[syzbot] [net?] general protection fault in qdisc_tree_reduce_backlog

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: bd475eeaaf3c Merge branch '200GbE' of git://git.kernel.org..
git tree: net
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12f0b3d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8
dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=164d8c8c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14839ebc580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d59bc82a55e0/disk-bd475eea.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a83759fceb6/vmlinux-bd475eea.xz
kernel image: https://storage.googleapis.com/syzbot-assets/07576fd8e432/bzImage-bd475eea.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+126167...@syzkaller.appspotmail.com

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 UID: 0 PID: 5835 Comm: syz-executor374 Not tainted 6.16.0-rc3-syzkaller-00144-gbd475eeaaf3c #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:qdisc_tree_reduce_backlog+0x223/0x480 net/sched/sch_api.c:806
Code: 89 ef e8 40 80 b3 f8 4d 89 ef 85 db 74 0d e8 74 fc 4f f8 4c 89 f5 e9 88 00 00 00 48 8b 6d 00 48 8d 45 20 48 89 c3 48 c1 eb 03 <42> 80 3c 33 00 48 89 04 24 74 0d 48 8b 3c 24 e8 09 80 b3 f8 48 8b
RSP: 0018:ffffc900040bf0a8 EFLAGS: 00010202
RAX: 0000000000000020 RBX: 0000000000000004 RCX: 0000000000000000
RDX: ffff888031da3c00 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff888031da3c00 R09: 0000000000000002
R10: 00000000ffffffff R11: 0000000000000000 R12: 00000000000afff2
R13: ffff88802875a000 R14: dffffc0000000000 R15: ffff88802875a000
FS: 000055555b6b1380(0000) GS:ffff888125c50000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000240 CR3: 00000000726c2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
fq_codel_change+0xa96/0xef0 net/sched/sch_fq_codel.c:450
fq_codel_init+0x355/0x960 net/sched/sch_fq_codel.c:487
qdisc_create+0x7ac/0xea0 net/sched/sch_api.c:1324
__tc_modify_qdisc net/sched/sch_api.c:1749 [inline]
tc_modify_qdisc+0x1426/0x2010 net/sched/sch_api.c:1813
rtnetlink_rcv_msg+0x779/0xb70 net/core/rtnetlink.c:6953
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2534
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x75b/0x8d0 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:727
____sys_sendmsg+0x505/0x830 net/socket.c:2566
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620
__sys_sendmsg net/socket.c:2652 [inline]
__do_sys_sendmsg net/socket.c:2657 [inline]
__se_sys_sendmsg net/socket.c:2655 [inline]
__x64_sys_sendmsg+0x19b/0x260 net/socket.c:2655
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f79d710a6a9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff2ee70668 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fff2ee70838 RCX: 00007f79d710a6a9
RDX: 0000000000000800 RSI: 0000200000000100 RDI: 0000000000000003
RBP: 00007f79d717d610 R08: 0000000000000004 R09: 00007fff2ee70838
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff2ee70828 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:qdisc_tree_reduce_backlog+0x223/0x480 net/sched/sch_api.c:806
Code: 89 ef e8 40 80 b3 f8 4d 89 ef 85 db 74 0d e8 74 fc 4f f8 4c 89 f5 e9 88 00 00 00 48 8b 6d 00 48 8d 45 20 48 89 c3 48 c1 eb 03 <42> 80 3c 33 00 48 89 04 24 74 0d 48 8b 3c 24 e8 09 80 b3 f8 48 8b
RSP: 0018:ffffc900040bf0a8 EFLAGS: 00010202
RAX: 0000000000000020 RBX: 0000000000000004 RCX: 0000000000000000
RDX: ffff888031da3c00 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff888031da3c00 R09: 0000000000000002
R10: 00000000ffffffff R11: 0000000000000000 R12: 00000000000afff2
R13: ffff88802875a000 R14: dffffc0000000000 R15: ffff88802875a000
FS: 000055555b6b1380(0000) GS:ffff888125c50000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000240 CR3: 00000000726c2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 ef mov %ebp,%edi
2: e8 40 80 b3 f8 call 0xf8b38047
7: 4d 89 ef mov %r13,%r15
a: 85 db test %ebx,%ebx
c: 74 0d je 0x1b
e: e8 74 fc 4f f8 call 0xf84ffc87
13: 4c 89 f5 mov %r14,%rbp
16: e9 88 00 00 00 jmp 0xa3
1b: 48 8b 6d 00 mov 0x0(%rbp),%rbp
1f: 48 8d 45 20 lea 0x20(%rbp),%rax
23: 48 89 c3 mov %rax,%rbx
26: 48 c1 eb 03 shr $0x3,%rbx
* 2a: 42 80 3c 33 00 cmpb $0x0,(%rbx,%r14,1) <-- trapping instruction
2f: 48 89 04 24 mov %rax,(%rsp)
33: 74 0d je 0x42
35: 48 8b 3c 24 mov (%rsp),%rdi
39: e8 09 80 b3 f8 call 0xf8b38047
3e: 48 rex.W
3f: 8b .byte 0x8b


