linux-kernel - Re: [REGRESSION] 6.14.3 panic - kernel NULL pointer dereference in htb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250427204254.6ae5cd4a@frodo.int.wylie.me.uk>
Date: Sun, 27 Apr 2025 20:42:54 +0100
From: "Alan J. Wylie" <alan@...ie.me.uk>
To: Cong Wang <xiyou.wangcong@...il.com>
Cc: Holger Hoffstätte <holger@...lied-asynchrony.com>,
 Jamal Hadi Salim <jhs@...atatu.com>, regressions@...ts.linux.dev, Jiri
 Pirko <jiri@...nulli.us>, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org, Octavian Purdila <tavip@...gle.com>, Toke
 Høiland-Jørgensen <toke@...hat.com>,
 stable@...r.kernel.org, Greg KH <gregkh@...uxfoundation.org>
Subject: Re: [REGRESSION] 6.14.3 panic - kernel NULL pointer dereference in
 htb_dequeue

On Sun, 27 Apr 2025 12:11:45 -0700
Cong Wang <xiyou.wangcong@...il.com> wrote:

Hi

> I just tried your reproducer in my VM since I don't have pppoe setup,
> after running ping flood (ping -f) bidirectionally for ~10 minutes, I
> still didn't get any warning or crash.
> 
> I also tried to reduce the bandwidth limit you set in your script to get
> traffic throttled, still no crash/warning.
> 
> Note, I just used the latest -net, without applying any extra patch.

That would be https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/ ?

I've just cloned that. I'll do a build and a test.

I disabled the cron job that ran my ip-up.d script every 5 mins, but left
it enabled to run when ppp came up.

I still had two panics today, I re-enabled netconsole after the first, the
second crashed in htb_dequeue+0x42f/0x610 [sch_htb] as previously.

Kernel config attached.

Just confirming I'm running the right version:

$ git clone --reference=linux-mirror/ https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/ linux-net

$ head Makefile 
VERSION = 6
PATCHLEVEL = 15
SUBLEVEL = 0
EXTRAVERSION = -rc3

$ git show HEAD
commit f73f05c6f711fd1628c7565441b9febc0c4d6c58 (HEAD -> main, origin/main, origin/HEAD)
Merge: 68f9d8974b54 e54b4db35e20
Author: Jakub Kicinski <kuba@...nel.org>
Date:   Fri Apr 25 19:06:58 2025 -0700

    Merge branch 'net-ethernet-mtk-star-emac-fix-several-issues-on-rx-tx-poll'

$ git log -p net/sched/

commit 6ccbda44e2cc3d26fd22af54c650d6d5d801addf
Author: Cong Wang <xiyou.wangcong@...il.com>
Date:   Thu Apr 17 11:47:31 2025 -0700

    net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too

-- 
Alan J. Wylie     https://www.wylie.me.uk/     mailto:<alan@...ie.me.uk>

Dance like no-one's watching. / Encrypt like everyone is.
Security is inversely proportional to convenience

Download attachment ".config.bz2" of type "application/x-bzip2" (29101 bytes)