Skip to content

[ciqlts9_2] CVE-2022-50356 #728

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
roxanan1996 merged 2 commits into from
Dec 1, 2025
Merged

[ciqlts9_2] CVE-2022-50356 #728

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
874f503
net: sched: delete duplicate cleanup of backlog and qlen
roxanan1996 Nov 18, 2025
bc910cb
net: sched: sfb: fix null pointer access issue when sfb_init() fails
roxanan1996 Nov 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion include/net/sch_generic.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1137,7 +1137,6 @@ static inline void __qdisc_reset_queue(struct qdisc_skb_head *qh)
static inline void qdisc_reset_queue(struct Qdisc *sch)
{
__qdisc_reset_queue(&sch->q);
sch->qstats.backlog = 0;
}

static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
Expand Down
1 change: 0 additions & 1 deletion net/sched/sch_atm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -577,7 +577,6 @@ static void atm_tc_reset(struct Qdisc *sch)
pr_debug("atm_tc_reset(sch %p,[qdisc %p])\n", sch, p);
list_for_each_entry(flow, &p->flows, list)
qdisc_reset(flow->q);
sch->q.qlen = 0;
}

static void atm_tc_destroy(struct Qdisc *sch)
Expand Down
1 change: 0 additions & 1 deletion net/sched/sch_cbq.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -975,7 +975,6 @@ cbq_reset(struct Qdisc *sch)
cl->cpriority = cl->priority;
}
}
sch->q.qlen = 0;
}


Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_choke.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,8 +315,6 @@ static void choke_reset(struct Qdisc *sch)
rtnl_qdisc_drop(skb, sch);
}

sch->q.qlen = 0;
sch->qstats.backlog = 0;
if (q->tab)
memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *));
q->head = q->tail = 0;
Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_drr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -441,8 +441,6 @@ static void drr_reset_qdisc(struct Qdisc *sch)
qdisc_reset(cl->qdisc);
}
}
sch->qstats.backlog = 0;
sch->q.qlen = 0;
}

static void drr_destroy_qdisc(struct Qdisc *sch)
Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_dsmark.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,8 +409,6 @@ static void dsmark_reset(struct Qdisc *sch)
pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
if (p->q)
qdisc_reset(p->q);
sch->qstats.backlog = 0;
sch->q.qlen = 0;
}

static void dsmark_destroy(struct Qdisc *sch)
Expand Down
3 changes: 0 additions & 3 deletions net/sched/sch_etf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -445,9 +445,6 @@ static void etf_reset(struct Qdisc *sch)
timesortedlist_clear(sch);
__qdisc_reset_queue(&sch->q);

sch->qstats.backlog = 0;
sch->q.qlen = 0;

q->last = 0;
}

Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_ets.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -731,8 +731,6 @@ static void ets_qdisc_reset(struct Qdisc *sch)
}
for (band = 0; band < q->nbands; band++)
qdisc_reset(q->classes[band].qdisc);
sch->qstats.backlog = 0;
sch->q.qlen = 0;
}

static void ets_qdisc_destroy(struct Qdisc *sch)
Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_fq_codel.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,8 +347,6 @@ static void fq_codel_reset(struct Qdisc *sch)
codel_vars_init(&flow->cvars);
}
memset(q->backlogs, 0, q->flows_cnt * sizeof(u32));
sch->q.qlen = 0;
sch->qstats.backlog = 0;
q->memory_usage = 0;
}

