sch_qfq: make qfq_qlen_notify() idempotent

qfq_qlen_notify() always deletes its class from its active list
with list_del_init() _and_ calls qfq_deactivate_agg() when the whole list
becomes empty.

To make it idempotent, just skip everything when it is not in the active
list.

Also change other list_del()'s to list_del_init() just to be extra safe.

Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250403211033.166059-5-xiyou.wangcong@gmail.com
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 2cfbc977fe6d0bc33d8a3379551779c9e847a0f1..687a932eb9b2f6e12b0dec49234323a22e014881 100644 (file)
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -347,7 +347,7 @@ static void qfq_deactivate_class(struct qfq_sched *q, struct qfq_class *cl)
        struct qfq_aggregate *agg = cl->agg;
 
 
-       list_del(&cl->alist); /* remove from RR queue of the aggregate */
+       list_del_init(&cl->alist); /* remove from RR queue of the aggregate */
        if (list_empty(&agg->active)) /* agg is now inactive */
                qfq_deactivate_agg(q, agg);
 }
@@ -474,6 +474,7 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
        gnet_stats_basic_sync_init(&cl->bstats);
        cl->common.classid = classid;
        cl->deficit = lmax;
+       INIT_LIST_HEAD(&cl->alist);
 
        cl->qdisc = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
                                      classid, NULL);
@@ -982,7 +983,7 @@ static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg,
        cl->deficit -= (int) len;
 
        if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */
-               list_del(&cl->alist);
+               list_del_init(&cl->alist);
        else if (cl->deficit < qdisc_pkt_len(cl->qdisc->ops->peek(cl->qdisc))) {
                cl->deficit += agg->lmax;
                list_move_tail(&cl->alist, &agg->active);
@@ -1415,6 +1416,8 @@ static void qfq_qlen_notify(struct Qdisc *sch, unsigned long arg)
        struct qfq_sched *q = qdisc_priv(sch);
        struct qfq_class *cl = (struct qfq_class *)arg;
 
+       if (list_empty(&cl->alist))
+               return;
        qfq_deactivate_class(q, cl);
 }