net/sched: sch_htb: annotate data-races (I)

htb_dump() runs without holding qdisc spinlock.

Add missing READ_ONCE()/WRITE_ONCE() annotations around
q->overlimits and q->direct_pkts.

Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260514095935.3926276-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 873337ac1cca28ea1a32778d8e91cacb5bd3af9c..5bf1889bc0300e8e3a61d56ddcf1bb1402955107 100644 (file)
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -568,7 +568,7 @@ htb_change_class_mode(struct htb_sched *q, struct htb_class *cl, s64 *diff)
 
        if (new_mode == HTB_CANT_SEND) {
                cl->overlimits++;
-               q->overlimits++;
+               WRITE_ONCE(q->overlimits, q->overlimits + 1);
        }
 
        if (cl->prio_activity) {        /* not necessary: speed optimization */
@@ -628,7 +628,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                /* enqueue to helper queue */
                if (q->direct_queue.qlen < q->direct_qlen) {
                        __qdisc_enqueue_tail(skb, &q->direct_queue);
-                       q->direct_pkts++;
+                       WRITE_ONCE(q->direct_pkts, q->direct_pkts + 1);
                } else {
                        return qdisc_drop(skb, sch, to_free);
                }
@@ -1208,12 +1208,12 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
        struct nlattr *nest;
        struct tc_htb_glob gopt;
 
-       sch->qstats.overlimits = q->overlimits;
+       sch->qstats.overlimits = READ_ONCE(q->overlimits);
        /* Its safe to not acquire qdisc lock. As we hold RTNL,
         * no change can happen on the qdisc parameters.
         */
 
-       gopt.direct_pkts = q->direct_pkts;
+       gopt.direct_pkts = READ_ONCE(q->direct_pkts);
        gopt.version = HTB_VER;
        gopt.rate2quantum = q->rate2quantum;
        gopt.defcls = q->defcls;