pkt_sched: Fix return value corruption in HTB and TBF.
Based upon a bug report by Josip Rodin. Packet schedulers should only return NET_XMIT_DROP iff the packet really was dropped. If the packet does reach the device after we return NET_XMIT_DROP then TCP can crash because it depends upon the enqueue path return values being accurate. Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
96d203169d
commit
69747650c8
|
@ -577,7 +577,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
|
|||
sch->qstats.drops++;
|
||||
cl->qstats.drops++;
|
||||
}
|
||||
return NET_XMIT_DROP;
|
||||
return ret;
|
||||
} else {
|
||||
cl->bstats.packets +=
|
||||
skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
|
||||
|
@ -623,7 +623,7 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
|
|||
sch->qstats.drops++;
|
||||
cl->qstats.drops++;
|
||||
}
|
||||
return NET_XMIT_DROP;
|
||||
return ret;
|
||||
} else
|
||||
htb_activate(q, cl);
|
||||
|
||||
|
|
|
@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
|
|||
struct tbf_sched_data *q = qdisc_priv(sch);
|
||||
int ret;
|
||||
|
||||
if (qdisc_pkt_len(skb) > q->max_size) {
|
||||
sch->qstats.drops++;
|
||||
#ifdef CONFIG_NET_CLS_ACT
|
||||
if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))
|
||||
#endif
|
||||
kfree_skb(skb);
|
||||
|
||||
return NET_XMIT_DROP;
|
||||
}
|
||||
if (qdisc_pkt_len(skb) > q->max_size)
|
||||
return qdisc_reshape_fail(skb, sch);
|
||||
|
||||
ret = qdisc_enqueue(skb, q->qdisc);
|
||||
if (ret != 0) {
|
||||
|
|
Loading…
Reference in New Issue