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Lizhi Xu]

#syz test

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index d8a33486c51..7f32347971f 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)
break;
}
cops = sch->ops->cl_ops;
- if (notify && cops->qlen_notify) {
+ if (cops && notify && cops->qlen_notify) {
/* Note that qlen_notify must be idempotent as it may get called
* multiple times.
*/
cl = cops->find(sch, parentid);
- cops->qlen_notify(sch, cl);
+ if (virt_addr_valid(cl))
+ cops->qlen_notify(sch, cl);
}
sch->q.qlen -= n;
sch->qstats.backlog -= len;

[Hillf Danton]

> Date: Thu, 03 Jul 2025 22:20:37 -0700

> syzbot found the following issue on:
>
> HEAD commit: bd475eeaaf3c Merge branch '200GbE' of git://git.kernel.org..
> git tree: net
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12f0b3d4580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8
> dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06

> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=164d8c8c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14839ebc580000

#syz test

--- x/net/sched/sch_api.c
+++ y/net/sched/sch_api.c
@@ -803,7 +803,7 @@ void qdisc_tree_reduce_backlog(struct Qd

break;
}
cops = sch->ops->cl_ops;
- if (notify && cops->qlen_notify) {

+ if (notify && cops && cops->qlen_notify) {

/* Note that qlen_notify must be idempotent as it may get called
* multiple times.
*/

--

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+126167...@syzkaller.appspotmail.com
Tested-by: syzbot+126167...@syzkaller.appspotmail.com

Tested on:

commit: 17bbde2e Merge tag 'net-6.16-rc5' of git://git.kernel...
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=17ea0f70580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a6dba31fc9bb876c

dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

patch: https://syzkaller.appspot.com/x/patch.diff?x=1698548c580000

Note: testing is done by a robot and is best-effort only.

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+126167...@syzkaller.appspotmail.com
Tested-by: syzbot+126167...@syzkaller.appspotmail.com

Tested on:

commit: 17bbde2e Merge tag 'net-6.16-rc5' of git://git.kernel...
git tree: net

console output: https://syzkaller.appspot.com/x/log.txt?x=1691ac8c580000

kernel config: https://syzkaller.appspot.com/x/.config?x=a6dba31fc9bb876c
dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

patch: https://syzkaller.appspot.com/x/patch.diff?x=145eac8c580000

[Lizhi Xu]

If the parent qdisc does not support class operations then exit notify.

In addition, the validity of the cl value is judged before executing the
notify. Similarly, the notify is exited when the address represented by
its value is invalid.

Reported-by: syzbot+126167...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
Tested-by: syzbot+126167...@syzkaller.appspotmail.com
Signed-off-by: Lizhi Xu <lizh...@windriver.com>
---
net/sched/sch_api.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index d8a33486c51..53fd63af14d 100644

--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)

break;
}
cops = sch->ops->cl_ops;
- if (notify && cops->qlen_notify) {

+ if (cops && notify && cops->qlen_notify) {

/* Note that qlen_notify must be idempotent as it may get called
* multiple times.
*/

cl = cops->find(sch, parentid);
- cops->qlen_notify(sch, cl);
+ if (virt_addr_valid(cl))
+ cops->qlen_notify(sch, cl);
}
sch->q.qlen -= n;
sch->qstats.backlog -= len;

