net: sched: delete duplicate cleanup of backlog and qlen

roxanan1996 · roxanan1996 · commit 75e18b8eefa0 · 2025-11-18T16:38:13.000+01:00
jira VULN-155243 cve-pre CVE-2022-50356 commit-author Zhengchao Shao <shaozhengchao@huawei.com> commit c19d893 qdisc_reset() is clearing qdisc->q.qlen and qdisc->qstats.backlog _after_ calling qdisc->ops->reset. There is no need to clear them again in the specific reset function. Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> Link: https://lore.kernel.org/r/20220824005231.345727-1-shaozhengchao@huawei.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit c19d893) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
@@ -1137,7 +1137,6 @@ static inline void __qdisc_reset_queue(struct qdisc_skb_head *qh)
 static inline void qdisc_reset_queue(struct Qdisc *sch)
 {
 	__qdisc_reset_queue(&sch->q);
-	sch->qstats.backlog = 0;
 }
 
 static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
@@ -577,7 +577,6 @@ static void atm_tc_reset(struct Qdisc *sch)
 	pr_debug("atm_tc_reset(sch %p,[qdisc %p])\n", sch, p);
 	list_for_each_entry(flow, &p->flows, list)
 		qdisc_reset(flow->q);
-	sch->q.qlen = 0;
 }
 
 static void atm_tc_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
@@ -975,7 +975,6 @@ cbq_reset(struct Qdisc *sch)
 			cl->cpriority = cl->priority;
 		}
 	}
-	sch->q.qlen = 0;
 }
 
 
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
@@ -315,8 +315,6 @@ static void choke_reset(struct Qdisc *sch)
 		rtnl_qdisc_drop(skb, sch);
 	}
 
-	sch->q.qlen = 0;
-	sch->qstats.backlog = 0;
 	if (q->tab)
 		memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *));
 	q->head = q->tail = 0;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
@@ -441,8 +441,6 @@ static void drr_reset_qdisc(struct Qdisc *sch)
 			qdisc_reset(cl->qdisc);
 		}
 	}
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void drr_destroy_qdisc(struct Qdisc *sch)
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
@@ -409,8 +409,6 @@ static void dsmark_reset(struct Qdisc *sch)
 	pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
 	if (p->q)
 		qdisc_reset(p->q);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void dsmark_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_etf.c b/net/sched/sch_etf.c
@@ -445,9 +445,6 @@ static void etf_reset(struct Qdisc *sch)
 	timesortedlist_clear(sch);
 	__qdisc_reset_queue(&sch->q);
 
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
-
 	q->last = 0;
 }
 
diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c
@@ -731,8 +731,6 @@ static void ets_qdisc_reset(struct Qdisc *sch)
 	}
 	for (band = 0; band < q->nbands; band++)
 		qdisc_reset(q->classes[band].qdisc);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void ets_qdisc_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
@@ -347,8 +347,6 @@ static void fq_codel_reset(struct Qdisc *sch)
 		codel_vars_init(&flow->cvars);
 	}
 	memset(q->backlogs, 0, q->flows_cnt * sizeof(u32));
-	sch->q.qlen = 0;
-	sch->qstats.backlog = 0;
 	q->memory_usage = 0;
 }
 
diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c
@@ -521,9 +521,6 @@ static void fq_pie_reset(struct Qdisc *sch)
 		INIT_LIST_HEAD(&flow->flowchain);
 		pie_vars_init(&flow->vars);
 	}
-
-	sch->q.qlen = 0;
-	sch->qstats.backlog = 0;
 }
 
 static void fq_pie_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
@@ -1514,8 +1514,6 @@ hfsc_reset_qdisc(struct Qdisc *sch)
 	}
 	q->eligible = RB_ROOT;
 	qdisc_watchdog_cancel(&q->watchdog);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
@@ -1008,8 +1008,6 @@ static void htb_reset(struct Qdisc *sch)
 	}
 	qdisc_watchdog_cancel(&q->watchdog);
 	__qdisc_reset_queue(&q->direct_queue);
-	sch->q.qlen = 0;
-	sch->qstats.backlog = 0;
 	memset(q->hlevel, 0, sizeof(q->hlevel));
 	memset(q->row_mask, 0, sizeof(q->row_mask));
 }
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
@@ -152,7 +152,6 @@ multiq_reset(struct Qdisc *sch)
 
