Patrick McHardy wrote:

Corey Hickey wrote:

quoted

diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 8ae077f..0c46938 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c

@@ -380,71 +380,71 @@ static void sfq_perturbation(unsigned long arg)
 	}
 }
 
-static int sfq_change(struct Qdisc *sch, struct rtattr *opt)
+static int sfq_q_init(struct sfq_sched_data *q, struct rtattr *opt)
 {
-	struct sfq_sched_data *q = qdisc_priv(sch);
 	struct tc_sfq_qopt *ctl = RTA_DATA(opt);
-	unsigned int qlen;
+	int i;
 
-	if (opt->rta_len < RTA_LENGTH(sizeof(*ctl)))
+	if (opt && opt->rta_len < RTA_LENGTH(sizeof(*ctl)))

opt is dereferenced above (RTA_DATA), so if it is NULL we've already
crashed.

I think that test made ESFQ not crash when I did a "qdisc change" 
without giving any parameters, but that was a while ago and I might be 
mistaken. I'll need to rewrite much of this function anyway, and I'll 
pay attention to what happens when I get there.

quoted

 		return -EINVAL;
 
-	sch_tree_lock(sch);
-	q->quantum = ctl->quantum ? : psched_mtu(sch->dev);
-	q->perturb_period = ctl->perturb_period*HZ;
-	if (ctl->limit)
-		q->limit = min_t(u32, ctl->limit, SFQ_DEPTH);
+	q->perturbation = 0;
+	q->max_depth = 0;
+	q->tail = q->limit = SFQ_DEPTH;
+	if (opt == NULL) {
+		q->perturb_period = 0;
+	} else {
+		struct tc_sfq_qopt *ctl = RTA_DATA(opt);
+		if (ctl->quantum)
+			q->quantum = ctl->quantum;
+		q->perturb_period = ctl->perturb_period*HZ;
 
-	qlen = sch->q.qlen;
-	while (sch->q.qlen >= q->limit-1)
-		sfq_drop(sch);
-	qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);

I hope that patch that makes changing possible brings this back ..
<checking> .. it doesn't. Please either keep this or fix up 6/7
to bring it back.

It got lost in translation; I will add it to 6/7.

Thanks,
Corey