Bug#921542: tc qdisc kernel crash

From	Cong Wang <xiyou.wangcong@gmail.com>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#921542: tc qdisc kernel crash
Date	2019-02-10 19:40 +0100
Message-ID	<xq2bf-4AQ-1@gated-at.bofh.it> (permalink)
References	<xoyIi-6Fe-5@gated-at.bofh.it> <xpZGq-2Yy-7@gated-at.bofh.it> <xoyIi-6Fe-5@gated-at.bofh.it> <xpZGq-2Yy-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

On Sun, Feb 10, 2019 at 7:54 AM Ben Hutchings <ben@decadent.org.uk> wrote:
>
> Control: tag -1 confirmed upstream
> Control: found -1 4.20-1~exp1
>
> Adrian (cc'd) reported (https://bugs.debian.org/921542) that a script
> using tc could trigger a kernel crash.  I've simplified the script he
> provided down to:
>
> --- BEGIN ---
> #!/bin/sh -ex
>
> modprobe ifb
>
> while true; do
>     tc qdisc add dev ifb0 root handle 2:0 prio bands 5
>     tc qdisc add dev ifb0 parent 2:5 sfq
>     tc filter add dev ifb0 parent 2:0 protocol ip prio 5 handle 0 tcindex mask 0 classid 2:5 pass_on
>     tc qdisc del dev ifb0 root || true
> done
> --- END ---
>
> The crash is still reproducible in 4.20 and 5.0-rc5.  KASan shows a
> use-after-free:

Thanks for the reproducer and report! I will send a fix.

Back to linux.debian.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#921542: tc qdisc kernel crash Ben Hutchings <ben@decadent.org.uk> - 2019-02-10 17:00 +0100
  Bug#921542: tc qdisc kernel crash Cong Wang <xiyou.wangcong@gmail.com> - 2019-02-10 19:40 +0100

csiph-web