On Sun, Feb 10, 2019 at 7:54 AM Ben Hutchings <b...@decadent.org.uk> wrote: > > Control: tag -1 confirmed upstream > Control: found -1 4.20-1~exp1 > > Adrian (cc'd) reported (https://bugs.debian.org/921542) that a script > using tc could trigger a kernel crash. I've simplified the script he > provided down to: > > --- BEGIN --- > #!/bin/sh -ex > > modprobe ifb > > while true; do > tc qdisc add dev ifb0 root handle 2:0 prio bands 5 > tc qdisc add dev ifb0 parent 2:5 sfq > tc filter add dev ifb0 parent 2:0 protocol ip prio 5 handle 0 tcindex > mask 0 classid 2:5 pass_on > tc qdisc del dev ifb0 root || true > done > --- END --- > > The crash is still reproducible in 4.20 and 5.0-rc5. KASan shows a > use-after-free:
Thanks for the reproducer and report! I will send a fix.
