From: Jakub Kicinski <kuba@kernel.org>
To: David Lee <david.lee@trailofbits.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>,
davem@davemloft.net, edumazet@google.com, pabeni@redhat.com,
jiri@resnulli.us, Kyle Zeng <kylebot@openai.com>,
"Dominik 'Disconnect3d' Czarnota"
<dominik.czarnota@trailofbits.com>,
horms@kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH net] net/sched: defer qdisc freeing after failed creation
Date: Wed, 12 Aug 2026 18:22:46 -0700 [thread overview]
Message-ID: <20260812182246.3df00681@kernel.org> (raw)
In-Reply-To: <CAC_etQEByQLf5pMWzbyVfT3xtzereqEgu+XZYmwDjyvpRCzxjg@mail.gmail.com>
On Tue, 11 Aug 2026 00:58:27 +0900 David Lee wrote:
> [ 230.057740] ipip: IPv4 and MPLS over IPv4 tunneling driver
> [ 231.667279]
> ==================================================================
> [ 231.667738] BUG: KASAN: stack-out-of-bounds in
> __ip_options_echo+0xdf7/0x1860
I'm struggling to see how this is a repro for the qdisc lifecycle bug
In any case -- if the fix is really correct and there's some real repro
shared off list - I think you're deleting the last caller of
qdisc_free() so you should inline it into qdisc_free_cb()
So patch as is needs to be refactored. But please don't repost just
to refactor, we need a convincing repro first.
prev parent reply other threads:[~2026-08-13 1:22 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-05 10:25 [PATCH net] net/sched: defer qdisc freeing after failed creation David Lee
2026-08-05 18:00 ` Jamal Hadi Salim
2026-08-10 15:58 ` David Lee
2026-08-13 1:22 ` Jakub Kicinski [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260812182246.3df00681@kernel.org \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=david.lee@trailofbits.com \
--cc=dominik.czarnota@trailofbits.com \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kylebot@openai.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.