CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice

In the Linux kernel, the following vulnerability has been resolved:

net/sched: schhfsc: Don't make class passive twice

updatevf() is called from two places for the same class during a single dequeue when the class's child qdisc (e.g. codel/fqcodel) drops its last packets while dequeuing:

1. The child calls qdisctreereducebacklog(), which, now that the child is empty, invokes hfscqlennotify() -> updatevf(cl, 0, 0) and turns the class passive (clnactive is decremented up the hierarchy).

2. hfscdequeue() then calls updatevf(cl, qdiscpktlen(skb), curtime) to charge the dequeued bytes.

On the second call the class is already passive, but its child qdisc is still empty, so updatevf() arms gopassive again:

if (cl->qdisc->q.qlen == 0 && cl->clflags & HFSCFSC) gopassive = 1;

The leaf is then skipped by the clnactive == 0 check inside the loop, which does not clear gopassive, so the stale gopassive propagates to the parent and decrements its clnactive a second time. A parent that still has other active children is driven to clnactive == 0 and removed from the vttree, even though those siblings are still backlogged. They are never dequeued again and the qdisc stalls.

Fix this by only arming gopassive when the class is actually active, so an already-passive class no longer triggers a second passive transition. The byte accounting (cl->cltotal += len) still runs for every ancestor, so dequeued bytes continue to be counted exactly once.