 	for (band = 0; band < q->bands; band++)
 		qdisc_reset(q->queues[band]);
-	sch->q.qlen = 0;
 	q->curband = 0;
 }
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
@@ -135,8 +135,6 @@ prio_reset(struct Qdisc *sch)
 
 	for (prio = 0; prio < q->bands; prio++)
 		qdisc_reset(q->queues[prio]);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static int prio_offload(struct Qdisc *sch, struct tc_prio_qopt *qopt)
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
@@ -1459,8 +1459,6 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
 			qdisc_reset(cl->qdisc);
 		}
 	}
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void qfq_destroy_qdisc(struct Qdisc *sch)
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
@@ -178,8 +178,6 @@ static void red_reset(struct Qdisc *sch)
 	struct red_sched_data *q = qdisc_priv(sch);
 
 	qdisc_reset(q->qdisc);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 	red_restart(&q->vars);
 }
 
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
@@ -456,8 +456,6 @@ static void sfb_reset(struct Qdisc *sch)
 	struct sfb_sched_data *q = qdisc_priv(sch);
 
 	qdisc_reset(q->qdisc);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 	q->slot = 0;
 	q->double_buffering = false;
 	sfb_zero_all_buckets(q);
diff --git a/net/sched/sch_skbprio.c b/net/sched/sch_skbprio.c
@@ -213,9 +213,6 @@ static void skbprio_reset(struct Qdisc *sch)
 	struct skbprio_sched_data *q = qdisc_priv(sch);
 	int prio;
 
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
-
 	for (prio = 0; prio < SKBPRIO_MAX_PRIORITY; prio++)
 		__skb_queue_purge(&q->qdiscs[prio]);
 
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
@@ -1639,8 +1639,6 @@ static void taprio_reset(struct Qdisc *sch)
 			if (q->qdiscs[i])
 				qdisc_reset(q->qdiscs[i]);
 	}
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void taprio_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
@@ -330,8 +330,6 @@ static void tbf_reset(struct Qdisc *sch)
 	struct tbf_sched_data *q = qdisc_priv(sch);
 
 	qdisc_reset(q->qdisc);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 	q->t_c = ktime_get_ns();
 	q->tokens = q->buffer;
 	q->ptokens = q->mtu;
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
@@ -124,7 +124,6 @@ teql_reset(struct Qdisc *sch)
 	struct teql_sched_data *dat = qdisc_priv(sch);
 
