net: sched: delete duplicate cleanup of backlog and qlen

roxanan1996 · roxanan1996 · commit 3f8ef3d7ed6a · 2025-12-19T15:18:55.000+01:00
jira VULN-155239 cve-pre CVE-2022-50356 commit-author Zhengchao Shao <shaozhengchao@huawei.com> commit c19d893 qdisc_reset() is clearing qdisc->q.qlen and qdisc->qstats.backlog _after_ calling qdisc->ops->reset. There is no need to clear them again in the specific reset function. Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> Link: https://lore.kernel.org/r/20220824005231.345727-1-shaozhengchao@huawei.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit c19d893) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
@@ -1175,7 +1175,6 @@ static inline void __qdisc_reset_queue(struct qdisc_skb_head *qh)
 static inline void qdisc_reset_queue(struct Qdisc *sch)
 {
 	__qdisc_reset_queue(&sch->q);
-	sch->qstats.backlog = 0;
 }
 
 static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
@@ -575,7 +575,6 @@ static void atm_tc_reset(struct Qdisc *sch)
 	pr_debug("atm_tc_reset(sch %p,[qdisc %p])\n", sch, p);
 	list_for_each_entry(flow, &p->flows, list)
 		qdisc_reset(flow->q);
-	sch->q.qlen = 0;
 }
 
 static void atm_tc_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
@@ -1058,7 +1058,6 @@ cbq_reset(struct Qdisc *sch)
 			cl->cpriority = cl->priority;
 		}
 	}
-	sch->q.qlen = 0;
 }
 
 
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
@@ -319,8 +319,6 @@ static void choke_reset(struct Qdisc *sch)
 		rtnl_qdisc_drop(skb, sch);
 	}
 
-	sch->q.qlen = 0;
-	sch->qstats.backlog = 0;
 	if (q->tab)
 		memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *));
 	q->head = q->tail = 0;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
@@ -447,8 +447,6 @@ static void drr_reset_qdisc(struct Qdisc *sch)
 			qdisc_reset(cl->qdisc);
 		}
 	}
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void drr_destroy_qdisc(struct Qdisc *sch)
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
@@ -408,8 +408,6 @@ static void dsmark_reset(struct Qdisc *sch)
 	pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
 	if (p->q)
 		qdisc_reset(p->q);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void dsmark_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_etf.c b/net/sched/sch_etf.c
@@ -445,9 +445,6 @@ static void etf_reset(struct Qdisc *sch)
 	timesortedlist_clear(sch);
 	__qdisc_reset_queue(&sch->q);
 
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
-
 	q->last = 0;
 }
 
diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c
@@ -731,8 +731,6 @@ static void ets_qdisc_reset(struct Qdisc *sch)
 	}
 	for (band = 0; band < q->nbands; band++)
 		qdisc_reset(q->classes[band].qdisc);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void ets_qdisc_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
@@ -351,8 +351,6 @@ static void fq_codel_reset(struct Qdisc *sch)
 		codel_vars_init(&flow->cvars);
 	}
 	memset(q->backlogs, 0, q->flows_cnt * sizeof(u32));
-	sch->q.qlen = 0;
-	sch->qstats.backlog = 0;
 	q->memory_usage = 0;
 }
 
diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c
@@ -514,9 +514,6 @@ static void fq_pie_reset(struct Qdisc *sch)
 		INIT_LIST_HEAD(&flow->flowchain);
 		pie_vars_init(&flow->vars);
 	}
-
-	sch->q.qlen = 0;
-	sch->qstats.backlog = 0;
 }
 
 static void fq_pie_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
@@ -1511,8 +1511,6 @@ hfsc_reset_qdisc(struct Qdisc *sch)
 	}
 	q->eligible = RB_ROOT;
 	qdisc_watchdog_cancel(&q->watchdog);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
@@ -977,8 +977,6 @@ static void htb_reset(struct Qdisc *sch)
 	}
 	qdisc_watchdog_cancel(&q->watchdog);
 	__qdisc_reset_queue(&q->direct_queue);
-	sch->q.qlen = 0;
-	sch->qstats.backlog = 0;
 	memset(q->hlevel, 0, sizeof(q->hlevel));
 	memset(q->row_mask, 0, sizeof(q->row_mask));
 }
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
@@ -163,7 +163,6 @@ multiq_reset(struct Qdisc *sch)
 
