general protection fault in qdisc_tree_reduce_backlog
Subsystems (3)
syzbot
syzbotHello,
syzbot found the following issue on:
HEAD commit: bd475eeaaf3c Merge branch '200GbE' of git://git.kernel.org.. git tree: net console+strace: https://syzkaller.appspot.com/x/log.txt?x=12f0b3d4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8 dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06 compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=164d8c8c580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14839ebc580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d59bc82a55e0/disk-bd475eea.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a83759fceb6/vmlinux-bd475eea.xz
kernel image: https://storage.googleapis.com/syzbot-assets/07576fd8e432/bzImage-bd475eea.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 0 UID: 0 PID: 5835 Comm: syz-executor374 Not tainted 6.16.0-rc3-syzkaller-00144-gbd475eeaaf3c #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:qdisc_tree_reduce_backlog+0x223/0x480 net/sched/sch_api.c:806 Code: 89 ef e8 40 80 b3 f8 4d 89 ef 85 db 74 0d e8 74 fc 4f f8 4c 89 f5 e9 88 00 00 00 48 8b 6d 00 48 8d 45 20 48 89 c3 48 c1 eb 03 <42> 80 3c 33 00 48 89 04 24 74 0d 48 8b 3c 24 e8 09 80 b3 f8 48 8b RSP: 0018:ffffc900040bf0a8 EFLAGS: 00010202 RAX: 0000000000000020 RBX: 0000000000000004 RCX: 0000000000000000 RDX: ffff888031da3c00 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff888031da3c00 R09: 0000000000000002 R10: 00000000ffffffff R11: 0000000000000000 R12: 00000000000afff2 R13: ffff88802875a000 R14: dffffc0000000000 R15: ffff88802875a000 FS: 000055555b6b1380(0000) GS:ffff888125c50000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000240 CR3: 00000000726c2000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> fq_codel_change+0xa96/0xef0 net/sched/sch_fq_codel.c:450 fq_codel_init+0x355/0x960 net/sched/sch_fq_codel.c:487 qdisc_create+0x7ac/0xea0 net/sched/sch_api.c:1324 __tc_modify_qdisc net/sched/sch_api.c:1749 [inline] tc_modify_qdisc+0x1426/0x2010 net/sched/sch_api.c:1813 rtnetlink_rcv_msg+0x779/0xb70 net/core/rtnetlink.c:6953 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x75b/0x8d0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:727 ____sys_sendmsg+0x505/0x830 net/socket.c:2566 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620 __sys_sendmsg net/socket.c:2652 [inline] __do_sys_sendmsg net/socket.c:2657 [inline] __se_sys_sendmsg net/socket.c:2655 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2655 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f79d710a6a9 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff2ee70668 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fff2ee70838 RCX: 00007f79d710a6a9 RDX: 0000000000000800 RSI: 0000200000000100 RDI: 0000000000000003 RBP: 00007f79d717d610 R08: 0000000000000004 R09: 00007fff2ee70838 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fff2ee70828 R14: 0000000000000001 R15: 0000000000000001 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:qdisc_tree_reduce_backlog+0x223/0x480 net/sched/sch_api.c:806 Code: 89 ef e8 40 80 b3 f8 4d 89 ef 85 db 74 0d e8 74 fc 4f f8 4c 89 f5 e9 88 00 00 00 48 8b 6d 00 48 8d 45 20 48 89 c3 48 c1 eb 03 <42> 80 3c 33 00 48 89 04 24 74 0d 48 8b 3c 24 e8 09 80 b3 f8 48 8b RSP: 0018:ffffc900040bf0a8 EFLAGS: 00010202 RAX: 0000000000000020 RBX: 0000000000000004 RCX: 0000000000000000 RDX: ffff888031da3c00 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff888031da3c00 R09: 0000000000000002 R10: 00000000ffffffff R11: 0000000000000000 R12: 00000000000afff2 R13: ffff88802875a000 R14: dffffc0000000000 R15: ffff88802875a000 FS: 000055555b6b1380(0000) GS:ffff888125c50000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000240 CR3: 00000000726c2000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 89 ef mov %ebp,%edi 2: e8 40 80 b3 f8 call 0xf8b38047 7: 4d 89 ef mov %r13,%r15 a: 85 db test %ebx,%ebx c: 74 0d je 0x1b e: e8 74 fc 4f f8 call 0xf84ffc87 13: 4c 89 f5 mov %r14,%rbp 16: e9 88 00 00 00 jmp 0xa3 1b: 48 8b 6d 00 mov 0x0(%rbp),%rbp 1f: 48 8d 45 20 lea 0x20(%rbp),%rax 23: 48 89 c3 mov %rax,%rbx 26: 48 c1 eb 03 shr $0x3,%rbx * 2a: 42 80 3c 33 00 cmpb $0x0,(%rbx,%r14,1) <-- trapping instruction 2f: 48 89 04 24 mov %rax,(%rsp) 33: 74 0d je 0x42 35: 48 8b 3c 24 mov (%rsp),%rdi 39: e8 09 80 b3 f8 call 0xf8b38047 3e: 48 rex.W 3f: 8b .byte 0x8b
---
This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
syzbotFor archival purposes, forwarding an incoming command email to [email protected].
