bisecting fixing commit since 4fccc2503536a564a4ba31a1d50439854201659f building syzkaller on 2c36e7a75f8689b3da20e1a81a2ee5391f3af6e5 testing commit 4fccc2503536a564a4ba31a1d50439854201659f compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 9fd10f3095e0f8186aa867731b36e56b505ed438284bc6b79920396621526feb run #0: crashed: KASAN: use-after-free Read in qfq_search_class run #1: crashed: KASAN: use-after-free Read in qfq_search_class run #2: crashed: KASAN: use-after-free Read in qfq_search_class run #3: crashed: KASAN: use-after-free Read in qfq_search_class run #4: crashed: KASAN: use-after-free Read in qfq_search_class run #5: crashed: KASAN: use-after-free Read in qfq_search_class run #6: crashed: KASAN: use-after-free Read in qfq_search_class run #7: crashed: KASAN: use-after-free Read in qfq_search_class run #8: crashed: KASAN: use-after-free Read in qfq_search_class run #9: crashed: KASAN: use-after-free Read in qfq_search_class run #10: crashed: KASAN: use-after-free Read in qfq_search_class run #11: crashed: KASAN: use-after-free Read in qfq_search_class run #12: crashed: KASAN: use-after-free Read in qfq_search_class run #13: crashed: KASAN: use-after-free Read in qfq_search_class run #14: crashed: KASAN: use-after-free Read in qfq_search_class run #15: crashed: KASAN: use-after-free Read in qfq_search_class run #16: crashed: KASAN: use-after-free Read in qfq_search_class run #17: crashed: KASAN: use-after-free Read in qfq_search_class run #18: crashed: KASAN: use-after-free Read in qfq_search_class run #19: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor269278103" "root@10.128.10.11:./syz-executor269278103"]: exit status 1 Connection timed out during banner exchange Connection to 10.128.10.11 port 22 timed out lost connection testing current HEAD 4938296e03bd227e5020d63d418956fe52baf97c testing commit 4938296e03bd227e5020d63d418956fe52baf97c compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f4e8fe22fa66f2961f64fe9456d63470304be74627a18f70b67de45787f4bf32 all runs: OK # git bisect start 4938296e03bd227e5020d63d418956fe52baf97c 4fccc2503536a564a4ba31a1d50439854201659f Bisecting: 3806 revisions left to test after this (roughly 12 steps) [cd86e2ee197dc2065ad84b73cb1db44f8e920dfd] USB: serial: pl2303: add device-id for HP GC device testing commit cd86e2ee197dc2065ad84b73cb1db44f8e920dfd compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 932e05d912f21eb02b626b1180f97d06f9cdc99fa1454a4054e20f6598ddcfef all runs: crashed: KASAN: use-after-free Read in qfq_search_class # git bisect good cd86e2ee197dc2065ad84b73cb1db44f8e920dfd Bisecting: 1903 revisions left to test after this (roughly 11 steps) [5b1ef69663268b4afa9849004a4a2f8808e3cd81] btrfs: fix reloc root leak with 0 ref reloc roots on recovery testing commit 5b1ef69663268b4afa9849004a4a2f8808e3cd81 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 1d1a3bf68c110bb722c4c01211aae6a0023f143b2c6c5e7088e2a6ef179cd7c0 run #0: crashed: KASAN: use-after-free Read in qfq_search_class run #1: crashed: KASAN: use-after-free Read in qfq_search_class run #2: crashed: KASAN: use-after-free Read in qfq_search_class run #3: crashed: KASAN: use-after-free Read in qfq_search_class run #4: crashed: KASAN: use-after-free Read in qfq_search_class run #5: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #6: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #7: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #8: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #9: crashed: KASAN: use-after-free Read in qfq_reset_qdisc # git bisect good 5b1ef69663268b4afa9849004a4a2f8808e3cd81 Bisecting: 951 revisions left to test after this (roughly 10 steps) [2708da3dbba9e05f7eb57bb79638194d08d3eb38] powerpc/iommu: Annotate nested lock for lockdep testing commit 2708da3dbba9e05f7eb57bb79638194d08d3eb38 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 095a4bbbb8d5afe642ddbfe5463694d61795c73976653c658621015f2485f1a6 all runs: basic kernel testing failed: unregister_netdevice: waiting for DEV to become free # git bisect skip 