Bug#921542: tc qdisc kernel crash

[Cong Wang <xiyou.wangcong@gmail.com>]

On Sun, Feb 10, 2019 at 7:54 AM Ben Hutchings <ben@decadent.org.uk> wrote:
>
> Control: tag -1 confirmed upstream
> Control: found -1 4.20-1~exp1
>
> Adrian (cc'd) reported (https://bugs.debian.org/921542) that a script
> using tc could trigger a kernel crash.  I've simplified the script he
> provided down to:
>
> --- BEGIN ---
> #!/bin/sh -ex
>
> modprobe ifb
>
> while true; do
>     tc qdisc add dev ifb0 root handle 2:0 prio bands 5
>     tc qdisc add dev ifb0 parent 2:5 sfq
>     tc filter add dev ifb0 parent 2:0 protocol ip prio 5 handle 0 tcindex mask 0 classid 2:5 pass_on
>     tc qdisc del dev ifb0 root || true
> done
> --- END ---
>
> The crash is still reproducible in 4.20 and 5.0-rc5.  KASan shows a
> use-after-free:

Thanks for the reproducer and report! I will send a fix.