 	skb_queue_purge(&dat->q);
-	sch->q.qlen = 0;
 }
 
 static void

Original file line number	Diff line number	Diff line change
`@@ -1137,7 +1137,6 @@ static inline void __qdisc_reset_queue(struct qdisc_skb_head *qh)`
`1137`	`1137`	`static inline void qdisc_reset_queue(struct Qdisc *sch)`
`1138`	`1138`	`{`
`1139`	`1139`	`__qdisc_reset_queue(&sch->q);`
`1140`		`- sch->qstats.backlog = 0;`
`1141`	`1140`	`}`
`1142`	`1141`
`1143`	`1142`	`static inline struct Qdisc qdisc_replace(struct Qdisc sch, struct Qdisc *new,`
Original file line number	Diff line number	Diff line change
`@@ -577,7 +577,6 @@ static void atm_tc_reset(struct Qdisc *sch)`
`577`	`577`	`pr_debug("atm_tc_reset(sch %p,[qdisc %p])\n", sch, p);`
`578`	`578`	`list_for_each_entry(flow, &p->flows, list)`
`579`	`579`	`qdisc_reset(flow->q);`
`580`		`- sch->q.qlen = 0;`
`581`	`580`	`}`
`582`	`581`
`583`	`582`	`static void atm_tc_destroy(struct Qdisc *sch)`
Original file line number	Diff line number	Diff line change
`@@ -975,7 +975,6 @@ cbq_reset(struct Qdisc *sch)`
`975`	`975`	`cl->cpriority = cl->priority;`
`976`	`976`	`}`
`977`	`977`	`}`
`978`		`- sch->q.qlen = 0;`
`979`	`978`	`}`
`980`	`979`
`981`	`980`
Original file line number	Diff line number	Diff line change
`@@ -315,8 +315,6 @@ static void choke_reset(struct Qdisc *sch)`
`315`	`315`	`rtnl_qdisc_drop(skb, sch);`
`316`	`316`	`}`
`317`	`317`
`318`		`- sch->q.qlen = 0;`
`319`		`- sch->qstats.backlog = 0;`
`320`	`318`	`if (q->tab)`
`321`	`319`	`memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *));`
`322`	`320`	`q->head = q->tail = 0;`
Original file line number	Diff line number	Diff line change
`@@ -441,8 +441,6 @@ static void drr_reset_qdisc(struct Qdisc *sch)`
`441`	`441`	`qdisc_reset(cl->qdisc);`
`442`	`442`	`}`
`443`	`443`	`}`
`444`		`- sch->qstats.backlog = 0;`
`445`		`- sch->q.qlen = 0;`
`446`	`444`	`}`
`447`	`445`
`448`	`446`	`static void drr_destroy_qdisc(struct Qdisc *sch)`
Original file line number	Diff line number	Diff line change
`@@ -409,8 +409,6 @@ static void dsmark_reset(struct Qdisc *sch)`
`409`	`409`	`pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);`
`410`	`410`	`if (p->q)`
`411`	`411`	`qdisc_reset(p->q);`
`412`		`- sch->qstats.backlog = 0;`
`413`		`- sch->q.qlen = 0;`
`414`	`412`	`}`
`415`	`413`
`416`	`414`	`static void dsmark_destroy(struct Qdisc *sch)`
Original file line number	Diff line number	Diff line change
`@@ -445,9 +445,6 @@ static void etf_reset(struct Qdisc *sch)`
`445`	`445`	`timesortedlist_clear(sch);`
`446`	`446`	`__qdisc_reset_queue(&sch->q);`
`447`	`447`
`448`		`- sch->qstats.backlog = 0;`
`449`		`- sch->q.qlen = 0;`
`450`		`-`
`451`	`448`	`q->last = 0;`
`452`	`449`	`}`
`453`	`450`
Original file line number	Diff line number	Diff line change
`@@ -731,8 +731,6 @@ static void ets_qdisc_reset(struct Qdisc *sch)`
`731`	`731`	`}`
`732`	`732`	`for (band = 0; band < q->nbands; band++)`
`733`	`733`	`qdisc_reset(q->classes[band].qdisc);`
`734`		`- sch->qstats.backlog = 0;`
`735`		`- sch->q.qlen = 0;`
`736`	`734`	`}`
`737`	`735`
`738`	`736`	`static void ets_qdisc_destroy(struct Qdisc *sch)`
Original file line number	Diff line number	Diff line change
`@@ -347,8 +347,6 @@ static void fq_codel_reset(struct Qdisc *sch)`
`347`	`347`	`codel_vars_init(&flow->cvars);`
`348`	`348`	`}`
`349`	`349`	`memset(q->backlogs, 0, q->flows_cnt * sizeof(u32));`
`350`		`- sch->q.qlen = 0;`
`351`		`- sch->qstats.backlog = 0;`
`352`	`350`	`q->memory_usage = 0;`
`353`	`351`	`}`
`354`	`352`
Original file line number	Diff line number	Diff line change
`@@ -521,9 +521,6 @@ static void fq_pie_reset(struct Qdisc *sch)`
`521`	`521`	`INIT_LIST_HEAD(&flow->flowchain);`
`522`	`522`	`pie_vars_init(&flow->vars);`
`523`	`523`	`}`
`524`		`-`
`525`		`- sch->q.qlen = 0;`
`526`		`- sch->qstats.backlog = 0;`
`527`	`524`	`}`
`528`	`525`
`529`	`526`	`static void fq_pie_destroy(struct Qdisc *sch)`