For archival purposes, forwarding an incoming command email to [email protected].
***
Subject: Re: [syzbot] [net?] general protection fault in qdisc_tree_reduce_backlog
Author: [email protected]
#syz test
net/sched/sch_api.c +3 -2
@@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)break ; } cops = sch->ops->cl_ops; -if (notify && cops->qlen_notify) { +if (cops && notify && cops->qlen_notify) {/* Note that qlen_notify must be idempotent as it may get called * multiple times. */ cl = cops->find (sch, parentid); - cops->qlen_notify (sch, cl); +if (virt_addr_valid (cl)) + cops->qlen_notify (sch, cl); } sch->q.qlen -= n; sch->qstats.backlog -= len;
Quoted 10 lines
Date: Thu, 03 Jul 2025 22:20:37 -0700
syzbot found the following issue on:HEAD commit: bd475eeaaf3c Merge branch '200GbE' of git://git.kernel.org.. git tree: net console+strace: https://syzkaller.appspot.com/x/log.txt?x=12f0b3d4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8 dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=164d8c8c580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14839ebc580000
#syz test
net/sched/sch_api.c +1 -1
@@ -803,7 +803,7 @@ void qdisc_tree_reduce_backlog(struct Qdbreak ; } cops = sch->ops->cl_ops; -if (notify && cops->qlen_notify) { +if (notify && cops && cops->qlen_notify) {/* Note that qlen_notify must be idempotent as it may get called * multiple times. */
--
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Tested on:
commit: 17bbde2e Merge tag 'net-6.16-rc5' of git://git.kernel... git tree: net console output: https://syzkaller.appspot.com/x/log.txt?x=1691ac8c580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a6dba31fc9bb876c dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06 compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7 patch: https://syzkaller.appspot.com/x/patch.diff?x=145eac8c580000
Note: testing is done by a robot and is best-effort only.
PATCH 1/1 net/sched: Prevent notify to parent who unsupport class ops
In reply to syzbotIf the parent qdisc does not support class operations then exit notify.
In addition, the validity of the cl value is judged before executing the notify. Similarly, the notify is exited when the address represented by its value is invalid.
--- net/sched/sch_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/sched/sch_api.c +3 -2
@@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)break ; } cops = sch->ops->cl_ops; -if (notify && cops->qlen_notify) { +if (cops && notify && cops->qlen_notify) {/* Note that qlen_notify must be idempotent as it may get called * multiple times. */ cl = cops->find (sch, parentid); - cops->qlen_notify (sch, cl); +if (virt_addr_valid (cl)) + cops->qlen_notify (sch, cl); } sch->q.qlen -= n; sch->qstats.backlog -= len;
Signature · 1 line
2.43.0
Paolo Abeni
maintainerRe: [PATCH] net/sched: Prevent notify to parent who unsupport class ops
Quoted 21 lines · Lizhi Xu
If the parent qdisc does not support class operations then exit notify.
In addition, the validity of the cl value is judged before executing the notify. Similarly, the notify is exited when the address represented by its value is invalid.
