[PKT_SCHED]: Fix 'SFQ qdisc crashes with limit of 2 packets'

Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 5 deletions

diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 957957309859..3a23e30bc79e 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -270,7 +270,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                         q->tail = x;
                 }
         }
-        if (++sch->q.qlen < q->limit-1) {
+        if (++sch->q.qlen <= q->limit) {
                 sch->bstats.bytes += skb->len;
                 sch->bstats.packets++;
                 return 0;
@@ -306,7 +306,7 @@ sfq_requeue(struct sk_buff *skb, struct Qdisc* sch)
                         q->tail = x;
                 }
         }
-        if (++sch->q.qlen < q->limit - 1) {
+        if (++sch->q.qlen <= q->limit) {
                 sch->qstats.requeues++;
                 return 0;
         }
@@ -391,10 +391,10 @@ static int sfq_change(struct Qdisc *sch, struct rtattr *opt)
         q->quantum = ctl->quantum ? : psched_mtu(sch->dev);
         q->perturb_period = ctl->perturb_period*HZ;
         if (ctl->limit)
-                q->limit = min_t(u32, ctl->limit, SFQ_DEPTH);
+                q->limit = min_t(u32, ctl->limit, SFQ_DEPTH - 2);
 
         qlen = sch->q.qlen;
-        while (sch->q.qlen >= q->limit-1)
+        while (sch->q.qlen > q->limit)
                 sfq_drop(sch);
         qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);
 
@@ -423,7 +423,7 @@ static int sfq_init(struct Qdisc *sch, struct rtattr *opt)
                 q->dep[i+SFQ_DEPTH].next = i+SFQ_DEPTH;
                 q->dep[i+SFQ_DEPTH].prev = i+SFQ_DEPTH;
         }
-        q->limit = SFQ_DEPTH;
+        q->limit = SFQ_DEPTH - 2;
         q->max_depth = 0;
         q->tail = SFQ_DEPTH;
         if (opt == NULL) {