kern/128401: dummynet does not shape traffic with fast io enabled

[Mihail Balikov]

>Number:         128401
>Category:       kern
>Synopsis:       dummynet does not shape traffic with fast io enabled
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Oct 26 19:20:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Mihail Balikov
>Release:        FreeBSD6, FreeBSD7
>Organization:
Megalan Network
>Environment:
FreeBSD freebsd7.megalan.bg 7.1-PRERELEASE FreeBSD 7.1-PRERELEASE #0: Thu Oct 23 10:51:58 EEST 2008     root at freebsd7.megalan.bg:/usr/src/sys/i386/compile/mBSD7  i386

>Description:
On freebsd7 with hz=2000 dummynet stops shaping traffic after 25 days uptime.
I have tracked down the problem in dummynet io fast code at ip_dummynet.c:1353

        if (q->q_time < curr_time)
                q->numbytes = io_fast ? fs->pipe->bandwidth : 0;

This comparision is incorrect. q->q_time is u_int32_t and curr_time is u_int64_t.
After (1<<32) / hz seconds (~24days when hz=2000) q->q_time is always smaller than curr_time.

This is long standing bug, which also affects on RED.

>How-To-Repeat:

>Fix:
1) workaround: disable io fast
sysctl net.inet.ip.dummynet.io_fast=0

2) change q_time type to dn_key in ip_dummynet.h. ipfw userland program needs to be recompiled.

3) compare q_time with (curr_time & 0xffffffff). RED code (red_drops()) also should be revised.

>Release-Note:
>Audit-Trail:
>Unformatted: