* [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue
@ 2016-01-26 3:51 Bernie Harris
2016-01-26 18:03 ` Cong Wang
0 siblings, 1 reply; 7+ messages in thread
From: Bernie Harris @ 2016-01-26 3:51 UTC (permalink / raw)
To: netdev; +Cc: davem, jhs, stable, bernie.harris
There are cases where qdisc_dequeue_peeked can return NULL, and the result
is dereferenced later on in the function.
Similarly to the other qdisc dequeue functions, check whether the skb
pointer is NULL and if it is, goto out.
Signed-off-by: Bernie Harris <bernie.harris@alliedtelesis.co.nz>
---
net/sched/sch_drr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index f26bdea..8086c3d 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -403,6 +403,8 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
if (len <= cl->deficit) {
cl->deficit -= len;
skb = qdisc_dequeue_peeked(cl->qdisc);
+ if (skb == NULL)
+ goto out;
if (cl->qdisc->q.qlen == 0)
list_del(&cl->alist);
--
2.7.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue
2016-01-26 3:51 [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue Bernie Harris
@ 2016-01-26 18:03 ` Cong Wang
2016-01-28 3:26 ` Bernie Harris
2016-01-28 3:30 ` Bernie Harris
0 siblings, 2 replies; 7+ messages in thread
From: Cong Wang @ 2016-01-26 18:03 UTC (permalink / raw)
To: Bernie Harris
Cc: Linux Kernel Network Developers, David Miller, Jamal Hadi Salim,
stable
On Mon, Jan 25, 2016 at 7:51 PM, Bernie Harris
<bernie.harris@alliedtelesis.co.nz> wrote:
> There are cases where qdisc_dequeue_peeked can return NULL, and the result
> is dereferenced later on in the function.
>
> Similarly to the other qdisc dequeue functions, check whether the skb
> pointer is NULL and if it is, goto out.
>
> Signed-off-by: Bernie Harris <bernie.harris@alliedtelesis.co.nz>
Looks good to me, just one minor thing: an unlikely() can be used for this case.
> ---
> net/sched/sch_drr.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
> index f26bdea..8086c3d 100644
> --- a/net/sched/sch_drr.c
> +++ b/net/sched/sch_drr.c
> @@ -403,6 +403,8 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
> if (len <= cl->deficit) {
> cl->deficit -= len;
> skb = qdisc_dequeue_peeked(cl->qdisc);
> + if (skb == NULL)
> + goto out;
> if (cl->qdisc->q.qlen == 0)
> list_del(&cl->alist);
>
> --
> 2.7.0
>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue
2016-01-26 18:03 ` Cong Wang
@ 2016-01-28 3:26 ` Bernie Harris
2016-01-28 3:30 ` Bernie Harris
1 sibling, 0 replies; 7+ messages in thread
From: Bernie Harris @ 2016-01-28 3:26 UTC (permalink / raw)
To: Cong Wang
Cc: Linux Kernel Network Developers, David Miller, Jamal Hadi Salim,
stable@vger.kernel.org
Thank you. I will add unlikely() and re-submit the patch.
________________________________________
From: Cong Wang <xiyou.wangcong@gmail.com>
Sent: 27 January 2016 07:03
To: Bernie Harris
Cc: Linux Kernel Network Developers; David Miller; Jamal Hadi Salim; stable@vger.kernel.org
Subject: Re: [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue
On Mon, Jan 25, 2016 at 7:51 PM, Bernie Harris
<bernie.harris@alliedtelesis.co.nz> wrote:
> There are cases where qdisc_dequeue_peeked can return NULL, and the result
> is dereferenced later on in the function.
>
> Similarly to the other qdisc dequeue functions, check whether the skb
> pointer is NULL and if it is, goto out.
>
> Signed-off-by: Bernie Harris <bernie.harris@alliedtelesis.co.nz>
Looks good to me, just one minor thing: an unlikely() can be used for this case.
> ---
> net/sched/sch_drr.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
> index f26bdea..8086c3d 100644
> --- a/net/sched/sch_drr.c
> +++ b/net/sched/sch_drr.c
> @@ -403,6 +403,8 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
> if (len <= cl->deficit) {
> cl->deficit -= len;
> skb = qdisc_dequeue_peeked(cl->qdisc);
> + if (skb == NULL)
> + goto out;
> if (cl->qdisc->q.qlen == 0)
> list_del(&cl->alist);
>
> --
> 2.7.0
>
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue
2016-01-26 18:03 ` Cong Wang
2016-01-28 3:26 ` Bernie Harris
@ 2016-01-28 3:30 ` Bernie Harris
2016-01-28 14:04 ` Sergei Shtylyov
` (2 more replies)
1 sibling, 3 replies; 7+ messages in thread
From: Bernie Harris @ 2016-01-28 3:30 UTC (permalink / raw)
To: netdev; +Cc: davem, jhs, stable, bernie.harris
There are cases where qdisc_dequeue_peeked can return NULL, and the result
is dereferenced later on in the function.
