net/sched: sch_dualpi2: Add missing skb check

[PATCH] net/sched: sch_dualpi2: Add missing skb check

Posted by Manas 1 month, 2 weeks ago

A packed is dequeued using the function `dequeue_packet()` but there is
no check to see if a packet is dequeued. The assignment is always
considered as true resulting in null-ptr-deref

Fixes: 8f9516daedd6 ("sched: Add enqueue/dequeue of dualpi2 qdisc")
Reported-by: Manas <ghandatmanas@gmail.com>
Reported-by: Rakshit Awasthi <rakshitawasthi17@gmail.com>
Signed-off-by: Manas <ghandatmanas@gmail.com>
---
 net/sched/sch_dualpi2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_dualpi2.c b/net/sched/sch_dualpi2.c
index 241e6a46bd00..e360bf16d617 100644
--- a/net/sched/sch_dualpi2.c
+++ b/net/sched/sch_dualpi2.c
@@ -588,7 +588,7 @@ static struct sk_buff *dualpi2_qdisc_dequeue(struct Qdisc *sch)
 
 	now = ktime_get_ns();
 
-	while ((skb = dequeue_packet(sch, q, &credit_change, now))) {
+	while ((skb = dequeue_packet(sch, q, &credit_change, now)) && skb) {
 		if (!q->drop_early && must_drop(sch, q, skb)) {
 			drop_and_retry(q, skb, sch, QDISC_DROP_CONGESTED);
 			continue;
-- 
2.43.0

Re: [PATCH] net/sched: sch_dualpi2: Add missing skb check

Posted by Jakub Kicinski 1 month, 2 weeks ago

On Tue, 28 Apr 2026 20:27:30 +0530 Manas wrote:
> A packed is dequeued using the function `dequeue_packet()` but there is
> no check to see if a packet is dequeued. The assignment is always
> considered as true resulting in null-ptr-deref
> 
> Fixes: 8f9516daedd6 ("sched: Add enqueue/dequeue of dualpi2 qdisc")
> Reported-by: Manas <ghandatmanas@gmail.com>
> Reported-by: Rakshit Awasthi <rakshitawasthi17@gmail.com>
> Signed-off-by: Manas <ghandatmanas@gmail.com>

Sorry but the patch is nonsensical. Please don't waste our time.

> diff --git a/net/sched/sch_dualpi2.c b/net/sched/sch_dualpi2.c
> index 241e6a46bd00..e360bf16d617 100644
> --- a/net/sched/sch_dualpi2.c
> +++ b/net/sched/sch_dualpi2.c
> @@ -588,7 +588,7 @@ static struct sk_buff *dualpi2_qdisc_dequeue(struct Qdisc *sch)
>  
>  	now = ktime_get_ns();
>  
> -	while ((skb = dequeue_packet(sch, q, &credit_change, now))) {
> +	while ((skb = dequeue_packet(sch, q, &credit_change, now)) && skb) {
>  		if (!q->drop_early && must_drop(sch, q, skb)) {
>  			drop_and_retry(q, skb, sch, QDISC_DROP_CONGESTED);
>  			continue;
-- 
pw-bot: cr

Re: [PATCH] net/sched: sch_dualpi2: Add missing skb check

Posted by Jamal Hadi Salim 1 month, 2 weeks ago

On Wed, Apr 29, 2026 at 9:52 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Tue, 28 Apr 2026 20:27:30 +0530 Manas wrote:
> > A packed is dequeued using the function `dequeue_packet()` but there is
> > no check to see if a packet is dequeued. The assignment is always
> > considered as true resulting in null-ptr-deref
> >
> > Fixes: 8f9516daedd6 ("sched: Add enqueue/dequeue of dualpi2 qdisc")
> > Reported-by: Manas <ghandatmanas@gmail.com>
> > Reported-by: Rakshit Awasthi <rakshitawasthi17@gmail.com>
> > Signed-off-by: Manas <ghandatmanas@gmail.com>
>
> Sorry but the patch is nonsensical. Please don't waste our time.
>

Fixed in: https://lore.kernel.org/netdev/20260430152957.194015-1-jhs@mojatatu.com/T/#mfe773e91a05e103f47dfa71ea434210aebb74e17

As I have mentioned a few times, when you find issues, please either
a) describe how you found the issue (a reproducer helps) or b) provide
tdc test case for extra bonus.
As you can see the issue has _nothing_ to do with dualpi2.

cheers,
jamal