Cong Wang d1365ca80b net_sched: Flush gso_skb list too during ->change() ... [ Upstream commit 2d3cbfd6d54a2c39ce3244f33f85c595844bd7b8 ] Previously, when reducing a qdisc's limit via the ->change() operation, only the main skb queue was trimmed, potentially leaving packets in the gso_skb list. This could result in NULL pointer dereference when we only check sch->limit against sch->q.qlen. This patch introduces a new helper, qdisc_dequeue_internal(), which ensures both the gso_skb list and the main queue are properly flushed when trimming excess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie) are updated to use this helper in their ->change() routines. Fixes: 76e3cc126b ("codel: Controlled Delay AQM") Fixes: 4b549a2ef4 ("fq_codel: Fair Queue Codel AQM") Fixes: afe4fd0624 ("pkt_sched: fq: Fair Queue packet scheduler") Fixes: ec97ecf1eb ("net: sched: add Flow Queue PIE packet scheduler") Fixes: 10239edf86 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc") Fixes: d4b36210c2 ("net: pkt_sched: PIE AQM scheme") Reported-by: Will <willsroot@protonmail.com> Reported-by: Savy <savy@syst3mfailure.io> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-05-22 14:29:39 +02:00
..
act_api.c	net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers	2024-10-23 11:31:27 +02:00
act_bpf.c	net: Rename mono_delivery_time to tstamp_type for scalabilty	2024-05-23 14:14:23 -07:00
act_connmark.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_csum.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_ct.c	sched: act_ct: avoid -Wflex-array-member-not-at-end warning	2024-08-12 17:54:24 -07:00
act_ctinfo.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_gact.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_gate.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_ife.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-02-22 15:29:26 -08:00
act_mpls.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_nat.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_pedit.c	net: sched: Annotate struct tc_pedit with __counted_by	2024-02-19 10:58:24 +00:00
act_police.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_sample.c	net: sched: act_sample: add action cookie to sample	2024-07-05 17:45:47 -07:00
act_simple.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_skbedit.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_skbmod.c	net/sched: act_skbmod: convert comma to semicolon	2024-07-11 17:12:15 -07:00
act_tunnel_key.c	net: fix geneve_opt length integer overflow	2025-04-10 14:39:34 +02:00
act_vlan.c	tc: adjust network header after 2nd vlan push	2024-08-27 11:37:42 +02:00
cls_api.c	tc: Ensure we have enough buffer space when sending filter netlink notifications	2025-04-20 10:15:07 +02:00
cls_basic.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
cls_bpf.c	net: sched: refine software bypass handling in tc_run	2025-02-08 09:57:25 +01:00
cls_cgroup.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
cls_flow.c	net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute	2025-01-17 13:40:37 +01:00
cls_flower.c	net: fix geneve_opt length integer overflow	2025-04-10 14:39:34 +02:00
cls_fw.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
cls_matchall.c	net: sched: refine software bypass handling in tc_run	2025-02-08 09:57:25 +01:00
cls_route.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
cls_u32.c	net: sched: refine software bypass handling in tc_run	2025-02-08 09:57:25 +01:00
em_canid.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
em_cmp.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
em_ipset.c
em_ipt.c
em_meta.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
em_nbyte.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
em_text.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
em_u32.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
ematch.c	net_sched: reject TCF_EM_SIMPLE case for complex ematch module	2022-12-19 09:43:18 +00:00
Kconfig	net: sched: Remove NET_ACT_IPT from Kconfig	2024-02-13 11:24:35 +01:00
Makefile	net/sched: Retire ipt action	2024-01-02 12:41:16 +00:00
sch_api.c	net_sched: Prevent creation of classes with TC_H_ROOT	2025-03-22 12:54:13 -07:00
sch_blackhole.c
sch_cake.c	sched: sch_cake: add bounds checks to host bulk flow fairness counts	2025-01-17 13:40:41 +01:00
sch_cbs.c	net/sched: cbs: Fix integer overflow in cbs_set_port_rate()	2024-12-14 20:03:47 +01:00
sch_choke.c	net: sched: fix ordering of qlen adjustment	2024-12-27 14:01:57 +01:00
sch_codel.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:29:39 +02:00
sch_drr.c	sch_drr: make drr_qlen_notify() idempotent	2025-05-09 09:50:50 +02:00
sch_etf.c	net_sched: sch_tfs: implement lockless etf_dump()	2024-04-19 11:34:07 +01:00
sch_ets.c	sch_ets: make est_qlen_notify() idempotent	2025-05-09 09:50:51 +02:00
sch_fifo.c	pfifo_tail_enqueue: Drop new packet when sch->limit == 0	2025-02-17 10:05:01 +01:00
sch_fq_codel.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:29:39 +02:00
sch_fq_pie.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:29:39 +02:00
sch_fq.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:29:39 +02:00
sch_frag.c	net: dst: remove unnecessary input parameter in dst_alloc and dst_init	2023-09-12 11:42:25 +02:00
sch_generic.c	ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()	2025-02-08 09:57:07 +01:00
sch_gred.c	sched: address a potential NULL pointer dereference in the GRED scheduler.	2025-03-22 12:54:10 -07:00
sch_hfsc.c	sch_hfsc: make hfsc_qlen_notify() idempotent	2025-05-09 09:50:50 +02:00
sch_hhf.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:29:39 +02:00
sch_htb.c	sch_htb: make htb_deactivate() idempotent	2025-05-18 08:24:47 +02:00
sch_ingress.c	bpf: Fix too early release of tcx_entry	2024-07-08 14:07:31 -07:00
sch_mq.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-07 10:25:39 +01:00
sch_mqprio_lib.c	net: sched: Fill in missing MODULE_DESCRIPTION for qdiscs	2023-11-01 21:49:09 -07:00
sch_mqprio_lib.h	net/sched: mqprio: allow per-TC user input of FP adminStatus	2023-04-13 22:22:10 -07:00
sch_mqprio.c	netlink: introduce type-checking attribute iteration	2024-03-29 15:06:02 -07:00
sch_multiq.c	net: sched: sch_multiq: fix possible OOB write in multiq_tune()	2024-06-05 10:50:19 +01:00
sch_netem.c	netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()	2025-02-17 10:05:01 +01:00
sch_pie.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:29:39 +02:00
sch_plug.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
sch_prio.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
sch_qfq.c	sch_qfq: make qfq_qlen_notify() idempotent	2025-05-09 09:50:50 +02:00
sch_red.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
sch_sfb.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
sch_sfq.c	net_sched: sch_sfq: move the limit validation	2025-04-20 10:15:08 +02:00
sch_skbprio.c	net_sched: skbprio: Remove overly strict queue assertions	2025-04-10 14:39:33 +02:00
sch_taprio.c	net: sched: use RCU read-side critical section in taprio_dump()	2024-10-23 13:26:15 +02:00
sch_tbf.c	net/sched: tbf: correct backlog statistic for GSO packets	2024-12-14 20:03:03 +01:00
sch_teql.c	net: annotate writes on dev->mtu from ndo_change_mtu()	2024-05-07 16:19:14 -07:00