[PKT_SCHED] RED: Fix overflow in calculation of queue average

Overflow can occur very easily with 32 bits, e.g., with 1 second
us_idle is approx. 2^20, which leaves only 11-Wlog bits for queue
length. Since the EWMA exponent is typically around 9, queue
lengths larger than 2^2 cause overflow. Whether the affected
branch is taken when us_idle is as high as 1 second, depends on
Scell_log, but with rather reasonable configuration Scell_log is
large enough to cause p->Stab to have zero index, which always
results zero shift (typically also few other small indices result
in zero shift).

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: Adrian Bunk <bunk@kernel.org>

diff --git a/include/net/red.h b/include/net/red.h
index 2ed4358e3295c2f03595efd9bc9a91c86fa2b496..cfc26254987126f7d1e32972e43a4dde10b1e80c 100644 (file)
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -213,7 +213,7 @@ static inline unsigned long red_calc_qavg_from_idle_time(struct red_parms *p)
                 * Seems, it is the best solution to
                 * problem of too coarse exponent tabulation.
                 */
-               us_idle = (p->qavg * us_idle) >> p->Scell_log;
+               us_idle = (p->qavg * (u64)us_idle) >> p->Scell_log;
 
                if (us_idle < (p->qavg >> 1))
                        return p->qavg - us_idle;