diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-07-29 16:24:33 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-08-09 17:53:35 +0200 |
| commit | 9838c90727b07e3e7c6dbf6cbe4634c07cc9fb60 (patch) | |
| tree | 8c3e5eb3066c1af61b2c100075f9309d1d9885e0 /net | |
| parent | e4140af99280223e24becd8fb3690444f7db42db (diff) | |
| download | linux-stable-9838c90727b07e3e7c6dbf6cbe4634c07cc9fb60.tar.gz linux-stable-9838c90727b07e3e7c6dbf6cbe4634c07cc9fb60.tar.bz2 linux-stable-9838c90727b07e3e7c6dbf6cbe4634c07cc9fb60.zip | |
net: sched: Fix a possible null-pointer dereference in dequeue_func()
[ Upstream commit 051c7b39be4a91f6b7d8c4548444e4b850f1f56c ]
In dequeue_func(), there is an if statement on line 74 to check whether
skb is NULL:
if (skb)
When skb is NULL, it is used on line 77:
prefetch(&skb->end);
Thus, a possible null-pointer dereference may occur.
To fix this bug, skb->end is used when skb is not NULL.
This bug is found by a static analysis tool STCheck written by us.
Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/sch_codel.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c index c518a1efcb9d..b22e5cde6059 100644 --- a/net/sched/sch_codel.c +++ b/net/sched/sch_codel.c @@ -71,10 +71,10 @@ static struct sk_buff *dequeue_func(struct codel_vars *vars, void *ctx) struct Qdisc *sch = ctx; struct sk_buff *skb = __qdisc_dequeue_head(&sch->q); - if (skb) + if (skb) { sch->qstats.backlog -= qdisc_pkt_len(skb); - - prefetch(&skb->end); /* we'll need skb_shinfo() */ + prefetch(&skb->end); /* we'll need skb_shinfo() */ + } return skb; } |