--- net/sched/sch_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)net/sched/sch_api.c +0
-0@@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)break ; }
net/sched/sch_api.c void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) · line 812
Quoted 10 lines
net/sched/sch_api.c +3
-2cops = sch->ops->cl_ops; -if (notify && cops->qlen_notify) { +if (cops && notify && cops->qlen_notify) {/* Note that qlen_notify must be idempotent as it may get called * multiple times. */ cl = cops->find (sch, parentid); - cops->qlen_notify (sch, cl); +if (virt_addr_valid (cl)) + cops->qlen_notify (sch, cl);
The above causes build failures in arm64 builds:
../net/sched/sch_api.c: In function ‘qdisc_tree_reduce_backlog’:
../arch/arm64/include/asm/memory.h:424:66: error: passing argument 1
of ‘virt_to_pfn’ makes pointer from integer without a cast [-Wint-conversion]
424 | __is_lm_address(__addr) &&
pfn_is_map_memory(virt_to_pfn(__addr)); \
/P
Re: [PATCH] net/sched: Prevent notify to parent who unsupport class ops
In reply to Lizhi Xu(Cc Victor)
Quoted 10 lines · Lizhi Xu
If the parent qdisc does not support class operations then exit notify.
In addition, the validity of the cl value is judged before executing the notify. Similarly, the notify is exited when the address represented by its value is invalid.
Victor also posted a fix here:
https://lore.kernel.org/netdev/[email protected]/
I asked Victor there if we still need to patchqdisc_tree_reduce_backlog().
Quoted 9 lines
--- net/sched/sch_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)net/sched/sch_api.c +0
-0
net/sched/sch_api.c void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) · line 806
Quoted 5 lines
net/sched/sch_api.c +1
-1@@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)break ; } cops = sch->ops->cl_ops; -if (notify && cops->qlen_notify) { +if (cops && notify && cops->qlen_notify) {
I think 'notify' should be tested first, as it was.
net/sched/sch_api.c void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) · line 811
Quoted 6 lines
net/sched/sch_api.c +1
-1/* Note that qlen_notify must be idempotent as it may get called * multiple times. */ cl = cops->find (sch, parentid); - cops->qlen_notify (sch, cl); +if (virt_addr_valid (cl))
This is not how we test NULL or error pointers. Just "if (cl)" should be sufficient for NULL case.
Thanks.
PATCH v2 1/1 net/sched: Prevent notify to parent who unsupport class ops
If the parent qdisc does not support class operations then exit notify.
In addition, the validity of the cl value is judged before executing the notify. Similarly, the notify is exited when the address represented by its value is invalid.
---
V1 -> V2: movie notify check first and check cl NULL
net/sched/sch_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/sched/sch_api.c +3 -2
@@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)break ; } cops = sch->ops->cl_ops; -if (notify && cops->qlen_notify) { +if (notify && cops && cops->qlen_notify) {/* Note that qlen_notify must be idempotent as it may get called * multiple times. */ cl = cops->find (sch, parentid); - cops->qlen_notify (sch, cl); +if (cl) + cops->qlen_notify (sch, cl); } sch->q.qlen -= n; sch->qstats.backlog -= len;
Signature · 1 line
2.43.0
Re: [PATCH V2] net/sched: Prevent notify to parent who unsupport class ops
Hi Lizhi,
Quoted 8 lines · Lizhi Xu
If the parent qdisc does not support class operations then exit notify.
In addition, the validity of the cl value is judged before executing the notify. Similarly, the notify is exited when the address represented by its value is invalid.
Maybe I didn't make it clear, I think Victor's patch also fixes this bug.
https://lore.kernel.org/netdev/[email protected]/
Can you check if you still see the crash with his fix?
The reason why I am asking is because his fix addresses a problem earlier on the code path, which possibly makes your fix unnecessary. Hence, his fix is closer to the root cause.
Please test and confirm.
Thanks!
Jamal Hadi Salim
maintainerRe: [PATCH V2] net/sched: Prevent notify to parent who unsupport class ops
Quoted 13 lines · Cong Wang
Hi Lizhi,
Quoted 8 lines · Lizhi Xu
If the parent qdisc does not support class operations then exit notify.
In addition, the validity of the cl value is judged before executing the notify. Similarly, the notify is exited when the address represented by its value is invalid.
Quoted 7 lines
Maybe I didn't make it clear, I think Victor's patch also fixes this bug.
https://lore.kernel.org/netdev/[email protected]/
Can you check if you still see the crash with his fix?
[email protected] (in this report) is part of what Victor's patch fixes (as listed in that patch).
cheers,
jamal
Quoted 6 lines
The reason why I am asking is because his fix addresses a problem earlier on the code path, which possibly makes your fix unnecessary. Hence, his fix is closer to the root cause.
