[PATCH net 0/2] Introduce CBS reset ops

QFQ uses qlen to check whether it should reset pointer q->in_serv_agg.
When QFQ has a CBS child which has a netem child it is possible to create a
scenario where QFQ's qlen goes to 0 but the computation makes it underflow.
This then aggrevates a null pointer deref.

Jamal Hadi Salim (1):
  net/sched: sch_cbs: Call qdisc_reset for child qdisc

Victor Nogueira (1):
  selftests/tc-testing: Add QFQ/CBS qlen underflow test

 net/sched/sch_cbs.c                           | 12 +++++-
 .../tc-testing/tc-tests/infra/qdiscs.json     | 41 +++++++++++++++++++
 2 files changed, 52 insertions(+), 1 deletion(-)

-- 
2.34.1