats_update(sch, skb);
sch->q.qlen--;
return skb;
}
static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
{
struct cbs_sched_data *q = qdisc_priv(sch);
struct Qdisc *qdisc = q->qdisc;
s64 now = ktime_get_ns();
struct sk_buff *skb;
s64 credits;
int len;
/* The previous packet is still being sent */
if (now < q->last) {
qdisc_watchdog_schedule_ns(&q->watchdog, q->last);
return NULL;
}
if (q->credits < 0) {
credits = timediff_to_credits(now - q->last, q->idleslope);
credits = q->credits + credits;
q->credits = min_t(s64, credits, q->hicredit);
if (q->credits < 0) {
s64 delay;
delay = delay_from_credits(q->credits, q->idleslope);
qdisc_watchdog_schedule_ns(&q->watchdog, now + delay);
q->last = now;
return NULL;
}
}
skb = cbs_child_dequeue(sch, qdisc);
if (!skb)
return NULL;
len = qdisc_pkt_len(skb);
/* As sendslope is a negative number, this will decrease the
* amount of q->credits.
*/
credits = credits_from_len(len, q->sendslope,
atomic64_read(&q->port_rate));
credits += q->credits;
q->credits = max_t(s64, credits, q->locredit);
/* Estimate of the transmission of the last byte of the packet in ns */
if (unlikely(atomic64_read(&q->port_rate) == 0))
q->last = now;
else
q->last = now + div64_s64(len * NSEC_PER_SEC,
atomic64_read(&q->port_rate));
return skb;
}
static struct sk_buff *cbs_dequeue_offload(struct Qdisc *sch)
{
struct cbs_sched_data *q = qdisc_priv(sch);
struct Qdisc *qdisc = q->qdisc;
return cbs_child_dequeue(sch, qdisc);
}
static struct sk_buff *cbs_dequeue(struct Qdisc *sch)
{
struct cbs_sched_data *q = qdisc_priv(sch);
return q->dequeue(sch);
}
static void cbs_reset(struct Qdisc *sch)
{
struct cbs_sched_data *q = qdisc_priv(sch);
/* Nothing to do if we couldn't create the underlying qdisc */
if (!q->qdisc)
return;
qdisc_reset(q->qdisc);
qdisc_watchdog_cancel(&q->watchdog);
q->credits = 0;
q->last = 0;
}
static const struct nla_policy cbs_policy[TCA_CBS_MAX + 1] = {
[TCA_CBS_PARMS] = { .len = sizeof(struct tc_cbs_qopt) },
};
static void cbs_disable_offload(struct net_device *dev,
struct cbs_sched_data *q)
{
struct tc_cbs_qopt_offload cbs = { };
const struct net_device_ops *ops;
int err;
if (!q->offload)
return;
q->enqueue = cbs_enqueue_soft;
q->dequeue = cbs_dequeue_soft;
ops = dev->netdev_ops;
if (!ops->ndo_setup_tc)
return;
cbs.queue = q->queue;
cbs.enable = 0;
err = ops->ndo_setup_tc(dev, TC_SETUP_QDISC_CBS, &cbs);
if (err < 0)
pr_warn("Couldn't disable CBS offload for queue %d\n",
cbs.queue);
}
static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
const struct tc_cbs_qopt *opt,
struct netlink_ext_ack *extack)
{
const struct net_device_ops *ops = dev->netdev_ops;
struct tc_cbs_qopt_offload cbs = { };
int err;
if (!ops->ndo_setup_tc) {
NL_SET_ERR_MSG(extack, "Specified device does not support cbs offload");
return -EOPNOTSUPP;
}
cbs.queue = q->queue;
cbs.enable = 1;
cbs.hicredit = opt->hicredit;
cbs.locredit = opt->locredit;
cbs.idleslope = opt->idleslope;
cbs.sendslope = opt->sendslope;
err = ops->ndo_setup_tc(dev, TC_SETUP_QDISC_CBS, &cbs);
if (err < 0) {
