On Wed, Apr 23, 2025 at 10:51:49AM +0100, Alan J. Wylie wrote:
On Tue, 22 Apr 2025 14:49:27 -0700 Cong Wang xiyou.wangcong@gmail.com wrote:
Although I am still trying to understand the NULL pointer, which seems likely from:
478 if (p->inner.clprio[prio].ptr == cl->node + prio) { 479 /* we are removing child which is pointed to from 480 * parent feed - forget the pointer but remember 481 * classid 482 */ 483 p->inner.clprio[prio].last_ptr_id = cl->common.classid; 484 p->inner.clprio[prio].ptr = NULL; 485 }
Does the following patch work? I mean not just fixing the crash, but also not causing any other problem.
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c index 4b9a639b642e..0cdc778fddef 100644 --- a/net/sched/sch_htb.c +++ b/net/sched/sch_htb.c @@ -348,7 +348,8 @@ static void htb_add_to_wait_tree(struct htb_sched *q, */ static inline void htb_next_rb_node(struct rb_node **n) {
- *n = rb_next(*n);
- if (*n)
*n = rb_next(*n);} /**
There's been three of these:
Apr 23 08:08:32 bilbo kernel: WARNING: CPU: 0 PID: 0 at htb_deactivate+0xd/0x30 [sch_htb] Apr 23 08:08:32 bilbo kernel: WARNING: CPU: 0 PID: 0 at htb_deactivate+0xd/0x30 [sch_htb] Apr 23 10:41:36 bilbo kernel: WARNING: CPU: 1 PID: 0 at htb_deactivate+0xd/0x30 [sch_htb]
But no panic.
I've run scripts/decode.sh on the last one.
Thanks a lot for testing! This helped a lot to verify how far we can go beyond the panic and what I still missed. To me it looks a bit complicated for -stable if we make everything idempotent along the path.
Do you mind testing the following one instead? Please revert the above one for htb_next_rb_node(). I think maybe this is the safest fix we could have for -stable.
Thanks!
--------->
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c index 4b9a639b642e..3786abbdc4c3 100644 --- a/net/sched/sch_htb.c +++ b/net/sched/sch_htb.c @@ -1487,7 +1487,8 @@ static void htb_qlen_notify(struct Qdisc *sch, unsigned long arg)
if (!cl->prio_activity) return; - htb_deactivate(qdisc_priv(sch), cl); + if (!cl->leaf.q->q.qlen) + htb_deactivate(qdisc_priv(sch), cl); }
static inline int htb_parent_last_child(struct htb_class *cl)