2708da3dbba9e05f7eb57bb79638194d08d3eb38 Bisecting: 951 revisions left to test after this (roughly 10 steps) [54ef8243c3c8e90f1ea5792e6752e021a25c8eb3] net: check if protocol extracted by virtio_net_hdr_set_proto is correct testing commit 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: a728c0fb37c8bd3378dc476dd7b73d85bc9c4b81bb47dca130ea3e5a58f14e73 run #0: crashed: KASAN: use-after-free Read in qfq_search_class run #1: crashed: KASAN: use-after-free Read in qfq_search_class run #2: crashed: KASAN: use-after-free Read in qfq_search_class run #3: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #4: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #5: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #6: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #7: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #8: crashed: KASAN: use-after-free Read in qfq_reset_qdisc run #9: crashed: KASAN: use-after-free Read in qfq_reset_qdisc # git bisect good 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3 Bisecting: 870 revisions left to test after this (roughly 10 steps) [84d29b2fb3caf42d0bb0907a0ba01fa111ff4791] scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found testing commit 84d29b2fb3caf42d0bb0907a0ba01fa111ff4791 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: e458e730bfb2e44be45398d5b56fabbf325e20ad0c81b36a35992851c4981b50 all runs: basic kernel testing failed: unregister_netdevice: waiting for DEV to become free # git bisect skip 84d29b2fb3caf42d0bb0907a0ba01fa111ff4791 Bisecting: 870 revisions left to test after this (roughly 10 steps) [3c5e6538383baa0691b4ea2670b82c7c959bda4f] usb: dwc3: omap: improve extcon initialization testing commit 3c5e6538383baa0691b4ea2670b82c7c959bda4f compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 0867d371c0b7422d3e6c35bee40e202ea42d13ca903a59cb27498a2d55fe8fa1 all runs: basic kernel testing failed: unregister_netdevice: waiting for DEV to become free # git bisect skip 3c5e6538383baa0691b4ea2670b82c7c959bda4f Bisecting: 870 revisions left to test after this (roughly 10 steps) [f376dd8a409fe4cca5b121cd7c42b894689aada6] i2c: robotfuzz-osif: fix control-request directions testing commit f376dd8a409fe4cca5b121cd7c42b894689aada6 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: dfedd24e43b266bc5a903b0fb11e8cf1711c0dcc947abf2330e6b12e032f609b all runs: crashed: KASAN: use-after-free Read in qfq_search_class # git bisect good f376dd8a409fe4cca5b121cd7c42b894689aada6 Bisecting: 227 revisions left to test after this (roughly 8 steps) [170674a2bead4c3e5148e6b5d0741262c3f5d028] fsi/sbefifo: Clean up correct FIFO when receiving reset request from SBE testing commit 170674a2bead4c3e5148e6b5d0741262c3f5d028 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 7b04adf23c6ffc5dea13dab8151120aaaf0a2403f8683a4e7e074318f5a83311 all runs: OK # git bisect bad 170674a2bead4c3e5148e6b5d0741262c3f5d028 Bisecting: 113 revisions left to test after this (roughly 7 steps) [33f09d202e851ded5d1d9db1b059388da33f2361] ACPI: processor idle: Fix up C-state latency if not ordered testing commit 33f09d202e851ded5d1d9db1b059388da33f2361 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 599beabafd7c2b6481d5e2407f945a2537840319d93ca3a58477be98fead297e all runs: crashed: KASAN: use-after-free Read in qfq_search_class # git bisect good 33f09d202e851ded5d1d9db1b059388da33f2361 Bisecting: 56 revisions left to test after this (roughly 6 steps) [6c9629af44238a87f1283fbe20b671f741c17c55] RDMA/mlx5: Don't add slave port to unaffiliated list testing commit 6c9629af44238a87f1283fbe20b671f741c17c55 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: a872d5b6670396c936e0842cda2e1badd83e679d963994af8ef630e517835c23 all runs: crashed: KASAN: use-after-free Read in qfq_search_class # git bisect good 6c9629af44238a87f1283fbe20b671f741c17c55 Bisecting: 27 revisions left to test after this (roughly 5 steps) [23e431f7f36cb2744be7f1a1fffe6a3608b21b0c] tty: nozomi: Fix a resource leak in an error handling function testing commit 23e431f7f36cb2744be7f1a1fffe6a3608b21b0c compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 1c2734b311ba7afb7cf511b671b5c3cf3899197f6edb37edcb23de16f0ddd954 all runs: OK # git bisect bad 23e431f7f36cb2744be7f1a1fffe6a3608b21b0c Bisecting: 14 revisions left to test after this (roughly 4 steps) [2f001552df5e3e183ed80e1fc60fcbd7698b0904] mac80211: remove iwlwifi specific workaround NDPs of null_response testing commit 2f001552df5e3e183ed80e1fc60fcbd7698b0904 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: bb4496ad481e3281891bc5c0b13a075a6ab1e5c93a65df32a538884bf90234fa all runs: OK # git bisect bad 2f001552df5e3e183ed80e1fc60fcbd7698b0904 Bisecting: 6 revisions left to test after this (roughly 3 steps) [e85822aada6f2cf80397c48ef31ab2c856724ac3] net: ethernet: ezchip: fix UAF in nps_enet_remove testing commit e85822aada6f2cf80397c48ef31ab2c856724ac3 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 7509d01e9d41b4edb3b4fcade48fa472c2018fb90dd8f082288a4bb85bd51146 all runs: crashed: KASAN: use-after-free Read in qfq_search_class # git bisect good e85822aada6f2cf80397c48ef31ab2c856724ac3 Bisecting: 2 revisions left to test after this (roughly 2 steps) [0cb6b100b869164dcd4b48e8c236e0a9f1c8c0ad] net/ipv4: swap flow ports when validating source testing commit 0cb6b100b869164dcd4b48e8c236e0a9f1c8c0ad compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 95e1156f8dfd2892b5724a98203b599eddea43c63f36f9ebe56013e469061422 all runs: OK # git bisect bad 0cb6b100b869164dcd4b48e8c236e0a9f1c8c0ad Bisecting: 1 revision left to test after this (roughly 1 step) [98fd088c325429327fc5ddb0b12c6a203ebf7f30] pkt_sched: sch_qfq: fix qfq_change_class() error path testing commit 98fd088c325429327fc5ddb0b12c6a203ebf7f30 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: a92e81d7f14501f6f2a88d27ae80928cfba62c7e5922b4fd9d9bc633b7f9c35d all runs: OK # git bisect bad 98fd088c325429327fc5ddb0b12c6a203ebf7f30 Bisecting: 0 revisions left to test after this (roughly 0 steps) [fb9107d4fa7dddc351bd6ce77fefacd360ad1f66] net: ethernet: ezchip: fix error handling testing commit fb9107d4fa7dddc351bd6ce77fefacd360ad1f66 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 7509d01e9d41b4edb3b4fcade48fa472c2018fb90dd8f082288a4bb85bd51146 all runs: crashed: KASAN: use-after-free Read in qfq_search_class # git bisect good fb9107d4fa7dddc351bd6ce77fefacd360ad1f66 98fd088c325429327fc5ddb0b12c6a203ebf7f30 is the first bad commit commit 98fd088c325429327fc5ddb0b12c6a203ebf7f30 Author: Eric Dumazet Date: Mon Jun 21 10:54:49 2021 -0700 pkt_sched: sch_qfq: fix qfq_change_class() error path [ Upstream commit 0cd58e5c53babb9237b741dbef711f0a9eb6d3fd ] If qfq_change_class() is unable to allocate memory for qfq_aggregate, it frees the class that has been inserted in the class hash table, but does not unhash it. Defer the insertion after the problematic allocation. BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:884 [inline] BUG: KASAN: use-after-free in qdisc_class_hash_insert+0x200/0x210 net/sched/sch_api.c:731 Write of size 8 at addr ffff88814a534f10 by task syz-executor.4/31478 CPU: 0 PID: 31478 Comm: syz-executor.4 Not tainted 5.13.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:436 hlist_add_head include/linux/list.h:884 [inline] qdisc_class_hash_insert+0x200/0x210 net/sched/sch_api.c:731 qfq_change_class+0x96c/0x1990 net/sched/sch_qfq.c:489 tc_ctl_tclass+0x514/0xe50 net/sched/sch_api.c:2113 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5564 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665d9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdc7b5f0188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 00007fdc7b5f01d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 00007ffcf7310b3f R14: 00007fdc7b5f0300 R15: 0000000000022000 Allocated by task 31445: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:428 [inline] ____kasan_kmalloc mm/kasan/common.c:507 [inline] ____kasan_kmalloc mm/kasan/common.c:466 [inline] __kasan_kmalloc+0x9b/0xd0 mm/kasan/common.c:516 kmalloc include/linux/slab.h:556 [inline] kzalloc include/linux/slab.h:686 [inline] qfq_change_class+0x705/0x1990 