)]}'
{
  "commit": "7217e46094ce6bf030248161190afe8b3d8678e8",
  "tree": "39d8d2fd8c2375bd737840d27f17f491df6070be",
  "parents": [
    "34a3e6ba4f26e8e08cbb523f5a9234fc74624610"
  ],
  "author": {
    "name": "Cong Wang",
    "email": "xiyou.wangcong@gmail.com",
    "time": "Sun May 18 15:20:37 2025 -0700"
  },
  "committer": {
    "name": "Cloud Image Release",
    "email": "cloud-image-release@prod.google.com",
    "time": "Fri May 30 10:31:35 2025 -0700"
  },
  "message": "sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\n\n[ Upstream commit 3f981138109f63232a5fb7165938d4c945cc1b9d ]\n\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\nchild qdisc\u0027s peek() operation before incrementing sch-\u003eq.qlen and\nsch-\u003eqstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\ntrigger an immediate dequeue and potential packet drop. In such cases,\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc\u0027s qlen and backlog\nhave not yet been updated, leading to inconsistent queue accounting. This\ncan leave an empty HFSC class in the active list, causing further\nconsequences like use-after-free.\n\nThis patch fixes the bug by moving the increment of sch-\u003eq.qlen and\nsch-\u003eqstats.backlog before the call to the child qdisc\u0027s peek() operation.\nThis ensures that queue length and backlog are always accurate when packet\ndrops or dequeues are triggered during the peek.\n\nBUG\u003db/420529374\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed KCTF-3f98113 in the kernel.\n\ncos-patch: security-high\nFixes: 12d0ad3be9c3 (\"net/sched/sch_hfsc.c: handle corner cases where head may change invalidating calculated deadline\")\nReported-by: Mingi Cho \u003cmincho@theori.io\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20250518222038.58538-2-xiyou.wangcong@gmail.com\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nChange-Id: If2d03dbc9a4a92185749d01dc90813557980ddf5\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/103304\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Shuo Yang \u003cgshuoy@google.com\u003e\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/103582\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d8e6e7975af33cb87ba2bfe0368e7a0ce26c4862",
      "old_mode": 33188,
      "old_path": "net/sched/sch_hfsc.c",
      "new_id": "9a6cfdbcded761c082aa86540e334803f4149c27",
      "new_mode": 33188,
      "new_path": "net/sched/sch_hfsc.c"
    }
  ]
}