Jia-Ju Bai 4c641342d7 net: sched: Fix a possible null-pointer dereference in dequeue_func() ...

[ Upstream commit 051c7b39be ]

In dequeue_func(), there is an if statement on line 74 to check whether
skb is NULL:
    if (skb)

When skb is NULL, it is used on line 77:
    prefetch(&skb->end);

Thus, a possible null-pointer dereference may occur.

To fix this bug, skb->end is used when skb is not NULL.

This bug is found by a static analysis tool STCheck written by us.

Fixes: 76e3cc126b ("codel: Controlled Delay AQM")
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-08-11 12:20:45 +02:00

..

act_api.c

net sched actions: fix dumping which requires several messages to user space

2018-04-13 19:50:27 +02:00

act_bpf.c

net/sched: fix NULL dereference in the error path of tcf_bpf_init()

2018-04-13 19:50:25 +02:00

act_connmark.c

act_connmark: avoid crashing on malformed nlattrs with null parms

2017-03-22 12:04:16 +01:00

act_csum.c

sched: act_csum: don't mangle TCP and UDP GSO packets

2018-03-22 09:23:22 +01:00

act_gact.c

net_sched: act_gact: remove spinlock in fast path

2015-07-08 13:50:42 -07:00

act_ipt.c

net: sched: fix NULL pointer dereference when action calls some targets

2017-08-30 10:19:21 +02:00

act_mirred.c

net_sched: close another race condition in tcf_mirred_release()

2017-05-02 21:19:49 -07:00

act_nat.c

bpf: try harder on clones when writing into skb

2016-07-11 09:31:12 -07:00

act_pedit.c

net/sched: pedit: make sure that offset is valid

2016-12-10 19:07:23 +01:00

act_police.c

…

act_simple.c

net: sched: add percpu stats to actions

2015-07-08 13:50:41 -07:00

act_skbedit.c

net: sched: add percpu stats to actions

2015-07-08 13:50:41 -07:00

act_vlan.c

net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions

2016-11-15 07:46:37 +01:00

cls_api.c

net, sched: fix soft lockup in tc_classify

2017-01-15 13:41:34 +01:00

cls_basic.c

net, sched: respect rcu grace period on cls destruction

2016-12-10 19:07:23 +01:00

cls_bpf.c

net, sched: respect rcu grace period on cls destruction

2016-12-10 19:07:23 +01:00

cls_cgroup.c

net, sched: respect rcu grace period on cls destruction

2016-12-10 19:07:23 +01:00

cls_flow.c

net, sched: respect rcu grace period on cls destruction

2016-12-10 19:07:23 +01:00

cls_flower.c

net, sched: respect rcu grace period on cls destruction

2016-12-10 19:07:23 +01:00

cls_fw.c

net: revert "net_sched: move tp->root allocation into fw_init()"

2015-09-24 14:33:30 -07:00

cls_route.c

net_sched: destroy proto tp when all filters are gone

2015-03-09 15:35:55 -04:00

cls_rsvp6.c

…

cls_rsvp.c

…

cls_rsvp.h

net, sched: respect rcu grace period on cls destruction

2016-12-10 19:07:23 +01:00

cls_tcindex.c

net_sched: fix NULL pointer dereference when delete tcindex filter

2018-08-22 07:48:35 +02:00

cls_u32.c

cls_u32: complete the check for non-forced case in u32_destroy()

2015-08-25 17:02:48 -07:00

em_canid.c

…

em_cmp.c

…

em_ipset.c

netfilter: x_tables: Pass struct net in xt_action_param

2015-09-18 21:58:14 +02:00

em_meta.c

net_sched: em_meta: use skb_to_full_sk() helper

2015-11-08 20:56:39 -05:00

em_nbyte.c

…

em_text.c

net: Remove state argument from skb_find_text()

2015-02-22 15:59:54 -05:00

em_u32.c

…

ematch.c

ematch: Fix auto-loading of ematch modules.

2015-02-20 15:30:56 -05:00

Kconfig

net: add CONFIG_NET_INGRESS to enable ingress filtering

2015-05-14 01:10:05 -04:00

Makefile

tc: introduce Flower classifier

2015-05-13 15:19:48 -04:00

sch_api.c

net_sched: refetch skb protocol for each filter

2019-02-06 19:43:03 +01:00

sch_atm.c

net: sched: consolidate tc_classify{,_compat}

2015-08-27 14:18:48 -07:00

sch_blackhole.c

net_sched: blackhole: tell upper qdisc about dropped packets

2018-07-22 14:25:53 +02:00

sch_cbq.c

net_sched: update hierarchical backlog too

2016-05-18 17:06:39 -07:00

sch_choke.c

net_sched: red: Avoid illegal values

2018-02-25 11:03:40 +01:00

sch_codel.c

net: sched: Fix a possible null-pointer dereference in dequeue_func()

2019-08-11 12:20:45 +02:00

sch_drr.c

net_sched: update hierarchical backlog too

2016-05-18 17:06:39 -07:00

sch_dsmark.c

sch_dsmark: fix invalid skb_cow() usage

2017-12-25 14:22:10 +01:00

sch_fifo.c

net_sched: fix pfifo_head_drop behavior vs backlog

2016-07-11 09:31:11 -07:00

sch_fq_codel.c

net_sched: update hierarchical backlog too

2016-05-18 17:06:39 -07:00

sch_fq.c

net_sched: fq: take care of throttled flows before reuse

2018-05-26 08:48:47 +02:00

sch_generic.c

net: sched: do not requeue a NULL skb

2016-05-18 17:06:35 -07:00

sch_gred.c

net: sched: gred: pass the right attribute to gred_change_table_def()

2018-11-10 07:41:41 -08:00

sch_hfsc.c

net_sched: update hierarchical backlog too

2016-05-18 17:06:39 -07:00

sch_hhf.c

sch_hhf: fix null pointer dereference on init failure

2018-09-15 09:40:41 +02:00

sch_htb.c

sch_htb: fix crash on init failure

2018-09-15 09:40:41 +02:00

sch_ingress.c

net: sched: further simplify handle_ing

2015-05-11 11:10:35 -04:00

sch_mq.c

net_sched: fix error recovery at qdisc creation

2017-07-21 07:44:54 +02:00

sch_mqprio.c

net_sched: fix error recovery at qdisc creation

2017-07-21 07:44:54 +02:00

sch_multiq.c

sch_multiq: fix double free on init failure

2018-09-15 09:40:41 +02:00

sch_netem.c

net: Prevent invalid access to skb->prev in __qdisc_drop_all

2018-12-17 21:55:09 +01:00

sch_pie.c

net_sched: update hierarchical backlog too

2016-05-18 17:06:39 -07:00

sch_plug.c

net: sched: drop all special handling of tx_queue_len == 0

2015-08-18 11:55:08 -07:00

sch_prio.c

net_sched: update hierarchical backlog too

2016-05-18 17:06:39 -07:00

sch_qfq.c

net_sched: update hierarchical backlog too

2016-05-18 17:06:39 -07:00

sch_red.c

sch_red: update backlog as well

2018-11-10 07:41:37 -08:00

sch_sfb.c

net_sched: update hierarchical backlog too

2016-05-18 17:06:39 -07:00

sch_sfq.c

net_sched: red: Avoid illegal values

2018-02-25 11:03:40 +01:00

sch_tbf.c

net: create skb_gso_validate_mac_len()

2019-06-11 12:24:10 +02:00

sch_teql.c

net: sched: fix skb->protocol use in case of accelerated vlan path

2015-01-13 17:51:08 -05:00