NL_SET_ERR_MSG(extack, "Specified device failed to setup cbs hardware offload");
return err;
}
q->enqueue = cbs_enqueue_offload;
q->dequeue = cbs_dequeue_offload;
return 0;
}
static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
{
struct ethtool_link_ksettings ecmd;
int speed = SPEED_10;
s64 port_rate;
int err;
err = __ethtool_get_link_ksettings(dev, &ecmd);
if (err < 0)
goto skip;
if (ecmd.base.speed && ecmd.base.speed != SPEED_UNKNOWN)
speed = ecmd.base.speed;
skip:
port_rate = speed * 1000 * BYTES_PER_KBIT;
atomic64_set(&q->port_rate, port_rate);
netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n",
dev->name, (long long)atomic64_read(&q->port_rate),
ecmd.base.speed);
}
static int cbs_dev_notifier(struct notifier_block *nb, unsigned long event,
void *ptr)
{
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct cbs_sched_data *q;
struct net_device *qdev;
bool found = false;
ASSERT_RTNL();
if (event != NETDEV_UP && event != NETDEV_CHANGE)
return NOTIFY_DONE;
spin_lock(&cbs_list_lock);
list_for_each_entry(q, &cbs_list, cbs_list) {
qdev = qdisc_dev(q->qdisc);
if (qdev == dev) {
found = true;
break;
}
}
spin_unlock(&cbs_list_lock);
if (found)
cbs_set_port_rate(dev, q);
return NOTIFY_DONE;
}
static int cbs_change(struct Qdisc *sch, struct nlattr *opt,
struct netlink_ext_ack *extack)
{
struct cbs_sched_data *q = qdisc_priv(sch);
struct net_device *dev = qdisc_dev(sch);
struct nlattr *tb[TCA_CBS_MAX + 1];
struct tc_cbs_qopt *qopt;
int err;
err = nla_parse_nested_deprecated(tb, TCA_CBS_MAX, opt, cbs_policy,
extack);
if (err < 0)
return err;
if (!tb[TCA_CBS_PARMS]) {
NL_SET_ERR_MSG(extack, "Missing CBS parameter which are mandatory");
return -EINVAL;
}
qopt = nla_data(tb[TCA_CBS_PARMS]);
if (!qopt->offload) {
cbs_set_port_rate(dev, q);
cbs_disable_offload(dev, q);
} else {
err = cbs_enable_offload(dev, q, qopt, extack);
if (err < 0)
return err;
}
/* Everything went OK, save the parameters used. */
WRITE_ONCE(q->hicredit, qopt->hicredit);
WRITE_ONCE(q->locredit, qopt->locredit);
WRITE_ONCE(q->idleslope, qopt->idleslope * BYTES_PER_KBIT);
WRITE_ONCE(q->sendslope, qopt->sendslope * BYTES_PER_KBIT);
WRITE_ONCE(q->offload, qopt->offload);
return 0;
}
static int cbs_init(struct Qdisc *sch, struct nlattr *opt,
struct netlink_ext_ack *extack)
{
struct cbs_sched_data *q = qdisc_priv(sch);
struct net_device *dev = qdisc_dev(sch);
if (!opt) {
NL_SET_ERR_MSG(extack, "Missing CBS qdisc options which are mandatory");
return -EINVAL;
}
q->qdisc = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
sch->handle, extack);
if (!q->qdisc)
return -ENOMEM;
spin_lock(&cbs_list_lock);
list_add(&q->cbs_list, &cbs_list);
spin_unlock(&cbs_list_lock);
qdisc_hash_add(q->qdisc, false);
q->queue = sch->dev_queue - netdev_get_tx_queue(dev, 0);
q->enqueue = cbs_enqueue_soft;
q->dequeue = cbs_dequeue_soft;
qdisc_watchdog_init(&q->watchdog, sch);
return cbs_change(sch, opt, extack);
}
static void cbs_destroy(struct Qdisc *sch)
{
struct cbs_sched_data *q = qdisc_priv(sch);
struct net_device *dev = qdisc_dev(sch);
