From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vs1-f46.google.com (mail-vs1-f46.google.com [209.85.217.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2C64539DBF4 for ; Fri, 26 Jun 2026 17:18:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.217.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782494289; cv=none; b=e0xNEM+H5RbkQtG3B2StEs92fhFwpTekXjOa7fmlHot0VSnouwv03tqL9Lq/ixoVDFdyf3AYb+4J9mbBnLrKW2t2E4zKB1U7qVgxbPJcz+9SRIoG1f4qyNn/MQG1lC+113GAeAkQy6eVwlUC5pZX3CLcqLAIk3Y0yRMksFpZLwI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782494289; c=relaxed/simple; bh=EjLyYEXY+jT0+beeDAekbvlNUwzaCX0goMmbdDDv2JM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=hb2LKhCLduXk9cnMvw/0t01+ocxOiEByUHuSg4VERb2XgqdrsXaMVRpkqqdg0f3XGD9D70JYK7pBhUgRUSUUAxPpKeurewt6apSAH1wmvx2Pos3WaKzZtSDzo0B/kb/jCB9q1F8VYJNN+XhZs2ZcN/xrQwfttx4phhGMys81AT8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mojatatu.com; spf=none smtp.mailfrom=mojatatu.com; dkim=pass (1024-bit key) header.d=mojatatu.com header.i=@mojatatu.com header.b=C06byR++; arc=none smtp.client-ip=209.85.217.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mojatatu.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=mojatatu.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mojatatu.com header.i=@mojatatu.com header.b="C06byR++" Received: by mail-vs1-f46.google.com with SMTP id ada2fe7eead31-73413da037eso583787137.1 for ; Fri, 26 Jun 2026 10:18:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu.com; s=google; t=1782494287; x=1783099087; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=C9VXl6VYO3SgtjDp+yfE7kugyX/R7fZfp1hlywtKsEc=; b=C06byR++tfXblrzfJUDOI76fcssjYePgY0IQjar+wMVMZ7/S+clVYJUyBcu4rmYt4C b2UDP7SMXbA2nL2PKiTCcwLzUl7gMIqR042XMTvkfSIneBMRoWKNJQLSxraSAImusnTw ku8JfBHp6nqvEHJwjlclJz5Hkmd2ilrVWdrPo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782494287; x=1783099087; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=C9VXl6VYO3SgtjDp+yfE7kugyX/R7fZfp1hlywtKsEc=; b=AnCb9enD6u8rq6iEzjtX0w+kE1+YvYsiO/25XPpQN49hBkweYbqoLBpvVA2rjVlW/p 4wShbMsN40t0bxTpsScNAUP67iFmrXLObuWiqxDL7N2/d4wO3WiGS1fX29TRc6alkJKJ iWH7uYWQbLKuomuH8Cc8Gn+Zm33z/QmQIZScHle/fhT99hQA4DXzHm2p/uabqVrx71kW PVowK8bKUPnUhaKHlQx8YeAudPepTn0+5afBkPmc8/GKsS4g7SZPjpqPwiODFs0hyB7e DU4vWlpAViJpoZK59c+lNLhxDGuHmAKqSSZmQbojPte5Kk+H91rQ18IT76ALAiVhWHQq v8WA== X-Forwarded-Encrypted: i=1; AHgh+Rp/tPm6oFVHc7F5I08bW8rWKDdt5NU18c5sNzEbmf+WVMQ20QTwAB5cyzhQJAo4xezz9pJ7DQTjjb1xbao=@vger.kernel.org X-Gm-Message-State: AOJu0YwwDKb0CQEy8NMIWTXO+5tmtOj3SlNdpyo690/nZDz/ybbk93th lTubFyeaYTuuaYBFPYaR1UImo4ZyTlTzKivgsD/9SPw06qQsBVop+mdoHX9NhtaBLw== X-Gm-Gg: AfdE7ckqeWQ+Te5VC4nGW37k3XrfzVkCKMOhQBo350INDc4GRvDKbiAyqj7GnJv9bcU tq/CwB2MPQnav0fpDnMn5r52qJOyvBPXZfUoWhnR2wBLfjqTsF6i2tzFehs1GDAi2D1T4VfF+sm lQrAIJ0Vqk6w7MN+xoUv5mhqrMdVOnaqfqXP2EDIbny0fIhuIUVx6sAsef+usO+6DZ5sd2X+KPW 597Z3f40vq/9OCdiP8FoTFUnv9KxfQHWHywNB8HLJf1CtiyxqIa0ZW6cY0PsVVIt1ege3m6njKz Izmg9yziv5O+fIAjJttni1hFCqC9dHVI+QEfaqIpBhcbgkJeihMYsW3wFPD2s/wmm4iuDb6CKEO Xv8kETtInDkS+f++Wun3ySmVJtBiqO6b9bgiwIjN2uerPbxGQDZRgp4ACE9sGxskxdFFo4xif0f prV+gGbLVIEnDZwlQNd8WLD4YgS0t7ahUZoFgnjY9XZKKJFw7Eoxg8Wv232m44ARPgJg== X-Received: by 2002:a05:6102:3e94:b0:633:f2bf:7de4 with SMTP id ada2fe7eead31-73434452a93mr4152791137.10.1782494287134; Fri, 26 Jun 2026 10:18:07 -0700 (PDT) Received: from ?IPV6:2804:14d:5c54:4d67:f17:d82a:d5b8:20a? ([2804:14d:5c54:4d67:f17:d82a:d5b8:20a]) by smtp.gmail.com with ESMTPSA id ada2fe7eead31-735697bb220sm1592107137.8.2026.06.26.10.18.02 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 26 Jun 2026 10:18:06 -0700 (PDT) Message-ID: Date: Fri, 26 Jun 2026 14:18:01 -0300 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 2/2] net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked To: hexlabsecurity@proton.me, Vinicius Costa Gomes , Paolo Abeni , Jamal Hadi Salim , Jiri Pirko , Jakub Kicinski , "David S. Miller" , Eric Dumazet Cc: Simon Horman , netdev@vger.kernel.org, Jarek Poplawski , Vladimir Oltean , linux-kernel@vger.kernel.org References: <20260625-b4-disp-31bcb279-v1-0-85c40b83c529@proton.me> <20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me> Content-Language: en-US From: Victor Nogueira In-Reply-To: <20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 25/06/2026 06:51, Bryam Vargas via B4 Relay wrote: > From: Bryam Vargas > > multiq_dequeue() takes a packet from a band's child with a direct > ->dequeue() call after multiq_peek() peeked it. When the child is > non-work-conserving the peek stashes the skb in the child's gso_skb, so > the direct dequeue returns a different skb and orphans the stash, > desyncing the child's qlen/backlog. With a qfq child reached through a > peeking parent (e.g. tbf) this re-enters the child on an emptied list and > dereferences NULL, panicking the kernel from softirq on ordinary egress. > > Take the packet through qdisc_dequeue_peeked(), as sch_prio already does > and as sch_red and sch_sfb were just fixed to do. The helper is a no-op > when the child has no stash, so a work-conserving child is unaffected. > > Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.") > Cc: stable@vger.kernel.org > Signed-off-by: Bryam Vargas Reviewed-by: Victor Nogueira