From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.2 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,MAILING_LIST_MULTI, NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF063C433B4 for ; Thu, 8 Apr 2021 15:26:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B49D3610FB for ; Thu, 8 Apr 2021 15:26:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232013AbhDHP0S (ORCPT ); Thu, 8 Apr 2021 11:26:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36442 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231940AbhDHP0Q (ORCPT ); Thu, 8 Apr 2021 11:26:16 -0400 Received: from mail-wr1-x435.google.com (mail-wr1-x435.google.com [IPv6:2a00:1450:4864:20::435]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C2E28C061761; Thu, 8 Apr 2021 08:26:03 -0700 (PDT) Received: by mail-wr1-x435.google.com with SMTP id a6so2568944wrw.8; Thu, 08 Apr 2021 08:26:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=Ro0Cl2ZMCuXrJ9b0fwLjjBLrLgPpPx9T1CglyBY8Flg=; b=P85wMwKSOkDlLreR0HNgYwJ1GmjO4jq9t5vfV7E89O+QZXOoYFAkX6SjMlB+uxsw+p BoeunuwoUC81jaKLFHWHpr9SdclpMnmlDPI/LODZugl2ZakbfcBqoWogM0gIB4B5OY// rYLHvt62VJheycqLfTRe+eZoL93Zl418mvZDWWrYt9R4q7VUzu1HSyR5KdK1YoSNNVOX PisULAy8S8r3a3UdVT5MB82WlwWeSRb9/atdSk+V4fAYqOhCnGLbarrRh/W3lORYstW/ QjPJJZm26UY5xmh2S2rQlFnmrOjI4vbIGhZYMiK5rA5LqWLci+uCfcxEJufHEEO8mIzq oTQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=Ro0Cl2ZMCuXrJ9b0fwLjjBLrLgPpPx9T1CglyBY8Flg=; b=Zq8WJZdfsv6S0FAjPJf5Ylmv1feYHxn75aH+MGkX0QPej0Q8QDxAvSIVKib4UfKZ8j Lzsam2fYufXvZv8/6jRZBJva/zJx8M/YM7sTG64BqnORvxxp0y5bAUPiCAK4htqs6HYA q7XWn5s8KffQqvlhL/eg2Nf1gyZdKn8raJex6k3eWgTlPajupcT3jy1vrq3cYQZ0Gmfn RaCuA1T+ye0Wm+IWQ4gdUtOzOEIFQosrQcmeUS4mf0CgqeZ9KqxgpwhRquUTH0cAFcgy S57PwSjpGyyHoZL4kHetEE5inclPP6TDNVeuiLIemUI/oNlRWsWaYEHt9tTz9okLbkpZ l2/Q== X-Gm-Message-State: AOAM5327z1tk5c9/lPtpyAA2yivPB5TWc7fLcxuqnCjPChKeL/ftvZl6 j1l6gS2X5kvnNXgoNDpcWnYWVmHvUVo= X-Google-Smtp-Source: ABdhPJzQTZpDMTEJAtpbeLvim8ocsgXHIy0vNqV+oCBbYFFS74wHPGylxgWdlTuc2AJXqKjZBhxbvQ== X-Received: by 2002:a5d:564a:: with SMTP id j10mr12047785wrw.120.1617895562259; Thu, 08 Apr 2021 08:26:02 -0700 (PDT) Received: from [192.168.1.101] ([37.165.75.160]) by smtp.gmail.com with ESMTPSA id 91sm51459253wrl.20.2021.04.08.08.26.01 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 08 Apr 2021 08:26:01 -0700 (PDT) Subject: Re: [PATCH] net: sched: sch_teql: fix null-pointer dereference To: Pavel Tikhomirov , Jamal Hadi Salim , Cong Wang , Jiri Pirko Cc: "David S. Miller" , Jakub Kicinski , netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20210408151431.9512-1-ptikhomirov@virtuozzo.com> From: Eric Dumazet Message-ID: <0c385039-3780-b5d0-ba36-c1c51da9bc08@gmail.com> Date: Thu, 8 Apr 2021 17:26:00 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.8.0 MIME-Version: 1.0 In-Reply-To: <20210408151431.9512-1-ptikhomirov@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 4/8/21 5:14 PM, Pavel Tikhomirov wrote: > Reproduce: > > modprobe sch_teql > tc qdisc add dev teql0 root teql0 > > This leads to (for instance in Centos 7 VM) OOPS: > > > > Null pointer dereference happens on master->slaves dereference in > teql_destroy() as master is null-pointer. > > When qdisc_create() calls teql_qdisc_init() it imediately fails after > check "if (m->dev == dev)" because both devices are teql0, and it does > not set qdisc_priv(sch)->m leaving it zero on error path, then > qdisc_create() imediately calls teql_destroy() which does not expect > zero master pointer and we get OOPS. > > Signed-off-by: Pavel Tikhomirov > --- This makes sense, thanks ! Reviewed-by: Eric Dumazet I would think bug origin is Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation") Can you confirm you have this backported to 3.10.0-1062.7.1.el7.x86_64 ?