diff options
| author | David S. Miller <davem@davemloft.net> | 2008-08-17 23:55:36 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-08-18 00:39:41 -0700 |
| commit | 69747650c814a8a79fef412c7416adf823293a3e (patch) | |
| tree | c1c83e9ae903b0e93029f0071fdca544d2add340 /net/sched/sch_tbf.c | |
| parent | 96d203169d1d851ac1468f7d4459a09581be364c (diff) | |
| download | linux-stable-69747650c814a8a79fef412c7416adf823293a3e.tar.gz linux-stable-69747650c814a8a79fef412c7416adf823293a3e.tar.bz2 linux-stable-69747650c814a8a79fef412c7416adf823293a3e.zip | |
pkt_sched: Fix return value corruption in HTB and TBF.
Based upon a bug report by Josip Rodin.
Packet schedulers should only return NET_XMIT_DROP iff
the packet really was dropped. If the packet does reach
the device after we return NET_XMIT_DROP then TCP can
crash because it depends upon the enqueue path return
values being accurate.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/sch_tbf.c')
| -rw-r--r-- | net/sched/sch_tbf.c | 11 |
1 files changed, 2 insertions, 9 deletions
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c index 7d3b7ff3bf07..94c61598b86a 100644 --- a/net/sched/sch_tbf.c +++ b/net/sched/sch_tbf.c @@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch) struct tbf_sched_data *q = qdisc_priv(sch); int ret; - if (qdisc_pkt_len(skb) > q->max_size) { - sch->qstats.drops++; -#ifdef CONFIG_NET_CLS_ACT - if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch)) -#endif - kfree_skb(skb); - - return NET_XMIT_DROP; - } + if (qdisc_pkt_len(skb) > q->max_size) + return qdisc_reshape_fail(skb, sch); ret = qdisc_enqueue(skb, q->qdisc); if (ret != 0) { |