linux-kernel - Re: [REGRESSION] 6.14.3 panic - kernel NULL pointer dereference in htb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250424135331.02511131@frodo.int.wylie.me.uk>
Date: Thu, 24 Apr 2025 13:53:31 +0100
From: "Alan J. Wylie" <alan@...ie.me.uk>
To: Cong Wang <xiyou.wangcong@...il.com>
Cc: Holger Hoffstätte <holger@...lied-asynchrony.com>,
 Jamal Hadi Salim <jhs@...atatu.com>, regressions@...ts.linux.dev, Jiri
 Pirko <jiri@...nulli.us>, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org, Octavian Purdila <tavip@...gle.com>, Toke
 Høiland-Jørgensen <toke@...hat.com>,
 stable@...r.kernel.org, Greg KH <gregkh@...uxfoundation.org>
Subject: Re: [REGRESSION] 6.14.3 panic - kernel NULL pointer dereference in
 htb_dequeue

> On Tue, Apr 22, 2025 at 07:20:24PM +0200, Holger Hoffstätte wrote:

> Meanwhile, if you could provide a reliable (and ideally minimum)
> reproducer, it would help me a lot to debug.

I've found a reproducer. Below is a stripped down version of the shell script
that I posted in my initial report.

Running this in a 1 second loop is enough to cause the panic very quickly.

It seems a bit of network traffic is needed, too.


# while true; do ./tc.sh; sleep 1; done
13:33:43 7196kbit 29296kbit
13:33:44 7196kbit 29296kbit
...
13:35:38 7196kbit 29296kbit
13:35:39 7196kbit 29296kbit
[panic]

# while true; do ./tc.sh; sleep 1; done
13:44:31 7196kbit 29296kbit
13:44:32 7196kbit 29296kbit
...
13:44:52 7196kbit 29296kbit
13:44:53 7196kbit 29296kbit
[panic]

The same place as usual
 htb_dequeue+0x42f/0x610 [sch_htb]

--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<
#!/usr/bin/bash

set -o nounset
set -o errexit

export PATH=/usr/bin

ext=ppp0
ext_ingress=ppp0ifb0

ext_up=7196kbit
ext_down=29296kbit

printf "%(%T)T $ext_up $ext_down\n"

q=1486
quantum=300

modprobe act_mirred
modprobe ifb
modprobe sch_cake
modprobe sch_fq_codel

ethtool -K "$ext" tso off gso off gro off 

tc qdisc del dev "$ext" root		>& /dev/null || true
tc qdisc del dev "$ext" ingress		>& /dev/null || true
tc qdisc del dev "$ext_ingress" root	>& /dev/null || true
tc qdisc del dev "$ext_ingress" ingress	>& /dev/null || true
ip link del "$ext_ingress"  		>& /dev/null || true

tc qdisc add dev "$ext" handle ffff: ingress

ip link add name "$ext_ingress"  type ifb
ip link set dev "$ext_ingress" up || true 

tc filter add dev "$ext" parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev "$ext_ingress"
tc qdisc add dev "$ext_ingress" root handle 1: htb default 11 r2q 20
tc class add dev "$ext_ingress" parent 1: classid 1:1 htb rate $ext_down 
tc class add dev "$ext_ingress" parent 1:1 classid 1:11 htb rate $ext_down prio 0 quantum $q
tc qdisc add dev "$ext_ingress" parent 1:11 fq_codel quantum $quantum ecn
tc qdisc add dev "$ext" root handle 1: htb default 11
tc class add dev "$ext" parent 1: classid 1:1 htb rate $ext_up
tc class add dev "$ext" parent 1:1 classid 1:11 htb rate $ext_up prio 0 quantum $q
tc qdisc add dev "$ext" parent 1:11 fq_codel quantum $quantum noecn
--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<

-- 
Alan J. Wylie     https://www.wylie.me.uk/     mailto:<alan@...ie.me.uk>

Dance like no-one's watching. / Encrypt like everyone is.
Security is inversely proportional to convenience