Re: [REGRESSION] 6.14.3 panic - kernel NULL pointer dereference in htb_dequeue

["Alan J. Wylie" <alan@wylie.me.uk>]

> On Tue, Apr 22, 2025 at 07:20:24PM +0200, Holger Hoffstätte wrote:

> Meanwhile, if you could provide a reliable (and ideally minimum)
> reproducer, it would help me a lot to debug.

I've found a reproducer. Below is a stripped down version of the shell script
that I posted in my initial report.

Running this in a 1 second loop is enough to cause the panic very quickly.

It seems a bit of network traffic is needed, too.


# while true; do ./tc.sh; sleep 1; done
13:33:43 7196kbit 29296kbit
13:33:44 7196kbit 29296kbit
...
13:35:38 7196kbit 29296kbit
13:35:39 7196kbit 29296kbit
[panic]

# while true; do ./tc.sh; sleep 1; done
13:44:31 7196kbit 29296kbit
13:44:32 7196kbit 29296kbit
...
13:44:52 7196kbit 29296kbit
13:44:53 7196kbit 29296kbit
[panic]

The same place as usual
 htb_dequeue+0x42f/0x610 [sch_htb]

--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<
#!/usr/bin/bash

set -o nounset
set -o errexit

export PATH=/usr/bin

ext=ppp0
ext_ingress=ppp0ifb0

ext_up=7196kbit
ext_down=29296kbit

printf "%(%T)T $ext_up $ext_down\n"

q=1486
quantum=300

modprobe act_mirred
modprobe ifb
modprobe sch_cake
modprobe sch_fq_codel

ethtool -K "$ext" tso off gso off gro off 

tc qdisc del dev "$ext" root		>& /dev/null || true
tc qdisc del dev "$ext" ingress		>& /dev/null || true
tc qdisc del dev "$ext_ingress" root	>& /dev/null || true
tc qdisc del dev "$ext_ingress" ingress	>& /dev/null || true
ip link del "$ext_ingress"  		>& /dev/null || true

tc qdisc add dev "$ext" handle ffff: ingress

ip link add name "$ext_ingress"  type ifb
ip link set dev "$ext_ingress" up || true 

tc filter add dev "$ext" parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev "$ext_ingress"
tc qdisc add dev "$ext_ingress" root handle 1: htb default 11 r2q 20
tc class add dev "$ext_ingress" parent 1: classid 1:1 htb rate $ext_down 
tc class add dev "$ext_ingress" parent 1:1 classid 1:11 htb rate $ext_down prio 0 quantum $q
tc qdisc add dev "$ext_ingress" parent 1:11 fq_codel quantum $quantum ecn
tc qdisc add dev "$ext" root handle 1: htb default 11
tc class add dev "$ext" parent 1: classid 1:1 htb rate $ext_up
tc class add dev "$ext" parent 1:1 classid 1:11 htb rate $ext_up prio 0 quantum $q
tc qdisc add dev "$ext" parent 1:11 fq_codel quantum $quantum noecn
--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<

-- 
Alan J. Wylie     https://www.wylie.me.uk/     mailto:<alan@wylie.me.uk>

Dance like no-one's watching. / Encrypt like everyone is.
Security is inversely proportional to convenience