/* Nothing to do if we couldn't create the underlying qdisc */
if (!q->qdisc)
return;
qdisc_watchdog_cancel(&q->watchdog);
cbs_disable_offload(dev, q);
spin_lock(&cbs_list_lock);
list_del(&q->cbs_list);
spin_unlock(&cbs_list_lock);
qdisc_put(q->qdisc);
}
static int cbs_dump(struct Qdisc *sch, struct sk_buff *skb)
{
struct cbs_sched_data *q = qdisc_priv(sch);
struct tc_cbs_qopt opt = { };
struct nlattr *nest;
nest = nla_nest_start_noflag(skb, TCA_OPTIONS);
if (!nest)
goto nla_put_failure;
opt.hicredit = READ_ONCE(q->hicredit);
opt.locredit = READ_ONCE(q->locredit);
opt.sendslope = div64_s64(READ_ONCE(q->sendslope), BYTES_PER_KBIT);
opt.idleslope = div64_s64(READ_ONCE(q->idleslope), BYTES_PER_KBIT);
opt.offload = READ_ONCE(q->offload);
if (nla_put(skb, TCA_CBS_PARMS, sizeof(opt), &opt))
goto nla_put_failure;
return nla_nest_end(skb, nest);
nla_put_failure:
nla_nest_cancel(skb, nest);
return -1;
}
static int cbs_dump_class(struct Qdisc *sch, unsigned long cl,
struct sk_buff *skb, struct tcmsg *tcm)
{
struct cbs_sched_data *q = qdisc_priv(sch);
if (cl != 1 || !q->qdisc) /* only one class */
return -ENOENT;
tcm->tcm_handle |= TC_H_MIN(1);
tcm->tcm_info = q->qdisc->handle;
return 0;
}
static int cbs_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
struct Qdisc **old, struct netlink_ext_ack *extack)
{
struct cbs_sched_data *q = qdisc_priv(sch);
if (!new) {
new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
sch->handle, NULL);
if (!new)
new = &noop_qdisc;
}
*old = qdisc_replace(sch, new, &q->qdisc);
return 0;
}
static struct Qdisc *cbs_leaf(struct Qdisc *sch, unsigned long arg)
{
struct cbs_sched_data *q = qdisc_priv(sch);
return q->qdisc;
}
static unsigned long cbs_find(struct Qdisc *sch, u32 classid)
{
return 1;
}
static void cbs_walk(struct Qdisc *sch, struct qdisc_walker *walker)
{
if (!walker->stop) {
tc_qdisc_stats_dump(sch, 1, walker);
}
}
static const struct Qdisc_class_ops cbs_class_ops = {
.graft = cbs_graft,
.leaf = cbs_leaf,
.find = cbs_find,
.walk = cbs_walk,
.dump = cbs_dump_class,
};
static struct Qdisc_ops cbs_qdisc_ops __read_mostly = {
.id = "cbs",
.cl_ops = &cbs_class_ops,
.priv_size = sizeof(struct cbs_sched_data),
.enqueue = cbs_enqueue,
.dequeue = cbs_dequeue,
.peek = qdisc_peek_dequeued,
.init = cbs_init,
.reset = cbs_reset,
.destroy = cbs_destroy,
.change = cbs_change,
.dump = cbs_dump,
.owner = THIS_MODULE,
};
MODULE_ALIAS_NET_SCH("cbs");
static struct notifier_block cbs_device_notifier = {
.notifier_call = cbs_dev_notifier,
};
static int __init cbs_module_init(void)
{
int err;
err = register_netdevice_notifier(&cbs_device_notifier);
if (err)
return err;
err = register_qdisc(&cbs_qdisc_ops);
if (err)
unregister_netdevice_notifier(&cbs_device_notifier);
return err;
}
static void __exit cbs_module_exit(void)
{
unregister_qdisc(&cbs_qdisc_ops);
unregister_netdevice_notifier(&cbs_device_notifier);
}
module_init(cbs_module_init)
module_exit(cbs_module_exit)
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Credit Based shaper");