 	for (band = 0; band < q->bands; band++)
 		qdisc_reset(q->queues[band]);
-	sch->q.qlen = 0;
 	q->curband = 0;
 }
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
@@ -139,8 +139,6 @@ prio_reset(struct Qdisc *sch)
 
 	for (prio = 0; prio < q->bands; prio++)
 		qdisc_reset(q->queues[prio]);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static int prio_offload(struct Qdisc *sch, struct tc_prio_qopt *qopt)
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
@@ -1487,8 +1487,6 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
 			qdisc_reset(cl->qdisc);
 		}
 	}
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void qfq_destroy_qdisc(struct Qdisc *sch)
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
@@ -182,8 +182,6 @@ static void red_reset(struct Qdisc *sch)
 	struct red_sched_data *q = qdisc_priv(sch);
 
 	qdisc_reset(q->qdisc);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 	red_restart(&q->vars);
 }
 
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
@@ -457,8 +457,6 @@ static void sfb_reset(struct Qdisc *sch)
 	struct sfb_sched_data *q = qdisc_priv(sch);
 
 	qdisc_reset(q->qdisc);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 	q->slot = 0;
 	q->double_buffering = false;
 	sfb_zero_all_buckets(q);
diff --git a/net/sched/sch_skbprio.c b/net/sched/sch_skbprio.c
@@ -217,9 +217,6 @@ static void skbprio_reset(struct Qdisc *sch)
 	struct skbprio_sched_data *q = qdisc_priv(sch);
 	int prio;
 
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
-
 	for (prio = 0; prio < SKBPRIO_MAX_PRIORITY; prio++)
 		__skb_queue_purge(&q->qdiscs[prio]);
 
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
@@ -1658,8 +1658,6 @@ static void taprio_reset(struct Qdisc *sch)
 			if (q->qdiscs[i])
 				qdisc_reset(q->qdiscs[i]);
 	}
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 }
 
 static void taprio_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
@@ -321,8 +321,6 @@ static void tbf_reset(struct Qdisc *sch)
 	struct tbf_sched_data *q = qdisc_priv(sch);
 
 	qdisc_reset(q->qdisc);
-	sch->qstats.backlog = 0;
-	sch->q.qlen = 0;
 	q->t_c = ktime_get_ns();
 	q->tokens = q->buffer;
 	q->ptokens = q->mtu;
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
@@ -128,7 +128,6 @@ teql_reset(struct Qdisc *sch)
 	struct teql_sched_data *dat = qdisc_priv(sch);
 
