summaryrefslogtreecommitdiff
path: root/net/sched/sch_codel.c
diff options
context:
space:
mode:
authorJia-Ju Bai <baijiaju1990@gmail.com>2019-07-29 11:24:33 +0300
committerDavid S. Miller <davem@davemloft.net>2019-07-29 19:46:58 +0300
commit051c7b39be4a91f6b7d8c4548444e4b850f1f56c (patch)
tree927038e9f4382bc96ab6588eae8294e4c91220d9 /net/sched/sch_codel.c
parenta7f9cbf0ed2f67380b547971145e823b9225d39d (diff)
downloadlinux-051c7b39be4a91f6b7d8c4548444e4b850f1f56c.tar.xz
net: sched: Fix a possible null-pointer dereference in dequeue_func()
In dequeue_func(), there is an if statement on line 74 to check whether skb is NULL: if (skb) When skb is NULL, it is used on line 77: prefetch(&skb->end); Thus, a possible null-pointer dereference may occur. To fix this bug, skb->end is used when skb is not NULL. This bug is found by a static analysis tool STCheck written by us. Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM") Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Reviewed-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/sch_codel.c')
-rw-r--r--net/sched/sch_codel.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
index 25ef172c23df..30169b3adbbb 100644
--- a/net/sched/sch_codel.c
+++ b/net/sched/sch_codel.c
@@ -71,10 +71,10 @@ static struct sk_buff *dequeue_func(struct codel_vars *vars, void *ctx)
struct Qdisc *sch = ctx;
struct sk_buff *skb = __qdisc_dequeue_head(&sch->q);
- if (skb)
+ if (skb) {
sch->qstats.backlog -= qdisc_pkt_len(skb);
-
- prefetch(&skb->end); /* we'll need skb_shinfo() */
+ prefetch(&skb->end); /* we'll need skb_shinfo() */
+ }
return skb;
}