net: sched: Fix a possible null-pointer dereference in dequeue_func()
authorJia-Ju Bai <baijiaju1990@gmail.com>
Mon, 29 Jul 2019 08:24:33 +0000 (16:24 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 9 Aug 2019 15:52:32 +0000 (17:52 +0200)
commitd82dc254b9670068fe8c2652553eb144cfa26399
treecbc0bebdee86e0eb55bef1877efb9a0f05f7cdc4
parent44b96a38c2b5dd6e67039898201fdbcbaa4974ae
net: sched: Fix a possible null-pointer dereference in dequeue_func()

[ Upstream commit 051c7b39be4a91f6b7d8c4548444e4b850f1f56c ]

In dequeue_func(), there is an if statement on line 74 to check whether
skb is NULL:
    if (skb)

When skb is NULL, it is used on line 77:
    prefetch(&skb->end);

Thus, a possible null-pointer dereference may occur.

To fix this bug, skb->end is used when skb is not NULL.

This bug is found by a static analysis tool STCheck written by us.

Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sched/sch_codel.c