 	skb_queue_purge(&dat->q);
-	sch->q.qlen = 0;
 }
 
 static void

Original file line number	Diff line number	Diff line change
`@@ -1175,7 +1175,6 @@ static inline void __qdisc_reset_queue(struct qdisc_skb_head *qh)`
`1175`	`1175`	`static inline void qdisc_reset_queue(struct Qdisc *sch)`
`1176`	`1176`	`{`
`1177`	`1177`	`__qdisc_reset_queue(&sch->q);`
`1178`		`- sch->qstats.backlog = 0;`
`1179`	`1178`	`}`
`1180`	`1179`
`1181`	`1180`	`static inline struct Qdisc qdisc_replace(struct Qdisc sch, struct Qdisc *new,`
Original file line number	Diff line number	Diff line change
`@@ -575,7 +575,6 @@ static void atm_tc_reset(struct Qdisc *sch)`
`575`	`575`	`pr_debug("atm_tc_reset(sch %p,[qdisc %p])\n", sch, p);`
`576`	`576`	`list_for_each_entry(flow, &p->flows, list)`
`577`	`577`	`qdisc_reset(flow->q);`
`578`		`- sch->q.qlen = 0;`
`579`	`578`	`}`
`580`	`579`
`581`	`580`	`static void atm_tc_destroy(struct Qdisc *sch)`
Original file line number	Diff line number	Diff line change
`@@ -1058,7 +1058,6 @@ cbq_reset(struct Qdisc *sch)`
`1058`	`1058`	`cl->cpriority = cl->priority;`
`1059`	`1059`	`}`
`1060`	`1060`	`}`
`1061`		`- sch->q.qlen = 0;`
`1062`	`1061`	`}`
`1063`	`1062`
`1064`	`1063`
Original file line number	Diff line number	Diff line change
`@@ -319,8 +319,6 @@ static void choke_reset(struct Qdisc *sch)`
`319`	`319`	`rtnl_qdisc_drop(skb, sch);`
`320`	`320`	`}`
`321`	`321`
`322`		`- sch->q.qlen = 0;`
`323`		`- sch->qstats.backlog = 0;`
`324`	`322`	`if (q->tab)`
`325`	`323`	`memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *));`
`326`	`324`	`q->head = q->tail = 0;`
Original file line number	Diff line number	Diff line change
`@@ -447,8 +447,6 @@ static void drr_reset_qdisc(struct Qdisc *sch)`
`447`	`447`	`qdisc_reset(cl->qdisc);`
`448`	`448`	`}`
`449`	`449`	`}`
`450`		`- sch->qstats.backlog = 0;`
`451`		`- sch->q.qlen = 0;`
`452`	`450`	`}`
`453`	`451`
`454`	`452`	`static void drr_destroy_qdisc(struct Qdisc *sch)`
Original file line number	Diff line number	Diff line change
`@@ -408,8 +408,6 @@ static void dsmark_reset(struct Qdisc *sch)`
`408`	`408`	`pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);`
`409`	`409`	`if (p->q)`
`410`	`410`	`qdisc_reset(p->q);`
`411`		`- sch->qstats.backlog = 0;`
`412`		`- sch->q.qlen = 0;`
`413`	`411`	`}`
`414`	`412`
`415`	`413`	`static void dsmark_destroy(struct Qdisc *sch)`
Original file line number	Diff line number	Diff line change
`@@ -445,9 +445,6 @@ static void etf_reset(struct Qdisc *sch)`
`445`	`445`	`timesortedlist_clear(sch);`
`446`	`446`	`__qdisc_reset_queue(&sch->q);`
`447`	`447`
`448`		`- sch->qstats.backlog = 0;`
`449`		`- sch->q.qlen = 0;`
`450`		`-`
`451`	`448`	`q->last = 0;`
`452`	`449`	`}`
`453`	`450`
Original file line number	Diff line number	Diff line change
`@@ -731,8 +731,6 @@ static void ets_qdisc_reset(struct Qdisc *sch)`
`731`	`731`	`}`
`732`	`732`	`for (band = 0; band < q->nbands; band++)`
`733`	`733`	`qdisc_reset(q->classes[band].qdisc);`
`734`		`- sch->qstats.backlog = 0;`
`735`		`- sch->q.qlen = 0;`
`736`	`734`	`}`
`737`	`735`
`738`	`736`	`static void ets_qdisc_destroy(struct Qdisc *sch)`
Original file line number	Diff line number	Diff line change
`@@ -351,8 +351,6 @@ static void fq_codel_reset(struct Qdisc *sch)`
`351`	`351`	`codel_vars_init(&flow->cvars);`
`352`	`352`	`}`
`353`	`353`	`memset(q->backlogs, 0, q->flows_cnt * sizeof(u32));`
`354`		`- sch->q.qlen = 0;`
`355`		`- sch->qstats.backlog = 0;`
`356`	`354`	`q->memory_usage = 0;`
`357`	`355`	`}`
`358`	`356`
Original file line number	Diff line number	Diff line change
`@@ -514,9 +514,6 @@ static void fq_pie_reset(struct Qdisc *sch)`
`514`	`514`	`INIT_LIST_HEAD(&flow->flowchain);`
`515`	`515`	`pie_vars_init(&flow->vars);`
`516`	`516`	`}`
`517`		`-`
`518`		`- sch->q.qlen = 0;`
`519`		`- sch->qstats.backlog = 0;`
`520`	`517`	`}`
`521`	`518`
`522`	`519`	`static void fq_pie_destroy(struct Qdisc *sch)`