]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
Merge branch 'net-sched-taprio-fix-null-pointer-dereference-in-class-dump'
authorJakub Kicinski <kuba@kernel.org>
Tue, 28 Apr 2026 01:41:37 +0000 (18:41 -0700)
committerJakub Kicinski <kuba@kernel.org>
Tue, 28 Apr 2026 01:41:38 +0000 (18:41 -0700)
Weiming Shi says:

====================
net/sched: taprio: fix NULL pointer dereference in class dump

Patch 1/2 is the fix: replace NULL entries in q->qdiscs[] with the
global &noop_qdisc singleton so that control-plane dump paths, as well
as the existing NULL guards in the data-plane enqueue/dequeue paths,
cannot deref a NULL child qdisc.

Patch 2/2 is a tdc regression test that drives the graft + delete +
class-dump sequence on a multi-queue netdevsim device. It panics the
vulnerable kernel and passes on the fixed one.
====================

Link: https://patch.msgid.link/20260422161958.2517539-2-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Trivial merge