net/sched: sch_htb: do not change sch->flags in htb_dump()

htb_dump() runs without holding qdisc spinlock.

It is illegal to touch sch->flags with non locked RMW,
as concurrent readers might see intermediate wrong values.

Set TCQ_F_OFFLOADED in control path (htb_init()) instead.

Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260514095935.3926276-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 1e600f65c8769a74286c4f060b0d45da9a13eeeb..873337ac1cca28ea1a32778d8e91cacb5bd3af9c 100644 (file)
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1147,6 +1147,7 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt,
         * parts (especially calling ndo_setup_tc) on errors.
         */
        q->offload = true;
+       sch->flags |= TCQ_F_OFFLOADED;
 
        return 0;
 }
@@ -1207,11 +1208,6 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
        struct nlattr *nest;
        struct tc_htb_glob gopt;
 
-       if (q->offload)
-               sch->flags |= TCQ_F_OFFLOADED;
-       else
-               sch->flags &= ~TCQ_F_OFFLOADED;
-
        sch->qstats.overlimits = q->overlimits;
        /* Its safe to not acquire qdisc lock. As we hold RTNL,
         * no change can happen on the qdisc parameters.