net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag

[ Upstream commit d837fbee92453fbb829f950c8e7cf76207d73f33 ]

This is more of a preventive patch to make the code more consistent and
to prevent possible exploits that employ child qlen manipulations on qfq.
use cl_is_active instead of relying on the child qdisc's qlen to determine
class activation.

Fixes: 462dbc9101acd ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260114160243.913069-3-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 7c6b5428b8ed40477a60398b0444779496fcc278..a17f7c31378e62bb7f241178d3fa8013864a6728 100644 (file)
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -373,7 +373,7 @@ static void qfq_rm_from_agg(struct qfq_sched *q, struct qfq_class *cl)
 /* Deschedule class and remove it from its parent aggregate. */
 static void qfq_deact_rm_from_agg(struct qfq_sched *q, struct qfq_class *cl)
 {
-       if (cl->qdisc->q.qlen > 0) /* class is active */
+       if (cl_is_active(cl)) /* class is active */
                qfq_deactivate_class(q, cl);
 
        qfq_rm_from_agg(q, cl);