Hi Pedro, On 6/21/24 11:24 오후, Pedro Tammela wrote: > On 21/06/2024 08:45, yskelg@gmail.com wrote: >> From: Yunseong Kim >> >> In the TRACE_EVENT(qdisc_reset) NULL dereference occurred from >> >>   qdisc->dev_queue->dev ->name >> >> This situation simulated from bunch of veths and Bluetooth >> dis/reconnection. >> >> During qdisc initialization, qdisc was being set to noop_queue. >> In veth_init_queue, the initial tx_num was reduced back to one, >> causing the qdisc reset to be called with noop, which led to the >> kernel panic. >> >> I think this will happen on the kernel version. >>   Linux kernel version ≥ v6.7.10, ≥ v6.8 ≥ v6.9 and 6.10 > > You should tag your patch for the net tree Thank you for the code review, I will tag the next patch for the net tree. >> This occurred from 51270d573a8d. I think this patch is absolutely >> necessary. Previously, It was showing not intended string value of name. > Add a 'Fixes:' tag with this commit I will added 'Fixes: 51270d573a8d' Tag on patch v2 message. >> I can attach a sys-execprog's executing program, kernel dump and dmesg >> if someone need it, but I'm not sure how to safely attach large vmcore >> with vmlinux. > > The syzkaller program + C reproducer is usually enough, please make it > visible somewhere I got it, I have a converted C syz program. So, I've attached the GitHub gist link and C source code in this mail. https://gist.github.com/yskelg/cc64562873ce249cdd0d5a358b77d740 >> Signed-off-by: Yunseong Kim , Yeoreum Yun >> > > Should be two SoB tags Oh, It's the first time we've sent together, I made a mistake.. Sorry. Thank you Pedro for the advice! >> --- >>   include/trace/events/qdisc.h | 2 +- >>   1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/include/trace/events/qdisc.h b/include/trace/events/qdisc.h >> index f1b5e816e7e5..170b51fbe47a 100644 >> --- a/include/trace/events/qdisc.h >> +++ b/include/trace/events/qdisc.h >> @@ -81,7 +81,7 @@ TRACE_EVENT(qdisc_reset, >>       TP_ARGS(q), >>         TP_STRUCT__entry( >> -        __string(    dev,        qdisc_dev(q)->name    ) >> +        __string(dev, qdisc_dev(q) ? qdisc_dev(q)->name : "noop_queue") >>           __string(    kind,        q->ops->id        ) >>           __field(    u32,        parent            ) >>           __field(    u32,        handle            ) > Warm Regards, Yunseong Kim