Re: [PATCH net] net/sched: defer qdisc freeing after failed creation

On Mon, Aug 17, 2026 at 5:06 AM David Lee [off-list ref] wrote:

Hi Jakub,

Apologies for the confusion. I've reattached the correct reproducer.

Thanks for reattaching the correct reproducer. I have run it and the
KASAN use-after-free in now matches the bug exactly. The earlier log
showed a different issue, please ensure logs match the bug and the
repro in the future to reduce review time. We run every test - and we
will vet your claim; so sending the wrong log consumes our time for no
good reason.

The fix itself is sound, but it requires a v2:
Per request from both Jakub and Sashiko: Inline qdisc_free() into
qdisc_free_cb() (or make it static) since your patch removes its last
external caller, so the standalone symbol is dead weight.
Attaching a C poc to the patch is not something i have seen; make it
separate. So mext steps: you are going to send 0/1 with the attached
poc and a good description of what changes you made since v1. Then 1/1
is the refactored patch.

Keep Fixes: 51ab2994c387 since the that's the commit that made clsact
bind a shared block before creation completes.

cheers,
jamal

======== Affected Versions =======
Runtime reproduction: Linux 7.2.0-rc3-kasan
Confirmed vulnerable revision:
f5098b6bae761e346ebcd9da7f95622c04733cff (Linux 7.2-rc5)
Latest inspected vulnerable revisions:
* 62cc90241548d5570ee68e01aaba6506964e9811 (Torvalds master)
* 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 (net main)
Introduced by:
51ab2994c387c80b45caf8b8067b3f3b97771d25
("net: sched: allow ingress and clsact qdiscs to share filter blocks")
https://github.com/torvalds/linux/commit/51ab2994c387c80b45caf8b8067b3f3b97771d25

Required Configs for the Vulnerability:
* CONFIG_NET_SCHED
* CONFIG_NET_SCH_INGRESS
* CONFIG_NET_CLS_ACT

Additional Configs used by the Proof-of-Concept:
* CONFIG_NET_CLS_BPF
* CONFIG_TUN
* CONFIG_USER_NS
* CONFIG_NET_NS
* CONFIG_KASAN

========== Reproduction ==========
Step 1: Build and boot a KASAN-enabled kernel with the configurations
listed above.

Step 2: Statically compile the attached `poc.c`:

~
gcc -static -O2 -Wall -Wextra -pthread -o poc poc.c
~

Step 3: Run `./poc` as a regular local user. The program creates an
owned user and network namespace, two TUN interfaces, and a populated
shared ingress block. It sends ingress traffic while repeatedly
requesting a `clsact` qdisc with the shared block and the invalid rate
estimator.

Step 4: Because this is a race, triggering time varies. The validated
run reported:

~
BUG: KASAN: slab-use-after-free in tc_run+0x5e3/0x620
Read of size 8 ... by task poc/...

Freed by task ...:
  kfree
  qdisc_free
  qdisc_create
  tc_modify_qdisc
~

The complete KASAN report is attached as `splash.txt`.

Best regards,
David

On Wed, Aug 12, 2026 at 9:22 PM Jakub Kicinski [off-list ref] wrote:

quoted

On Tue, 11 Aug 2026 00:58:27 +0900 David Lee wrote:

quoted

[  230.057740] ipip: IPv4 and MPLS over IPv4 tunneling driver
[  231.667279]
==================================================================
[  231.667738] BUG: KASAN: stack-out-of-bounds in
__ip_options_echo+0xdf7/0x1860

I'm struggling to see how this is a repro for the qdisc lifecycle bug

In any case -- if the fix is really correct and there's some real repro
shared off list - I think you're deleting the last caller of
qdisc_free() so you should inline it into qdisc_free_cb()

So patch as is needs to be refactored. But please don't repost just
to refactor, we need a convincing repro first.