Commit 69747650 authored by David S. Miller's avatar David S. Miller
Browse files

pkt_sched: Fix return value corruption in HTB and TBF. 



Based upon a bug report by Josip Rodin.

Packet schedulers should only return NET_XMIT_DROP iff
the packet really was dropped.  If the packet does reach
the device after we return NET_XMIT_DROP then TCP can
crash because it depends upon the enqueue path return
values being accurate.

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 96d20316

net/sched/sch_htb.c

+2 −2
Original line number Diff line number Diff line
@@ -577,7 +577,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch) 
			sch->qstats.drops++;

			cl->qstats.drops++;

		}

		return NET_XMIT_DROP;

		return ret;

	} else {

		cl->bstats.packets +=

			skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
@@ -623,7 +623,7 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch) 
			sch->qstats.drops++;

			cl->qstats.drops++;

		}

		return NET_XMIT_DROP;

		return ret;

	} else

		htb_activate(q, cl);

net/sched/sch_tbf.c

+2 −9
Original line number Diff line number Diff line
@@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch) 
	struct tbf_sched_data *q = qdisc_priv(sch);

	int ret;



	if (qdisc_pkt_len(skb) > q->max_size) {

		sch->qstats.drops++;

#ifdef CONFIG_NET_CLS_ACT

		if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))

#endif

			kfree_skb(skb);



		return NET_XMIT_DROP;

	}

	if (qdisc_pkt_len(skb) > q->max_size)

		return qdisc_reshape_fail(skb, sch);



	ret = qdisc_enqueue(skb, q->qdisc);

	if (ret != 0) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE