diff options
| author | Bernie Harris <bernie.harris@alliedtelesis.co.nz> | 2016-01-28 04:30:51 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-01-30 02:26:44 +0100 |
| commit | df3eb6cd68924d5ea16032faecae7fb775f67883 (patch) | |
| tree | 665e9b3f2484a31be8c4237862ea6dff274b0a94 /net/sched/sch_drr.c | |
| parent | ptp: ixp46x: use helpers for converting ns to timespec (diff) | |
| download | linux-df3eb6cd68924d5ea16032faecae7fb775f67883.tar.xz linux-df3eb6cd68924d5ea16032faecae7fb775f67883.zip | |
net_sched: drr: check for NULL pointer in drr_dequeue
There are cases where qdisc_dequeue_peeked can return NULL, and the result
is dereferenced later on in the function.
Similarly to the other qdisc dequeue functions, check whether the skb
pointer is NULL and if it is, goto out.
Signed-off-by: Bernie Harris <bernie.harris@alliedtelesis.co.nz>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/sch_drr.c')
| -rw-r--r-- | net/sched/sch_drr.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c index f26bdea875c1..a1cd778240cd 100644 --- a/net/sched/sch_drr.c +++ b/net/sched/sch_drr.c @@ -403,6 +403,8 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch) if (len <= cl->deficit) { cl->deficit -= len; skb = qdisc_dequeue_peeked(cl->qdisc); + if (unlikely(skb == NULL)) + goto out; if (cl->qdisc->q.qlen == 0) list_del(&cl->alist); |