From 69747650c814a8a79fef412c7416adf823293a3e Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Sun, 17 Aug 2008 23:55:36 -0700 Subject: pkt_sched: Fix return value corruption in HTB and TBF. Based upon a bug report by Josip Rodin. Packet schedulers should only return NET_XMIT_DROP iff the packet really was dropped. If the packet does reach the device after we return NET_XMIT_DROP then TCP can crash because it depends upon the enqueue path return values being accurate. Signed-off-by: David S. Miller --- net/sched/sch_tbf.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) (limited to 'net/sched/sch_tbf.c') diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c index 7d3b7ff..94c6159 100644 --- a/net/sched/sch_tbf.c +++ b/net/sched/sch_tbf.c @@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch) struct tbf_sched_data *q = qdisc_priv(sch); int ret; - if (qdisc_pkt_len(skb) > q->max_size) { - sch->qstats.drops++; -#ifdef CONFIG_NET_CLS_ACT - if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch)) -#endif - kfree_skb(skb); - - return NET_XMIT_DROP; - } + if (qdisc_pkt_len(skb) > q->max_size) + return qdisc_reshape_fail(skb, sch); ret = qdisc_enqueue(skb, q->qdisc); if (ret != 0) { -- cgit v1.1