Commit bdfc87f7 authored Sep 11, 2012 by Eric Dumazet Committed by David S. Miller Sep 11, 2012

net-sched: sch_cbq: avoid infinite loop



Its possible to setup a bad cbq configuration leading to
an infinite loop in cbq_classify()

DEV_OUT=eth0
ICMP="match ip protocol 1 0xff"
U32="protocol ip u32"
DST="match ip dst"
tc qdisc add dev $DEV_OUT root handle 1: cbq avpkt 1000 \
	bandwidth 100mbit
tc class add dev $DEV_OUT parent 1: classid 1:1 cbq \
	rate 512kbit allot 1500 prio 5 bounded isolated
tc filter add dev $DEV_OUT parent 1: prio 3 $U32 \
	$ICMP $DST 192.168.3.234 flowid 1:

Reported-by: Denys Fedoryschenko <denys@visp.net.lb>
Tested-by: Denys Fedoryschenko <denys@visp.net.lb>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent b48d6f8b

net/sched/sch_cbq.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -250,10 +250,11 @@ cbq_classify(struct sk_buff skb, struct Qdisc sch, int *qerr)
		else if ((cl = defmap[res.classid & TC_PRIO_MAX]) == NULL)
		cl = defmap[TC_PRIO_BESTEFFORT];

		if (cl == NULL \|\| cl->level >= head->level)
		if (cl == NULL)
		goto fallback;
		}

		if (cl->level >= head->level)
		goto fallback;
		#ifdef CONFIG_NET_CLS_ACT
		switch (result) {
		case TC_ACT_QUEUED: