Patch "sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     sch_htb-avoid-grafting-on-htb_destroy_class_offload-.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 76d7374bbb049a3d32f6f3f65c2807f44c1caa1a
Author: Rahul Rameshbabu <rrameshbabu@xxxxxxxxxx>
Date:   Thu Jan 12 16:55:29 2023 -0800

    sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb
    
    [ Upstream commit a22b7388d658ecfcd226600c8c34ce4481e88655 ]
    
    Peek at old qdisc and graft only when deleting a leaf class in the htb,
    rather than when deleting the htb itself. Do not peek at the qdisc of the
    netdev queue when destroying the htb. The caller may already have grafted a
    new qdisc that is not part of the htb structure being destroyed.
    
    This fix resolves two use cases.
    
      1. Using tc to destroy the htb.
        - Netdev was being prematurely activated before the htb was fully
          destroyed.
      2. Using tc to replace the htb with another qdisc (which also leads to
         the htb being destroyed).
        - Premature netdev activation like previous case. Newly grafted qdisc
          was also getting accidentally overwritten when destroying the htb.
    
    Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload")
    Signed-off-by: Rahul Rameshbabu <rrameshbabu@xxxxxxxxxx>
    Reviewed-by: Saeed Mahameed <saeedm@xxxxxxxxxx>
    Reviewed-by: Maxim Mikityanskiy <maxtram95@xxxxxxxxx>
    Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230113005528.302625-1-rrameshbabu@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index e5b4bbf3ce3d..3afac9c21a76 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1545,7 +1545,7 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl,
 	struct tc_htb_qopt_offload offload_opt;
 	struct netdev_queue *dev_queue;
 	struct Qdisc *q = cl->leaf.q;
-	struct Qdisc *old = NULL;
+	struct Qdisc *old;
 	int err;
 
 	if (cl->level)
@@ -1553,14 +1553,17 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl,
 
 	WARN_ON(!q);
 	dev_queue = htb_offload_get_queue(cl);
-	old = htb_graft_helper(dev_queue, NULL);
-	if (destroying)
-		/* Before HTB is destroyed, the kernel grafts noop_qdisc to
-		 * all queues.
+	/* When destroying, caller qdisc_graft grafts the new qdisc and invokes
+	 * qdisc_put for the qdisc being destroyed. htb_destroy_class_offload
+	 * does not need to graft or qdisc_put the qdisc being destroyed.
+	 */
+	if (!destroying) {
+		old = htb_graft_helper(dev_queue, NULL);
+		/* Last qdisc grafted should be the same as cl->leaf.q when
+		 * calling htb_delete.
 		 */
-		WARN_ON(!(old->flags & TCQ_F_BUILTIN));
-	else
 		WARN_ON(old != q);
+	}
 
 	if (cl->parent) {
 		_bstats_update(&cl->parent->bstats_bias,
@@ -1577,10 +1580,12 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl,
 	};
 	err = htb_offload(qdisc_dev(sch), &offload_opt);
 
-	if (!err || destroying)
-		qdisc_put(old);
-	else
-		htb_graft_helper(dev_queue, old);
+	if (!destroying) {
+		if (!err)
+			qdisc_put(old);
+		else
+			htb_graft_helper(dev_queue, old);
+	}
 
 	if (last_child)
 		return err;