From: Jia-Ju Bai <[email protected]>
Date: Mon, 29 Jul 2019 16:24:33 +0800
> In dequeue_func(), there is an if statement on line 74 to check whether
> skb is NULL:
> if (skb)
>
> When skb is NULL, it is used on line 77:
> prefetch(&skb->end);
>
> Thus, a possible null-pointer dereference may occur.
>
> To fix this bug, skb->end is used when skb is not NULL.
>
> This bug is found by a static analysis tool STCheck written by us.
>
> Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
> Signed-off-by: Jia-Ju Bai <[email protected]>
Applied and queued up for -stable.