Similarly to the other qdisc dequeue functions, check whether the skb
pointer is NULL and if it is, goto out.
Signed-off-by: Bernie Harris <bernie.harris@alliedtelesis.co.nz>
---
net/sched/sch_drr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index f26bdea..a1cd778 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -403,6 +403,8 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
if (len <= cl->deficit) {
cl->deficit -= len;
skb = qdisc_dequeue_peeked(cl->qdisc);
+ if (unlikely(skb == NULL))
+ goto out;
if (cl->qdisc->q.qlen == 0)
list_del(&cl->alist);
--
2.7.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue
2016-01-28 3:30 ` Bernie Harris
@ 2016-01-28 14:04 ` Sergei Shtylyov
2016-01-29 18:19 ` Cong Wang
2016-01-30 1:27 ` David Miller
2 siblings, 0 replies; 7+ messages in thread
From: Sergei Shtylyov @ 2016-01-28 14:04 UTC (permalink / raw)
To: Bernie Harris, netdev; +Cc: davem, jhs, stable
Hello.
On 1/28/2016 6:30 AM, Bernie Harris wrote:
> There are cases where qdisc_dequeue_peeked can return NULL, and the result
> is dereferenced later on in the function.
>
> Similarly to the other qdisc dequeue functions, check whether the skb
> pointer is NULL and if it is, goto out.
>
> Signed-off-by: Bernie Harris <bernie.harris@alliedtelesis.co.nz>
> ---
> net/sched/sch_drr.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
> index f26bdea..a1cd778 100644
> --- a/net/sched/sch_drr.c
> +++ b/net/sched/sch_drr.c
> @@ -403,6 +403,8 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
> if (len <= cl->deficit) {
> cl->deficit -= len;
> skb = qdisc_dequeue_peeked(cl->qdisc);
> + if (unlikely(skb == NULL))
!skb is preferred in the networking code. I think scripts/checkpatch.pl
should've warned you.
[...]
MBR, Sergei
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue
2016-01-28 3:30 ` Bernie Harris
2016-01-28 14:04 ` Sergei Shtylyov
@ 2016-01-29 18:19 ` Cong Wang
2016-01-30 1:27 ` David Miller
2 siblings, 0 replies; 7+ messages in thread
From: Cong Wang @ 2016-01-29 18:19 UTC (permalink / raw)
To: Bernie Harris
Cc: Linux Kernel Network Developers, David Miller, Jamal Hadi Salim,
stable
On Wed, Jan 27, 2016 at 7:30 PM, Bernie Harris
<bernie.harris@alliedtelesis.co.nz> wrote:
> There are cases where qdisc_dequeue_peeked can return NULL, and the result
> is dereferenced later on in the function.
>
> Similarly to the other qdisc dequeue functions, check whether the skb
> pointer is NULL and if it is, goto out.
>
> Signed-off-by: Bernie Harris <bernie.harris@alliedtelesis.co.nz>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue
2016-01-28 3:30 ` Bernie Harris
2016-01-28 14:04 ` Sergei Shtylyov
2016-01-29 18:19 ` Cong Wang
@ 2016-01-30 1:27 ` David Miller
2 siblings, 0 replies; 7+ messages in thread
From: David Miller @ 2016-01-30 1:27 UTC (permalink / raw)
To: bernie.harris; +Cc: netdev, jhs, stable
From: Bernie Harris <bernie.harris@alliedtelesis.co.nz>
Date: Thu, 28 Jan 2016 16:30:51 +1300
> There are cases where qdisc_dequeue_peeked can return NULL, and the result
> is dereferenced later on in the function.
>
> Similarly to the other qdisc dequeue functions, check whether the skb
> pointer is NULL and if it is, goto out.
>
> Signed-off-by: Bernie Harris <bernie.harris@alliedtelesis.co.nz>
Applied, thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2016-01-30 1:27 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-01-26 3:51 [PATCH] net_sched: drr: check for NULL pointer in drr_dequeue Bernie Harris
2016-01-26 18:03 ` Cong Wang
2016-01-28 3:26 ` Bernie Harris
2016-01-28 3:30 ` Bernie Harris
2016-01-28 14:04 ` Sergei Shtylyov
2016-01-29 18:19 ` Cong Wang
2016-01-30 1:27 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).