Messages in this thread Patch in this message | | | From | Jia-Ju Bai <> | Subject | [PATCH v2] net: sched: Fix a possible null-pointer dereference in dequeue_func() | Date | Mon, 29 Jul 2019 16:00:18 +0800 |
| |
In dequeue_func(), there is an if statement on line 74 to check whether skb is NULL: if (skb)
When skb is NULL, it is used on line 77: prefetch(&skb->end);
Thus, a possible null-pointer dereference may occur.
To fix this bug, skb->end is used when skb is not NULL.
This bug is found by a static analysis tool STCheck written by us.
Fixes: 79bdc4c862af ("codel: generalize the implementation") Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- v2: * Add a fix tag. Thank Jiri Pirko for helpful advice.
--- net/sched/sch_codel.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c index 25ef172c23df..30169b3adbbb 100644 --- a/net/sched/sch_codel.c +++ b/net/sched/sch_codel.c @@ -71,10 +71,10 @@ static struct sk_buff *dequeue_func(struct codel_vars *vars, void *ctx) struct Qdisc *sch = ctx; struct sk_buff *skb = __qdisc_dequeue_head(&sch->q); - if (skb) + if (skb) { sch->qstats.backlog -= qdisc_pkt_len(skb); - - prefetch(&skb->end); /* we'll need skb_shinfo() */ + prefetch(&skb->end); /* we'll need skb_shinfo() */ + } return skb; } -- 2.17.0
| |