Expand Down
3 changes: 0 additions & 3 deletions net/sched/sch_fq_pie.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -521,9 +521,6 @@ static void fq_pie_reset(struct Qdisc *sch)
INIT_LIST_HEAD(&flow->flowchain);
pie_vars_init(&flow->vars);
}

sch->q.qlen = 0;
sch->qstats.backlog = 0;
}

static void fq_pie_destroy(struct Qdisc *sch)
Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_hfsc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1514,8 +1514,6 @@ hfsc_reset_qdisc(struct Qdisc *sch)
}
q->eligible = RB_ROOT;
qdisc_watchdog_cancel(&q->watchdog);
sch->qstats.backlog = 0;
sch->q.qlen = 0;
}

static void
Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_htb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1008,8 +1008,6 @@ static void htb_reset(struct Qdisc *sch)
}
qdisc_watchdog_cancel(&q->watchdog);
__qdisc_reset_queue(&q->direct_queue);
sch->q.qlen = 0;
sch->qstats.backlog = 0;
memset(q->hlevel, 0, sizeof(q->hlevel));
memset(q->row_mask, 0, sizeof(q->row_mask));
}
Expand Down
1 change: 0 additions & 1 deletion net/sched/sch_multiq.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,6 @@ multiq_reset(struct Qdisc *sch)

for (band = 0; band < q->bands; band++)
qdisc_reset(q->queues[band]);
sch->q.qlen = 0;
q->curband = 0;
}

Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_prio.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,8 +135,6 @@ prio_reset(struct Qdisc *sch)

for (prio = 0; prio < q->bands; prio++)
qdisc_reset(q->queues[prio]);
sch->qstats.backlog = 0;
sch->q.qlen = 0;
}

static int prio_offload(struct Qdisc *sch, struct tc_prio_qopt *qopt)
Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_qfq.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1459,8 +1459,6 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
qdisc_reset(cl->qdisc);
}
}
sch->qstats.backlog = 0;
sch->q.qlen = 0;
}

static void qfq_destroy_qdisc(struct Qdisc *sch)
Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_red.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,8 +178,6 @@ static void red_reset(struct Qdisc *sch)
struct red_sched_data *q = qdisc_priv(sch);

qdisc_reset(q->qdisc);
sch->qstats.backlog = 0;
sch->q.qlen = 0;
red_restart(&q->vars);
}

Expand Down
5 changes: 2 additions & 3 deletions net/sched/sch_sfb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -455,9 +455,8 @@ static void sfb_reset(struct Qdisc *sch)
{
struct sfb_sched_data *q = qdisc_priv(sch);

qdisc_reset(q->qdisc);
sch->qstats.backlog = 0;
sch->q.qlen = 0;
if (likely(q->qdisc))
qdisc_reset(q->qdisc);
q->slot = 0;
q->double_buffering = false;
sfb_zero_all_buckets(q);
Expand Down
3 changes: 0 additions & 3 deletions net/sched/sch_skbprio.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,9 +213,6 @@ static void skbprio_reset(struct Qdisc *sch)
struct skbprio_sched_data *q = qdisc_priv(sch);
int prio;

sch->qstats.backlog = 0;
sch->q.qlen = 0;

for (prio = 0; prio < SKBPRIO_MAX_PRIORITY; prio++)
__skb_queue_purge(&q->qdiscs[prio]);

Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_taprio.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1639,8 +1639,6 @@ static void taprio_reset(struct Qdisc *sch)
if (q->qdiscs[i])
qdisc_reset(q->qdiscs[i]);
}
sch->qstats.backlog = 0;
sch->q.qlen = 0;
}

static void taprio_destroy(struct Qdisc *sch)
Expand Down
2 changes: 0 additions & 2 deletions net/sched/sch_tbf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -330,8 +330,6 @@ static void tbf_reset(struct Qdisc *sch)
struct tbf_sched_data *q = qdisc_priv(sch);

qdisc_reset(q->qdisc);
sch->qstats.backlog = 0;
sch->q.qlen = 0;
q->t_c = ktime_get_ns();
q->tokens = q->buffer;
q->ptokens = q->mtu;
Expand Down
1 change: 0 additions & 1 deletion net/sched/sch_teql.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,6 @@ teql_reset(struct Qdisc *sch)
struct teql_sched_data *dat = qdisc_priv(sch);

skb_queue_purge(&dat->q);
sch->q.qlen = 0;
}

static void
Expand Down
Loading