| From: stephen hemminger <stephen@networkplumber.org> |
| Date: Thu, 1 Aug 2013 22:32:07 -0700 |
| Subject: htb: fix sign extension bug |
| |
| [ Upstream commit cbd375567f7e4811b1c721f75ec519828ac6583f ] |
| |
| When userspace passes a large priority value |
| the assignment of the unsigned value hopt->prio |
| to signed int cl->prio causes cl->prio to become negative and the |
| comparison is with TC_HTB_NUMPRIO is always false. |
| |
| The result is that HTB crashes by referencing outside |
| the array when processing packets. With this patch the large value |
| wraps around like other values outside the normal range. |
| |
| See: https://bugzilla.kernel.org/show_bug.cgi?id=60669 |
| |
| Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> |
| Acked-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| net/sched/sch_htb.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c |
| index f08b9166..caa5aff 100644 |
| --- a/net/sched/sch_htb.c |
| +++ b/net/sched/sch_htb.c |
| @@ -86,7 +86,7 @@ struct htb_class { |
| unsigned int children; |
| struct htb_class *parent; /* parent class */ |
| |
| - int prio; /* these two are used only by leaves... */ |
| + u32 prio; /* these two are used only by leaves... */ |
| int quantum; /* but stored for parent-to-leaf return */ |
| |
| union { |
