mirror of
https://github.com/Ysurac/openmptcprouter.git
synced 2025-02-15 04:42:02 +00:00
52 lines
1.5 KiB
Diff
52 lines
1.5 KiB
Diff
|
From d82dc254b9670068fe8c2652553eb144cfa26399 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Jia-Ju Bai <baijiaju1990@gmail.com>
|
||
|
|
Date: Mon, 29 Jul 2019 16:24:33 +0800
|
||
|
|
Subject: [PATCH 795/826] net: sched: Fix a possible null-pointer dereference
|
||
|
|
in dequeue_func()
|
||
|
|
|
||
|
|
[ Upstream commit 051c7b39be4a91f6b7d8c4548444e4b850f1f56c ]
|
||
|
|
|
||
|
|
In dequeue_func(), there is an if statement on line 74 to check whether
|
||
|
|
skb is NULL:
|
||
|
|
if (skb)
|
||
|
|
|
||
|
|
When skb is NULL, it is used on line 77:
|
||
|
|
prefetch(&skb->end);
|
||
|
|
|
||
|
|
Thus, a possible null-pointer dereference may occur.
|
||
|
|
|
||
|
|
To fix this bug, skb->end is used when skb is not NULL.
|
||
|
|
|
||
|
|
This bug is found by a static analysis tool STCheck written by us.
|
||
|
|
|
||
|
|
Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
|
||
|
|
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
|
||
|
|
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
|
||
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
|
---
|
||
|
|
net/sched/sch_codel.c | 6 +++---
|
||
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
|
||
|
|
index 17cd81f84b5d..77fae0b7c6ee 100644
|
||
|
|
--- a/net/sched/sch_codel.c
|
||
|
|
+++ b/net/sched/sch_codel.c
|
||
|
|
@@ -71,10 +71,10 @@ static struct sk_buff *dequeue_func(struct codel_vars *vars, void *ctx)
|
||
|
|
struct Qdisc *sch = ctx;
|
||
|
|
struct sk_buff *skb = __qdisc_dequeue_head(&sch->q);
|
||
|
|
|
||
|
|
- if (skb)
|
||
|
|
+ if (skb) {
|
||
|
|
sch->qstats.backlog -= qdisc_pkt_len(skb);
|
||
|
|
-
|
||
|
|
- prefetch(&skb->end); /* we'll need skb_shinfo() */
|
||
|
|
+ prefetch(&skb->end); /* we'll need skb_shinfo() */
|
||
|
|
+ }
|
||
|
|
return skb;
|
||
|
|
}
|
||
|
|
|
||
|
|
--
|
||
|
|
2.22.0
|
||
|
|
|