[Cake] [PATCH V2 RESEND] net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

[Xiang Mei <xmei5@asu.edu>]

In cake_drop(), the function qdisc_tree_reduce_backlog() is called to
decrement the qlen of the qdisc hierarchy. However, it may incorrectly
reduce the qlen when the dropped packet was not enqueued, leading to
a potential null-pointer dereference (e.g., when using qfq sched as
the parent qdisc).

This issue occurs when the caller (cake_enqueue()) returns NET_XMIT_CN,
causing the parent qdisc not to enqueue the current packet, while
qdisc_tree_reduce_backlog() still decrements the backlog.

This patch prevents invalid qlen reduction by verifying that the
dropped packet was actually enqueued before adjusting the backlog.

Fixes: 15de71d06a40 ("net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit")
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
v2: add missing cc

 net/sched/sch_cake.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 32bacfc314c2..3a2ba9dfc22d 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -1548,7 +1548,7 @@ static int cake_advance_shaper(struct cake_sched_data *q,
 	return len;
 }
 
-static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)
+static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free, u32 current_flow)
 {
 	struct cake_sched_data *q = qdisc_priv(sch);
 	ktime_t now = ktime_get();
@@ -1597,7 +1597,8 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)
 
 	qdisc_drop_reason(skb, sch, to_free, SKB_DROP_REASON_QDISC_OVERLIMIT);
 	sch->q.qlen--;
-	qdisc_tree_reduce_backlog(sch, 1, len);
+	if (likely(current_flow != idx + (tin << 16)))
+		qdisc_tree_reduce_backlog(sch, 1, len);
 
 	cake_heapify(q, 0);
 
@@ -1934,7 +1935,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 
 		while (q->buffer_used > q->buffer_limit) {
 			dropped++;
-			drop_id = cake_drop(sch, to_free);
+			drop_id = cake_drop(sch, to_free, idx + (tin << 16));
 
 			if ((drop_id >> 16) == tin &&
 			    (drop_id & 0xFFFF) == idx)
-- 
2.43.0