[PATCH 3.16 14/83] net: sched: Fix a possible null-pointer dereference in dequeue_func()

From: Ben Hutchings
Date: Wed Nov 20 2019 - 10:47:08 EST

3.16.78-rc1 review patch. If anyone has any objections, please let me know.


From: Jia-Ju Bai <baijiaju1990@xxxxxxxxx>

commit 051c7b39be4a91f6b7d8c4548444e4b850f1f56c upstream.

In dequeue_func(), there is an if statement on line 74 to check whether
skb is NULL:
if (skb)

When skb is NULL, it is used on line 77:

Thus, a possible null-pointer dereference may occur.

To fix this bug, skb->end is used when skb is not NULL.

This bug is found by a static analysis tool STCheck written by us.

Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
Signed-off-by: Jia-Ju Bai <baijiaju1990@xxxxxxxxx>
Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
--- a/net/sched/sch_codel.c
+++ b/net/sched/sch_codel.c
@@ -68,7 +68,8 @@ static struct sk_buff *dequeue(struct co
struct sk_buff *skb = __skb_dequeue(&sch->q);

- prefetch(&skb->end); /* we'll need skb_shinfo() */
+ if (skb)
+ prefetch(&skb->end); /* we'll need skb_shinfo() */
return skb;