From: kwqcheii <juny24602@gmail.com>
To: netdev@vger.kernel.org
Cc: kwqcheii <juny24602@gmail.com>
Subject: [PATCH] sched: address a potential NULL pointer dereference in the GRED scheduler.
Date: Fri, 28 Feb 2025 00:04:19 +0800 [thread overview]
Message-ID: <20250227160419.3065643-1-juny24602@gmail.com> (raw)
If kzalloc in gred_init returns a NULL pointer, the code follows the error handling path, invoking gred_destroy. This, in turn, calls gred_offload, where memset could receive a NULL pointer as input, potentially leading to a kernel crash.
---
net/sched/sch_gred.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index ab6234b4fcd5..fa643e5709bd 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -317,10 +317,12 @@ static void gred_offload(struct Qdisc *sch, enum tc_gred_command command)
if (!tc_can_offload(dev) || !dev->netdev_ops->ndo_setup_tc)
return;
- memset(opt, 0, sizeof(*opt));
- opt->command = command;
- opt->handle = sch->handle;
- opt->parent = sch->parent;
+ if (opt) {
+ memset(opt, 0, sizeof(*opt));
+ opt->command = command;
+ opt->handle = sch->handle;
+ opt->parent = sch->parent;
+ }
if (command == TC_GRED_REPLACE) {
unsigned int i;
--
2.48.1
next reply other threads:[~2025-02-27 16:04 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-27 16:04 kwqcheii [this message]
2025-02-27 18:26 ` [PATCH] sched: address a potential NULL pointer dereference in the GRED scheduler Cong Wang
2025-03-04 14:18 ` kwqcheii
2025-03-04 20:05 ` Cong Wang
2025-03-05 15:44 ` Jun Yang
2025-03-05 18:22 ` Cong Wang
2025-03-07 0:50 ` patchwork-bot+netdevbpf
-- strict thread matches above, loose matches on Subject: below --
2025-03-05 15:57 Jun Yang
2025-03-07 1:32 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250227160419.3065643-1-juny24602@gmail.com \
--to=juny24602@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.