CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Return NULL when htblookupleaf encounters an empty rbtree

htblookupleaf has a BUGON that can trigger with the following:

tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 htb rate 64bit tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2:1 handle 3: blackhole ping -I lo -c1 -W0.001 127.0.0.1

The root cause is the following:

1. htbdequeue calls htbdequeuetree which calls the dequeue handler on the selected leaf qdisc 2. netemdequeue calls enqueue on the child qdisc 3. blackholeenqueue drops the packet and returns a value that is not just NETXMITSUCCESS 4. Because of this, netemdequeue calls qdisctreereducebacklog, and since qlen is now 0, it calls htbqlennotify -> htbdeactivate -> htbdeactiviateprios -> htbremoveclassfromrow -> htbsaferberase 5. As this is the only class in the selected hprio rbtree, rbchangechild in rberaseaugmented sets the rbroot pointer to NULL 6. Because blackholedequeue returns NULL, netemdequeue returns NULL, which causes htbdequeuetree to call htblookupleaf with the same hprio rbtree, and fail the BUGON

The function graph for this scenario is shown here: 0) | htbenqueue() { 0) + 13.635 us | netemenqueue(); 0) 4.719 us | htbactivateprios(); 0) # 2249.199 us | } 0) | htbdequeue() { 0) 2.355 us | htblookupleaf(); 0) | netemdequeue() { 0) + 11.061 us | blackholeenqueue(); 0) | qdisctreereducebacklog() { 0) | qdisclookuprcu() { 0) 1.873 us | qdiscmatchfromroot(); 0) 6.292 us | } 0) 1.894 us | htbsearch(); 0) | htbqlennotify() { 0) 2.655 us | htbdeactivateprios(); 0) 6.933 us | } 0) + 25.227 us | } 0) 1.983 us | blackholedequeue(); 0) + 86.553 us | } 0) # 2932.761 us | qdiscwarnnonwc(); 0) | htblookupleaf() { 0) | BUGON(); ------------------------------------------

The full original bug report can be seen here [1].

We can fix this just by returning NULL instead of the BUGON, as htbdequeuetree returns NULL when htblookupleaf returns NULL.

[1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI-SOxTgRvNoDwuux7UHKnEY5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/