Re: SFQ qdisc crashes with limit of 2 packets

[Patrick McHardy <kaber@trash.net>]

Patrick McHardy wrote:
> Chuck Ebbert wrote:
> 
>>Limit of 1 is forbidden, crashes with 2, works with 3:
>>
>>>From disassembling sch_sfq.ko it seems that it is on line 360 of sch_sfq.c:
>>    sch->qstats.backlog -= skb->len;
>>where "skb" is an invalid pointer:
> 
> 
> 
> Is it a NULL pointer or something random?


Never mind, I found the reason. When enqueuing the packet, sfq_enqueue
contains an off-by-one in the limit check (which IIRC is there for a
reason, but I can't remember right now) and drops the packet again.
dev_queue_xmit() calls qdisc_run() anyway and the empty qdisc is
dequeued, which is not handled by SFQ.

I see three possibilities to fix this (in my preferred order):

1) figure out why the off-by-one is there, if not needed remove
2) don't dequeue qdiscs even once if empty
3) check for NULL in sfq_dequeue

So I'll try to remeber why the off-by-one is there ..