Please test and confirm.
V
Quoted 1 line
Thanks!
syzbot
syzbotsyzbot has bisected this issue to:
syzbot has bisected this issue to:
commit 103406b38c600fec1fe375a77b27d87e314aea09
Author: Lion Ackermann <[email protected]> Date: Mon Jun 30 13:27:30 2025 +0000
net/sched: Always pass notifications when child class becomes empty
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13678582580000 start commit: bd475eeaaf3c Merge branch '200GbE' of git://git.kernel.org.. git tree: net final oops: https://syzkaller.appspot.com/x/report.txt?x=10e78582580000 console output: https://syzkaller.appspot.com/x/log.txt?x=17678582580000 kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8 dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=164d8c8c580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14839ebc580000
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Quoted 11 lines
Quoted 10 lines
Date: Thu, 03 Jul 2025 22:20:37 -0700
syzbot found the following issue on:HEAD commit: bd475eeaaf3c Merge branch '200GbE' of git://git.kernel.org.. git tree: net console+strace: https://syzkaller.appspot.com/x/log.txt?x=12f0b3d4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8 dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=164d8c8c580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14839ebc580000
Quoted 7 lines
Date: Fri, 4 Jul 2025 22:07:34 -0700 Cong Wang wrote:
Maybe I didn't make it clear, I think Victor's patch also fixes this bug.https://lore.kernel.org/netdev/[email protected]/
Can you check if you still see the crash with his fix?
#syz test
net/sched/sch_api.c +21 -10
@@ -336,17 +336,22 @@ out:return q; } -static struct Qdisc *qdisc_leaf (struct Qdisc *p,u32 classid) +static struct Qdisc *qdisc_leaf (struct Qdisc *p,u32 classid, +struct netlink_ext_ack *extack) {unsigned long cl;const struct Qdisc_class_ops *cops = p->ops->cl_ops; -if (cops ==NULL ) -return NULL ; +if (cops ==NULL ) { +NL_SET_ERR_MSG (extack,"Parent qdisc is not classful" ); +return ERR_PTR (-EOPNOTSUPP ); + } cl = cops->find (p, classid); -if (cl ==0 ) -return NULL ; +if (cl ==0 ) { +NL_SET_ERR_MSG (extack,"Specified class not found" ); +return ERR_PTR (-ENOENT ); + }return cops->leaf (p, cl); }
@@ -1490,16 +1495,20 @@ static int __tc_get_qdisc(struct sk_buffNL_SET_ERR_MSG (extack,"Failed to find qdisc with specified classid" );return -ENOENT ; } - q =qdisc_leaf (p, clid); + q =qdisc_leaf (p, clid, extack); }else if (dev_ingress_queue (dev)) { q =rtnl_dereference (dev_ingress_queue (dev)->qdisc_sleeping); } }else { q =rtnl_dereference (dev->qdisc); } -if (!q) { -NL_SET_ERR_MSG (extack,"Cannot find specified qdisc on specified device" ); -return -ENOENT ; +if (IS_ERR_OR_NULL (q)) { +if (!q) { +NL_SET_ERR_MSG (extack, +"Cannot find specified qdisc on specified device" ); +return -ENOENT ; + } +return PTR_ERR (q); }if (tcm->tcm_handle && q->handle != tcm->tcm_handle) {
@@ -1602,7 +1611,9 @@ static int __tc_modify_qdisc(struct sk_bNL_SET_ERR_MSG (extack,"Failed to find specified qdisc" );return -ENOENT ; } - q =qdisc_leaf (p, clid); + q =qdisc_leaf (p, clid, extack); +if (IS_ERR (q)) +return PTR_ERR (q); }else if (dev_ingress_queue_create (dev)) { q =rtnl_dereference (dev_ingress_queue (dev)->qdisc_sleeping); }
--
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Tested on:
commit: b9fd9888 bnxt_en: eliminate the compile warning in bnx.. git tree: net console output: https://syzkaller.appspot.com/x/log.txt?x=10742c8c580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a6dba31fc9bb876c dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06 compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7 patch: https://syzkaller.appspot.com/x/patch.diff?x=156f4f70580000
Note: testing is done by a robot and is best-effort only.