net/sched/sch_qfq.c:464 tc_ctl_tclass+0x514/0xe50 net/sched/sch_api.c:2113 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5564 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 31445: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357 ____kasan_slab_free mm/kasan/common.c:360 [inline] ____kasan_slab_free mm/kasan/common.c:325 [inline] __kasan_slab_free+0xfb/0x130 mm/kasan/common.c:368 kasan_slab_free include/linux/kasan.h:212 [inline] slab_free_hook mm/slub.c:1583 [inline] slab_free_freelist_hook+0xdf/0x240 mm/slub.c:1608 slab_free mm/slub.c:3168 [inline] kfree+0xe5/0x7f0 mm/slub.c:4212 qfq_change_class+0x10fb/0x1990 net/sched/sch_qfq.c:518 tc_ctl_tclass+0x514/0xe50 net/sched/sch_api.c:2113 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5564 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88814a534f00 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 16 bytes inside of 128-byte region [ffff88814a534f00, ffff88814a534f80) The buggy address belongs to the page: page:ffffea0005294d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a534 flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff) raw: 057ff00000000200 ffffea00004fee00 0000000600000006 ffff8880110418c0 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 29797, ts 604817765317, free_ts 604810151744 prep_new_page mm/page_alloc.c:2358 [inline] get_page_from_freelist+0x1033/0x2b60 mm/page_alloc.c:3994 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5200 alloc_pages+0x18c/0x2a0 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1646 [inline] allocate_slab+0x2c5/0x4c0 mm/slub.c:1786 new_slab mm/slub.c:1849 [inline] new_slab_objects mm/slub.c:2595 [inline] ___slab_alloc+0x4a1/0x810 mm/slub.c:2758 __slab_alloc.constprop.0+0xa7/0xf0 mm/slub.c:2798 slab_alloc_node mm/slub.c:2880 [inline] slab_alloc mm/slub.c:2922 [inline] __kmalloc+0x315/0x330 mm/slub.c:4050 kmalloc include/linux/slab.h:561 [inline] kzalloc include/linux/slab.h:686 [inline] __register_sysctl_table+0x112/0x1090 fs/proc/proc_sysctl.c:1318 mpls_dev_sysctl_register+0x1b7/0x2d0 net/mpls/af_mpls.c:1421 mpls_add_dev net/mpls/af_mpls.c:1472 [inline] mpls_dev_notify+0x214/0x8b0 net/mpls/af_mpls.c:1588 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2121 call_netdevice_notifiers_extack net/core/dev.c:2133 [inline] call_netdevice_notifiers net/core/dev.c:2147 [inline] register_netdevice+0x106b/0x1500 net/core/dev.c:10312 veth_newlink+0x585/0xac0 drivers/net/veth.c:1547 __rtnl_newlink+0x1062/0x1710 net/core/rtnetlink.c:3452 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3500 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1298 [inline] free_pcp_prepare+0x223/0x300 mm/page_alloc.c:1342 free_unref_page_prepare mm/page_alloc.c:3250 [inline] free_unref_page+0x12/0x1d0 mm/page_alloc.c:3298 __vunmap+0x783/0xb60 mm/vmalloc.c:2566 free_work+0x58/0x70 mm/vmalloc.c:80 process_one_work+0x98d/0x1600 kernel/workqueue.c:2276 worker_thread+0x64c/0x1120 kernel/workqueue.c:2422 kthread+0x3b1/0x4a0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Memory state around the buggy address: ffff88814a534e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88814a534e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88814a534f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88814a534f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88814a535000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Fixes: 462dbc9101acd ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Sasha Levin net/sched/sch_qfq.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) culprit signature: a92e81d7f14501f6f2a88d27ae80928cfba62c7e5922b4fd9d9bc633b7f9c35d parent signature: 7509d01e9d41b4edb3b4fcade48fa472c2018fb90dd8f082288a4bb85bd51146 revisions tested: 18, total time: 5h25m40.008824886s (build: 3h11m18.186853164s, test: 2h12m26.405589601s) first good commit: 98fd088c325429327fc5ddb0b12c6a203ebf7f30 pkt_sched: sch_qfq: fix qfq_change_class() error path recipients (to): ["davem@davemloft.net" "edumazet@google.com" "sashal@kernel.org"] recipients (cc): []