diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-07-29 16:24:33 +0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2019-11-22 15:57:08 +0000 |
| commit | 8c63189ddabaf3a7fb58bb0402d1d2233b4b6edf (patch) | |
| tree | 099e9cdf83c434801ce7f2336b5f8d9aeae95846 | |
| parent | a91e913e8f7aba2b485161379f5f9b63fce373c3 (diff) | |
| download | linux-stable-8c63189ddabaf3a7fb58bb0402d1d2233b4b6edf.tar.gz linux-stable-8c63189ddabaf3a7fb58bb0402d1d2233b4b6edf.tar.bz2 linux-stable-8c63189ddabaf3a7fb58bb0402d1d2233b4b6edf.zip | |
net: sched: Fix a possible null-pointer dereference in dequeue_func()
commit 051c7b39be4a91f6b7d8c4548444e4b850f1f56c upstream.
In dequeue_func(), there is an if statement on line 74 to check whether
skb is NULL:
if (skb)
When skb is NULL, it is used on line 77:
prefetch(&skb->end);
Thus, a possible null-pointer dereference may occur.
To fix this bug, skb->end is used when skb is not NULL.
This bug is found by a static analysis tool STCheck written by us.
Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | net/sched/sch_codel.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c index ebdb01fbdd24..ac28ce7c8c07 100644 --- a/net/sched/sch_codel.c +++ b/net/sched/sch_codel.c @@ -68,7 +68,8 @@ static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch) { struct sk_buff *skb = __skb_dequeue(&sch->q); - prefetch(&skb->end); /* we'll need skb_shinfo() */ + if (skb) + prefetch(&skb->end); /* we'll need skb_shinfo() */ return skb; } |