On Tue, Apr 22, 2025 at 07:20:24PM +0200, Holger Hoffstätte wrote:
Meanwhile, if you could provide a reliable (and ideally minimum) reproducer, it would help me a lot to debug.
I've found a reproducer. Below is a stripped down version of the shell script that I posted in my initial report.
Running this in a 1 second loop is enough to cause the panic very quickly.
It seems a bit of network traffic is needed, too.
# while true; do ./tc.sh; sleep 1; done 13:33:43 7196kbit 29296kbit 13:33:44 7196kbit 29296kbit ... 13:35:38 7196kbit 29296kbit 13:35:39 7196kbit 29296kbit [panic]
# while true; do ./tc.sh; sleep 1; done 13:44:31 7196kbit 29296kbit 13:44:32 7196kbit 29296kbit ... 13:44:52 7196kbit 29296kbit 13:44:53 7196kbit 29296kbit [panic]
The same place as usual htb_dequeue+0x42f/0x610 [sch_htb]
--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8< #!/usr/bin/bash
set -o nounset set -o errexit
export PATH=/usr/bin
ext=ppp0 ext_ingress=ppp0ifb0
ext_up=7196kbit ext_down=29296kbit
printf "%(%T)T $ext_up $ext_down\n"
q=1486 quantum=300
modprobe act_mirred modprobe ifb modprobe sch_cake modprobe sch_fq_codel
ethtool -K "$ext" tso off gso off gro off
tc qdisc del dev "$ext" root >& /dev/null || true tc qdisc del dev "$ext" ingress >& /dev/null || true tc qdisc del dev "$ext_ingress" root >& /dev/null || true tc qdisc del dev "$ext_ingress" ingress >& /dev/null || true ip link del "$ext_ingress" >& /dev/null || true
tc qdisc add dev "$ext" handle ffff: ingress
ip link add name "$ext_ingress" type ifb ip link set dev "$ext_ingress" up || true
tc filter add dev "$ext" parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev "$ext_ingress" tc qdisc add dev "$ext_ingress" root handle 1: htb default 11 r2q 20 tc class add dev "$ext_ingress" parent 1: classid 1:1 htb rate $ext_down tc class add dev "$ext_ingress" parent 1:1 classid 1:11 htb rate $ext_down prio 0 quantum $q tc qdisc add dev "$ext_ingress" parent 1:11 fq_codel quantum $quantum ecn tc qdisc add dev "$ext" root handle 1: htb default 11 tc class add dev "$ext" parent 1: classid 1:1 htb rate $ext_up tc class add dev "$ext" parent 1:1 classid 1:11 htb rate $ext_up prio 0 quantum $q tc qdisc add dev "$ext" parent 1:11 fq_codel quantum $quantum noecn --------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<