Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag

This is more of a preventive patch to make the code more consistent and
to prevent possible exploits that employ child qlen manipulations on qfq.
use cl_is_active instead of relying on the child qdisc's qlen to determine
class activation.

Fixes: 462dbc9101acd ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260114160243.913069-3-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Jamal Hadi Salim and committed by
Jakub Kicinski
d837fbee 50da4b9d

+1 -1
+1 -1
net/sched/sch_qfq.c
··· 373 373 /* Deschedule class and remove it from its parent aggregate. */ 374 374 static void qfq_deact_rm_from_agg(struct qfq_sched *q, struct qfq_class *cl) 375 375 { 376 - if (cl->qdisc->q.qlen > 0) /* class is active */ 376 + if (cl_is_active(cl)) /* class is active */ 377 377 qfq_deactivate_class(q, cl); 378 378 379 379 qfq_rm_from_agg(q, cl);