--
2.43.0

[syzbot]

syzbot has bisected this issue to:

commit 103406b38c600fec1fe375a77b27d87e314aea09
Author: Lion Ackermann <nna...@gmail.com>
Date: Mon Jun 30 13:27:30 2025 +0000

net/sched: Always pass notifications when child class becomes empty

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13678582580000
start commit: bd475eeaaf3c Merge branch '200GbE' of git://git.kernel.org..
git tree: net
final oops: https://syzkaller.appspot.com/x/report.txt?x=10e78582580000
console output: https://syzkaller.appspot.com/x/log.txt?x=17678582580000

kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8
dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=164d8c8c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14839ebc580000

Reported-by: syzbot+126167...@syzkaller.appspotmail.com
Fixes: 103406b38c60 ("net/sched: Always pass notifications when child class becomes empty")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Paolo Abeni]

The above causes build failures in arm64 builds:

../net/sched/sch_api.c: In function ‘qdisc_tree_reduce_backlog’:
../arch/arm64/include/asm/memory.h:424:66: error: passing argument 1
of ‘virt_to_pfn’ makes pointer from integer without a cast
[-Wint-conversion]
424 | __is_lm_address(__addr) &&
pfn_is_map_memory(virt_to_pfn(__addr)); \

/P

[Cong Wang]

(Cc Victor)

On Fri, Jul 04, 2025 at 04:04:21PM +0800, Lizhi Xu wrote:
> If the parent qdisc does not support class operations then exit notify.
>
> In addition, the validity of the cl value is judged before executing the
> notify. Similarly, the notify is exited when the address represented by
> its value is invalid.
>
> Reported-by: syzbot+126167...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
> Tested-by: syzbot+126167...@syzkaller.appspotmail.com
> Signed-off-by: Lizhi Xu <lizh...@windriver.com>

Victor also posted a fix here:
https://lore.kernel.org/netdev/20250704163422....@mojatatu.com/

I asked Victor there if we still need to patch
qdisc_tree_reduce_backlog().

> ---
> net/sched/sch_api.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
> index d8a33486c51..53fd63af14d 100644
> --- a/net/sched/sch_api.c
> +++ b/net/sched/sch_api.c
> @@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)
> break;
> }
> cops = sch->ops->cl_ops;
> - if (notify && cops->qlen_notify) {
> + if (cops && notify && cops->qlen_notify) {

I think 'notify' should be tested first, as it was.

> /* Note that qlen_notify must be idempotent as it may get called
> * multiple times.
> */
> cl = cops->find(sch, parentid);
> - cops->qlen_notify(sch, cl);
> + if (virt_addr_valid(cl))

This is not how we test NULL or error pointers. Just "if (cl)" should
be sufficient for NULL case.

Thanks.

[Lizhi Xu]

If the parent qdisc does not support class operations then exit notify.

In addition, the validity of the cl value is judged before executing the
notify. Similarly, the notify is exited when the address represented by
its value is invalid.

Reported-by: syzbot+126167...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
Tested-by: syzbot+126167...@syzkaller.appspotmail.com
Signed-off-by: Lizhi Xu <lizh...@windriver.com>

---
V1 -> V2: movie notify check first and check cl NULL

net/sched/sch_api.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index d8a33486c51..53fd63af14d 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)
break;
}
cops = sch->ops->cl_ops;
- if (notify && cops->qlen_notify) {

+ if (notify && cops && cops->qlen_notify) {

/* Note that qlen_notify must be idempotent as it may get called
* multiple times.
*/
cl = cops->find(sch, parentid);
- cops->qlen_notify(sch, cl);

+ if (cl)

[Cong Wang]

Hi Lizhi,

On Sat, Jul 05, 2025 at 09:18:22AM +0800, Lizhi Xu wrote:
> If the parent qdisc does not support class operations then exit notify.
>
> In addition, the validity of the cl value is judged before executing the
> notify. Similarly, the notify is exited when the address represented by
> its value is invalid.
>
> Reported-by: syzbot+126167...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06

Maybe I didn't make it clear, I think Victor's patch also fixes this
bug.

https://lore.kernel.org/netdev/20250704163422....@mojatatu.com/

Can you check if you still see the crash with his fix?

The reason why I am asking is because his fix addresses a problem
earlier on the code path, which possibly makes your fix unnecessary.
Hence, his fix is closer to the root cause.

Please test and confirm.

Thanks!

[Hillf Danton]

> > Date: Thu, 03 Jul 2025 22:20:37 -0700

> > syzbot found the following issue on:
> >
> > HEAD commit: bd475eeaaf3c Merge branch '200GbE' of git://git.kernel.org..
> > git tree: net
> > console+strace: https://syzkaller.appspot.com/x/log.txt?x=12f0b3d4580000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8
> > dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06

> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=164d8c8c580000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14839ebc580000
>

> Date: Fri, 4 Jul 2025 22:07:34 -0700 Cong Wang wrote:
> Maybe I didn't make it clear, I think Victor's patch also fixes this
> bug.
>
> https://lore.kernel.org/netdev/20250704163422....@mojatatu.com/
>
> Can you check if you still see the crash with his fix?

#syz test

--- x/net/sched/sch_api.c
+++ y/net/sched/sch_api.c

@@ -336,17 +336,22 @@ out:
return q;
}

-static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
+static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid,
+ struct netlink_ext_ack *extack)
{
unsigned long cl;
const struct Qdisc_class_ops *cops = p->ops->cl_ops;

- if (cops == NULL)
- return NULL;
+ if (cops == NULL) {
+ NL_SET_ERR_MSG(extack, "Parent qdisc is not classful");
+ return ERR_PTR(-EOPNOTSUPP);
+ }
cl = cops->find(p, classid);

- if (cl == 0)
- return NULL;
+ if (cl == 0) {
+ NL_SET_ERR_MSG(extack, "Specified class not found");
+ return ERR_PTR(-ENOENT);
+ }
return cops->leaf(p, cl);
}

@@ -1490,16 +1495,20 @@ static int __tc_get_qdisc(struct sk_buff
NL_SET_ERR_MSG(extack, "Failed to find qdisc with specified classid");
return -ENOENT;
}
- q = qdisc_leaf(p, clid);
+ q = qdisc_leaf(p, clid, extack);
} else if (dev_ingress_queue(dev)) {
q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
}
} else {
q = rtnl_dereference(dev->qdisc);
}
- if (!q) {
- NL_SET_ERR_MSG(extack, "Cannot find specified qdisc on specified device");
- return -ENOENT;
+ if (IS_ERR_OR_NULL(q)) {
+ if (!q) {
+ NL_SET_ERR_MSG(extack,
+ "Cannot find specified qdisc on specified device");
+ return -ENOENT;
+ }
+ return PTR_ERR(q);
}

if (tcm->tcm_handle && q->handle != tcm->tcm_handle) {
@@ -1602,7 +1611,9 @@ static int __tc_modify_qdisc(struct sk_b
NL_SET_ERR_MSG(extack, "Failed to find specified qdisc");
return -ENOENT;
}
- q = qdisc_leaf(p, clid);
+ q = qdisc_leaf(p, clid, extack);
+ if (IS_ERR(q))
+ return PTR_ERR(q);
} else if (dev_ingress_queue_create(dev)) {
q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
}
--

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+126167...@syzkaller.appspotmail.com
Tested-by: syzbot+126167...@syzkaller.appspotmail.com

Tested on:

commit: b9fd9888 bnxt_en: eliminate the compile warning in bnx..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=10742c8c580000

kernel config: https://syzkaller.appspot.com/x/.config?x=a6dba31fc9bb876c
dashboard link: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7

patch: https://syzkaller.appspot.com/x/patch.diff?x=156f4f70580000

[Jamal Hadi Salim]

On Sat, Jul 5, 2025 at 1:07 AM Cong Wang <xiyou.w...@gmail.com> wrote:
>
> Hi Lizhi,
>
> On Sat, Jul 05, 2025 at 09:18:22AM +0800, Lizhi Xu wrote:
> > If the parent qdisc does not support class operations then exit notify.
> >
> > In addition, the validity of the cl value is judged before executing the
> > notify. Similarly, the notify is exited when the address represented by
> > its value is invalid.
> >
> > Reported-by: syzbot+126167...@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
>
> Maybe I didn't make it clear, I think Victor's patch also fixes this
> bug.
>
> https://lore.kernel.org/netdev/20250704163422....@mojatatu.com/
>
> Can you check if you still see the crash with his fix?
>

syzbot+126167...@syzkaller.appspotmail.com (in this report)
is part of what Victor's patch fixes (as listed in that patch).

cheers,
jamal

> The reason why I am asking is because his fix addresses a problem
> earlier on the code path, which possibly makes your fix unnecessary.
> Hence, his fix is closer to the root cause.
>
> Please test and confirm.
>

V
> Thanks!