Re: [PATCH net] net/sched: defer qdisc freeing after failed creation

[Jamal Hadi Salim]

On Wed, Aug 19, 2026 at 5:12 AM Jamal Hadi Salim <jhs@xxxxxxxxxxxx> wrote:
>
> On Mon, Aug 17, 2026 at 5:06 AM David Lee <david.lee@xxxxxxxxxxxxxxx> wrote:
> >
> > Hi Jakub,
> >
> > Apologies for the confusion. I've reattached the correct reproducer.
> >
>
> Thanks for reattaching the correct reproducer. I have run it and the
> KASAN use-after-free in now matches the bug exactly. The earlier log
> showed a different issue, please ensure logs match the bug and the
> repro in the future to reduce review time. We run every test - and we
> will vet your claim; so sending the wrong log consumes our time for no
> good reason.
>
> The fix itself is sound, but it requires a v2:
> Per request from both Jakub and Sashiko: Inline qdisc_free() into
> qdisc_free_cb() (or make it static) since your patch removes its last
> external caller, so the standalone symbol is dead weight.
> Attaching a C poc to the patch is not something i have seen; make it
> separate. So mext steps: you are going to send 0/1 with the attached
> poc and a good description of what changes you made since v1. Then 1/1
> is the refactored patch.
>
> Keep Fixes: 51ab2994c387 since the that's the commit that made clsact
> bind a shared block before creation completes.
>

Reviewing your patch triggered my memory so i looked around...
This _same exact bug_ (with the same KASAN signature) was reported by
eilaimemedsnaimel@xxxxxxxxx(on Cc) on the security list on Jul 20.
They promised to send a patch to the list (which was the same as
yours!) but they never did.
Two main differences i will note:
1. Their repro was different than yours (ask them to send it to you if
you are curious)
2.  They quoted Fixes as 3a7d0d07a3867 (in a way that is defensible as well)

So please, when you send a v2 give them some credit in reported-by

cheers,
jamal

> cheers,
> jamal
>
> > ======== Affected Versions =======
> > Runtime reproduction: Linux 7.2.0-rc3-kasan
> > Confirmed vulnerable revision:
> > f5098b6bae761e346ebcd9da7f95622c04733cff (Linux 7.2-rc5)
> > Latest inspected vulnerable revisions:
> > * 62cc90241548d5570ee68e01aaba6506964e9811 (Torvalds master)
> > * 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 (net main)
> > Introduced by:
> > 51ab2994c387c80b45caf8b8067b3f3b97771d25
> > ("net: sched: allow ingress and clsact qdiscs to share filter blocks")
> > https://github.com/torvalds/linux/commit/51ab2994c387c80b45caf8b8067b3f3b97771d25
> >
> > Required Configs for the Vulnerability:
> > * CONFIG_NET_SCHED
> > * CONFIG_NET_SCH_INGRESS
> > * CONFIG_NET_CLS_ACT
> >
> > Additional Configs used by the Proof-of-Concept:
> > * CONFIG_NET_CLS_BPF
> > * CONFIG_TUN
> > * CONFIG_USER_NS
> > * CONFIG_NET_NS
> > * CONFIG_KASAN
> >
> > ========== Reproduction ==========
> > Step 1: Build and boot a KASAN-enabled kernel with the configurations
> > listed above.
> >
> > Step 2: Statically compile the attached `poc.c`:
> >
> > ~
> > gcc -static -O2 -Wall -Wextra -pthread -o poc poc.c
> > ~
> >
> > Step 3: Run `./poc` as a regular local user. The program creates an
> > owned user and network namespace, two TUN interfaces, and a populated
> > shared ingress block. It sends ingress traffic while repeatedly
> > requesting a `clsact` qdisc with the shared block and the invalid rate
> > estimator.
> >
> > Step 4: Because this is a race, triggering time varies. The validated
> > run reported:
> >
> > ~
> > BUG: KASAN: slab-use-after-free in tc_run+0x5e3/0x620
> > Read of size 8 ... by task poc/...
> >
> > Freed by task ...:
> >   kfree
> >   qdisc_free
> >   qdisc_create
> >   tc_modify_qdisc
> > ~
> >
> > The complete KASAN report is attached as `splash.txt`.
> >
> > Best regards,
> > David
> >
> > On Wed, Aug 12, 2026 at 9:22 PM Jakub Kicinski <kuba@xxxxxxxxxx> wrote:
> >>
> >> On Tue, 11 Aug 2026 00:58:27 +0900 David Lee wrote:
> >> > [  230.057740] ipip: IPv4 and MPLS over IPv4 tunneling driver
> >> > [  231.667279]
> >> > ==================================================================
> >> > [  231.667738] BUG: KASAN: stack-out-of-bounds in
> >> > __ip_options_echo+0xdf7/0x1860
> >>
> >> I'm struggling to see how this is a repro for the qdisc lifecycle bug
> >>
> >> In any case -- if the fix is really correct and there's some real repro
> >> shared off list - I think you're deleting the last caller of
> >> qdisc_free() so you should inline it into qdisc_free_cb()
> >>
> >> So patch as is needs to be refactored. But please don't repost just
> >> to refactor, we need a convincing repro first.