Re: [PATCH net v5 0/2] net/sched: taprio: fix NULL pointer dereference in class dump

patchwork-bot+netdevbpf
2026-04-28T01:50:55Z

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 23 Apr 2026 00:19:57 +0800 you wrote:
> Fix a NULL pointer dereference in taprio_dump_class() reachable by an
> unprivileged local user on kernels with unprivileged user namespaces
> enabled and CONFIG_NET_SCH_TAPRIO=y. The bug allows a local DoS via a
> crafted sequence of taprio child-qdisc graft, delete, and class dump.
>
> Patch 1/2 is the fix: replace NULL entries in q->qdiscs[] with the
> global &noop_qdisc singleton so that control-plane dump paths, as well
> as the existing NULL guards in the data-plane enqueue/dequeue paths,
> cannot deref a NULL child qdisc.
>
> [...]

Here is the summary with links:
- [net,v5,1/2] net/sched: taprio: fix NULL pointer dereference in class dump
https://git.kernel.org/netdev/net/c/3d07ca5c0fae
- [net,v5,2/2] selftests/tc-testing: add taprio test for class dump after child delete
https://git.kernel.org/netdev/net/c/a469feed399d

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.