]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
authorXiang Mei <xmei5@asu.edu>
Thu, 26 Mar 2026 20:43:09 +0000 (13:43 -0700)
committerJakub Kicinski <kuba@kernel.org>
Sat, 28 Mar 2026 03:41:11 +0000 (20:41 -0700)
commit4576100b8cd03118267513cafacde164b498b322
treea846c5a1af9390c8d7932b7dc8a05f4f98be64e7
parent1a6fdb351837da72e0521ed10d367f16d928cc1c
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()

m2sm() converts a u32 slope to a u64 scaled value.  For large inputs
(e.g. m1=4000000000), the result can reach 2^32.  rtsc_min() stores
the difference of two such u64 values in a u32 variable `dsm` and
uses it as a divisor.  When the difference is exactly 2^32 the
truncation yields zero, causing a divide-by-zero oops in the
concave-curve intersection path:

  Oops: divide error: 0000
  RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601)
  Call Trace:
   init_ed (net/sched/sch_hfsc.c:629)
   hfsc_enqueue (net/sched/sch_hfsc.c:1569)
   [...]

Widen `dsm` to u64 and replace do_div() with div64_u64() so the full
difference is preserved.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260326204310.1549327-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/sched/sch_hfsc.c