From df3eb6cd68924d5ea16032faecae7fb775f67883 Mon Sep 17 00:00:00 2001 From: Bernie Harris Date: Thu, 28 Jan 2016 16:30:51 +1300 Subject: net_sched: drr: check for NULL pointer in drr_dequeue There are cases where qdisc_dequeue_peeked can return NULL, and the result is dereferenced later on in the function. Similarly to the other qdisc dequeue functions, check whether the skb pointer is NULL and if it is, goto out. Signed-off-by: Bernie Harris Reviewed-by: Cong Wang Signed-off-by: David S. Miller --- net/sched/sch_drr.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'net/sched/sch_drr.c') diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c index f26bdea875c1..a1cd778240cd 100644 --- a/net/sched/sch_drr.c +++ b/net/sched/sch_drr.c @@ -403,6 +403,8 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch) if (len <= cl->deficit) { cl->deficit -= len; skb = qdisc_dequeue_peeked(cl->qdisc); + if (unlikely(skb == NULL)) + goto out; if (cl->qdisc->q.qlen == 0) list_del(&cl->alist); -- cgit