net/sched: dualpi2: clear stale classification on filter miss

DualPI2 leaves previous classification state attached to an skb when
filter classification returns no match.  The enqueue path can then act
on stale state from an earlier classification attempt.

A filter miss should fall back to the default class without reusing old
per-packet classification data.

Initialize the classification result to CLASSIC before running the
classifier.  Explicit L4S, priority, and successful filter
classification can still override that default.

Fixes: 8f9516daedd6 ("sched: Add enqueue/dequeue of dualpi2 qdisc")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sched/sch_dualpi2.c b/net/sched/sch_dualpi2.c
index 5434df6ca8efe600cdec5eef2b05c01fef54bd89..27088760eff4431ada466226269ac5e0dbf6c0a6 100644 (file)
--- a/net/sched/sch_dualpi2.c
+++ b/net/sched/sch_dualpi2.c
@@ -346,6 +346,8 @@ static int dualpi2_skb_classify(struct dualpi2_sched_data *q,
        struct tcf_proto *fl;
        int result;
 
+       cb->classified = DUALPI2_C_CLASSIC;
+
        dualpi2_read_ect(skb);
        if (cb->ect & q->ecn_mask) {
                cb->classified = DUALPI2_C_L4S;
@@ -359,10 +361,8 @@ static int dualpi2_skb_classify(struct dualpi2_sched_data *q,
        }
 
        fl = rcu_dereference_bh(q->tcf_filters);
-       if (!fl) {
-               cb->classified = DUALPI2_C_CLASSIC;
+       if (!fl)
                return NET_XMIT_SUCCESS;
-       }
 
        result = tcf_classify(skb, NULL, fl, &res, false);
        if (result >= 0) {