sch_qfq: fix overflow in qfq_update_start()
authorEric Dumazet <eric.dumazet@gmail.com>
Mon, 2 Jan 2012 05:47:57 +0000 (05:47 +0000)
committerDavid S. Miller <davem@davemloft.net>
Tue, 3 Jan 2012 17:58:23 +0000 (12:58 -0500)
grp->slot_shift is between 22 and 41, so using 32bit wide variables is
probably a typo.

This could explain QFQ hangs Dave reported to me, after 2^23 packets ?

(23 = 64 - 41)

Reported-by: Dave Taht <dave.taht@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Stephen Hemminger <shemminger@vyatta.com>
CC: Dave Taht <dave.taht@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sched/sch_qfq.c

index 103343408593589e8f2343987f3f4b44afca5edb..7b0325459e718c6c0fb8d259ef7e10ecc6353130 100644 (file)
@@ -817,11 +817,11 @@ skip_unblock:
 static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
 {
        unsigned long mask;
-       uint32_t limit, roundedF;
+       u64 limit, roundedF;
        int slot_shift = cl->grp->slot_shift;
 
        roundedF = qfq_round_down(cl->F, slot_shift);
-       limit = qfq_round_down(q->V, slot_shift) + (1UL << slot_shift);
+       limit = qfq_round_down(q->V, slot_shift) + (1ULL << slot_shift);
 
        if (!qfq_gt(cl->F, q->V) || qfq_gt(roundedF, limit)) {
                /* timestamp was stale */