Skip to content

Conversation

@github-actions
Copy link

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

### net: sched: sfb: fix null pointer access issue when sfb_init() fails

jira VULN-155243
cve CVE-2022-50356
commit-author Zhengchao Shao <[email protected]>
commit 2a3fc78210b9f0e85372a2435368962009f480fc

When the default qdisc is sfb, if the qdisc of dev_queue fails to be
inited during mqprio_init(), sfb_reset() is invoked to clear resources.
In this case, the q->qdisc is NULL, and it will cause gpf issue.

The process is as follows:
qdisc_create_dflt()
	sfb_init()
		tcf_block_get()          --->failed, q->qdisc is NULL
	...
	qdisc_put()
		...
		sfb_reset()
			qdisc_reset(q->qdisc)    --->q->qdisc is NULL
				ops = qdisc->ops

The following is the Call Trace information:
general protection fault, probably for non-canonical address
0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
RIP: 0010:qdisc_reset+0x2b/0x6f0
Call Trace:
<TASK>
sfb_reset+0x37/0xd0
qdisc_reset+0xed/0x6f0
qdisc_destroy+0x82/0x4c0
qdisc_put+0x9e/0xb0
qdisc_create_dflt+0x2c3/0x4a0
mqprio_init+0xa71/0x1760
qdisc_create+0x3eb/0x1000
tc_modify_qdisc+0x408/0x1720
rtnetlink_rcv_msg+0x38e/0xac0
netlink_rcv_skb+0x12d/0x3a0
netlink_unicast+0x4a2/0x740
netlink_sendmsg+0x826/0xcc0
sock_sendmsg+0xc5/0x100
____sys_sendmsg+0x583/0x690
___sys_sendmsg+0xe8/0x160
__sys_sendmsg+0xbf/0x160
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f2164122d04
</TASK>

Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler")
	Signed-off-by: Zhengchao Shao <[email protected]>
	Signed-off-by: David S. Miller <[email protected]>
(cherry picked from commit 2a3fc78210b9f0e85372a2435368962009f480fc)
	Signed-off-by: Roxana Nicolescu <[email protected]>

---
### net: sched: delete duplicate cleanup of backlog and qlen

jira VULN-155243
cve-pre CVE-2022-50356
commit-author Zhengchao Shao <[email protected]>
commit c19d893fbf3f2f8fa864ae39652c7fee939edde2

qdisc_reset() is clearing qdisc->q.qlen and qdisc->qstats.backlog
_after_ calling qdisc->ops->reset. There is no need to clear them
again in the specific reset function.

	Signed-off-by: Zhengchao Shao <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
	Signed-off-by: Paolo Abeni <[email protected]>
(cherry picked from commit c19d893fbf3f2f8fa864ae39652c7fee939edde2)
	Signed-off-by: Roxana Nicolescu <[email protected]>

---
### Add .container_build_image and remove -c flag from workflow

- Created .container_build_image with lts-9.2-kernel-builder
- Updated workflow to remove -c option from build_kernel.sh call
- Build script will now automatically use the image specified in .container_build_image

Signed-off-by: Shreeya Patel <[email protected]>

---
### Add PR body generation script

Script to generate detailed PR descriptions with kselftest results.

Signed-off-by: Shreeya Patel <[email protected]>

---
### Add automated kernel CI workflow with kselftest and PR creation

Implements a 5-stage GitHub Actions pipeline for automated kernel testing and PR creation.
Uses kernel-container-build automated-testing-v1 branch for build/test tooling.

Stage 1: Build (15-30 min)
- Checkout kernel source + kernel-container-build repo (automated-testing-v1)
- Build kernel in CIQ builder container with kABI checking
- Convert built container to QCOW2 VM image
- Upload: kernel-build.log, QCOW2 image

Stage 2: Boot Verification (2-5 min)
- Download QCOW2 image
- Boot kernel in QEMU (KVM or TCG) and validate login prompt appears
- Upload: boot logs

Stage 3: Kernel Selftests (40-60 min)
- Download QCOW2 image
- Execute comprehensive kselftests in QEMU with dual serial consoles
- Upload: kselftest TAP logs, dmesg output

Stage 4: Compare Results (1-2 min)
Purpose: Detect test regressions by comparing against base branch

Steps:
1. Checkout with full history (fetch-depth: 0) for git merge-base ops
2. Download current kselftest logs
3. Smart base branch detection:
   - For PRs: Uses PR's target branch
   - For pushes: Sorts branches by commit date, checks 30 most recent,
     finds closest common ancestor via git merge-base
   - For force-pushes: Doesn't do the detection again, instead uses the
     same base branch as detected during the first PR creation and also
     compares the result against that base branch only
   - Outputs: base_branch (reused by PR stage)
4. Download baseline logs from base branch (searches last 5 successful runs)
5. Compare results:
   - Counts passing/failing tests (before/after)
   - Fails if >±3 tests changed
   - Outputs: comparison_status, comparison_message

Stage 5: Create Pull Request (1-2 min)
Purpose: Auto-create/update PR after all tests pass

Prerequisites: Only runs if build + boot + kselftest passed, no regressions detected

Steps:
1. Check all stages passed and comparison_status != failed
2. Checkout (shallow: fetch-depth: 50) for commit messages
3. Download all artifacts (build/boot/test logs)
4. Extract statistics (pass/fail counts, build times)
5. Get commit info:
   - Single commit: Use commit message
   - Multiple commits: Create summary
6. Create/Update PR:
   - Reuses base_branch from compare-results (no duplication!)
   - Generate PR body with test results via create-pr-body.sh
   - Creates new PR or updates existing one in case of force pushes

Note :-
To skip this github action workflow, add [ci skip] or [skip ci]
into the head commit when pushing the patches.

Signed-off-by: Shreeya Patel <[email protected]>

---

Test Results

✅ Build Stage

✅ Boot Verification

✅ Kernel Selftests

⚠️ Test Comparison

  • Status: Skipped
  • Reason: No baseline test results available from ciqlts9_2
  • Note: Manual review recommended to ensure no regressions

🤖 This PR was automatically generated by GitHub Actions
Run ID: 19471889998

@roxanan1996
Copy link

@shreeya-patel98 I would personally not put the whole commit body, just the first few lines
Like this. What do you think?

### net: sched: sfb: fix null pointer access issue when sfb_init() fails

jira VULN-155243
cve CVE-2022-50356
commit-author Zhengchao Shao <[email protected]>
commit 2a3fc78210b9f0e85372a2435368962009f480fc

@roxanan1996
Copy link

Hmm, another thing is that it did not trigger the pull request automation.

@shreeya-patel98
Copy link
Collaborator

@shreeya-patel98 I would personally not put the whole commit body, just the first few lines Like this. What do you think?

### net: sched: sfb: fix null pointer access issue when sfb_init() fails

jira VULN-155243
cve CVE-2022-50356
commit-author Zhengchao Shao <[email protected]>
commit 2a3fc78210b9f0e85372a2435368962009f480fc

That's complicated to do because of the way we are fetching this data from each commits. We can do these kind of enhancements later because they are not really necessary at this stage.

@shreeya-patel98
Copy link
Collaborator

Hmm, another thing is that it did not trigger the pull request automation.

I did not get it, this PR is created due to the CI automation.

@roxanan1996
Copy link

Hmm, another thing is that it did not trigger the pull request automation.

I did not get it, this PR is created due to the CI automation.

It did not trigger the pull request workflow.

  1. aarch64 CI
  2. x86_64 CI
    3 validate kernel commits

See here https://github.com/ctrliq/kernel-src-tree/pull/666/checks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants