select: deal with math overflow from borderline valid userland data

[linux-2.6-omap-h63xx.git] / net / sched / sch_fifo.c

diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index 95ed48221652df8aaf081af418c3042fbc76a72c..23d258bfe8ace223e07d0c23dc62fbe7e0ae9faa 100644 (file)
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -27,7 +27,7 @@ static int bfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 {
        struct fifo_sched_data *q = qdisc_priv(sch);
 
-       if (likely(sch->qstats.backlog + skb->len <= q->limit))
+       if (likely(sch->qstats.backlog + qdisc_pkt_len(skb) <= q->limit))
                return qdisc_enqueue_tail(skb, sch);
 
        return qdisc_reshape_fail(skb, sch);
@@ -48,10 +48,10 @@ static int fifo_init(struct Qdisc *sch, struct nlattr *opt)
        struct fifo_sched_data *q = qdisc_priv(sch);
 
        if (opt == NULL) {
-               u32 limit = sch->dev->tx_queue_len ? : 1;
+               u32 limit = qdisc_dev(sch)->tx_queue_len ? : 1;
 
                if (sch->ops == &bfifo_qdisc_ops)
-                       limit *= sch->dev->mtu;
+                       limit *= qdisc_dev(sch)->mtu;
 
                q->limit = limit;
        } else {
@@ -107,3 +107,46 @@ struct Qdisc_ops bfifo_qdisc_ops __read_mostly = {
        .owner          =       THIS_MODULE,
 };
 EXPORT_SYMBOL(bfifo_qdisc_ops);
+
+/* Pass size change message down to embedded FIFO */
+int fifo_set_limit(struct Qdisc *q, unsigned int limit)
+{
+       struct nlattr *nla;
+       int ret = -ENOMEM;
+
+       /* Hack to avoid sending change message to non-FIFO */
+       if (strncmp(q->ops->id + 1, "fifo", 4) != 0)
+               return 0;
+
+       nla = kmalloc(nla_attr_size(sizeof(struct tc_fifo_qopt)), GFP_KERNEL);
+       if (nla) {
+               nla->nla_type = RTM_NEWQDISC;
+               nla->nla_len = nla_attr_size(sizeof(struct tc_fifo_qopt));
+               ((struct tc_fifo_qopt *)nla_data(nla))->limit = limit;
+
+               ret = q->ops->change(q, nla);
+               kfree(nla);
+       }
+       return ret;
+}
+EXPORT_SYMBOL(fifo_set_limit);
+
+struct Qdisc *fifo_create_dflt(struct Qdisc *sch, struct Qdisc_ops *ops,
+                              unsigned int limit)
+{
+       struct Qdisc *q;
+       int err = -ENOMEM;
+
+       q = qdisc_create_dflt(qdisc_dev(sch), sch->dev_queue,
+                             ops, TC_H_MAKE(sch->handle, 1));
+       if (q) {
+               err = fifo_set_limit(q, limit);
+               if (err < 0) {
+                       qdisc_destroy(q);
+                       q = NULL;
+               }
+       }
+
+       return q ? : ERR_PTR(err);
+}
+EXPORT_SYMBOL(fifo_create_dflt);