public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] sch_qfq: fix overflow in qfq_update_start()
@ 2012-01-02 15:47 Eric Dumazet
  2012-01-02 21:45 ` Eric Dumazet
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Eric Dumazet @ 2012-01-02 15:47 UTC (permalink / raw)
  To: David Miller; +Cc: netdev, Stephen Hemminger, Dave Taht

grp->slot_shift is between 22 and 41, so using 32bit wide variables is
probably a typo.

This could explain QFQ hangs Dave reported to me, after 2^23 packets ?

(23 = 64 - 41)

Reported-by: Dave Taht <dave.taht@gmail.com>
CC: Stephen Hemminger <shemminger@vyatta.com>
CC: Dave Taht <dave.taht@gmail.com>
---
 net/sched/sch_qfq.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 1033434..7b03254 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -817,11 +817,11 @@ skip_unblock:
 static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
 {
 	unsigned long mask;
-	uint32_t limit, roundedF;
+	u64 limit, roundedF;
 	int slot_shift = cl->grp->slot_shift;
 
 	roundedF = qfq_round_down(cl->F, slot_shift);
-	limit = qfq_round_down(q->V, slot_shift) + (1UL << slot_shift);
+	limit = qfq_round_down(q->V, slot_shift) + (1ULL << slot_shift);
 
 	if (!qfq_gt(cl->F, q->V) || qfq_gt(roundedF, limit)) {
 		/* timestamp was stale */

^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2012-01-03 17:59 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-01-02 15:47 [PATCH] sch_qfq: fix overflow in qfq_update_start() Eric Dumazet
2012-01-02 21:45 ` Eric Dumazet
2012-01-02 21:56   ` Dave Taht
2012-01-03 16:25 ` Stephen Hemminger
2012-01-03 16:54   ` Luigi Rizzo
2012-01-03 17:59 ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox