Re: [Discuss] KASAN: null-ptr-deference in qdisc_tree_reduce_backlog

[Cong Wang]

On Wed, Jul 23, 2025 at 10:48:27PM +0800, huyizhen2024@xxxxxxx wrote:
> Hello.
> 
> KASAN found a null ptr deference in qdisc_tree_reduce_backlog.
> If cops->find cannot find a qdisc, it returns NULL.
> And if cops->qlen_notify doesn't valid arg, it will deference the NULL ptr, resulting in a kernel crash.
> Should we add a check for the argument in cops->qlen_notify?
> 
> Looking forward to your reply, thank you!
> 
> net\sched\sch_hfsc.c:1237 hfsc_qlen_notify-null-ptr-deref
> 
> other info that might help debug this:
> 

Thanks for your report.

May we know which kernel version you are testing? Because recently we
fixed quite some qlen_notify related issues, testing the latest -net is
highly recommended.

And, if you have a reproducer, please provide it too.

Regards,
Cong Wang