linux-kernel - Re: [PATCH] atm: clip: Fix NULL pointer dereference in vcc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d1bb9101-f826-4d79-a74d-dabcbcac351d@huawei.com>
Date: Fri, 4 Jul 2025 15:54:58 +0800
From: Yue Haibing <yuehaibing@...wei.com>
To: Kuniyuki Iwashima <kuniyu@...gle.com>
CC: <davem@...emloft.net>, <edumazet@...gle.com>, <horms@...nel.org>,
	<kuba@...nel.org>, <linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>
Subject: Re: [PATCH] atm: clip: Fix NULL pointer dereference in vcc_sendmsg()

On 2025/7/4 14:53, Kuniyuki Iwashima wrote:
> Please specify 'net' in subject:
> 
>   [PATCH net v2] atm: clip: ...
> 
> From: Yue Haibing <yuehaibing@...wei.com>
> Date: Fri, 4 Jul 2025 10:39:14 +0800
[...]
>> as above.
> 
> Please move commit message before the splat.

ok
> 
> 
>>
>> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>> Reported-by: syzbot+e34e5e6b5eddb0014def@...kaller.appspotmail.com
>> Closes: https://lore.kernel.org/all/682f82d5.a70a0220.1765ec.0143.GAE@google.com/T
>> Signed-off-by: Yue Haibing <yuehaibing@...wei.com>
>> ---
>>  net/atm/clip.c | 9 ++++++++-
>>  1 file changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/net/atm/clip.c b/net/atm/clip.c
>> index b234dc3bcb0d..c02ba9d64bc3 100644
>> --- a/net/atm/clip.c
>> +++ b/net/atm/clip.c
>> @@ -616,8 +616,15 @@ static void atmarpd_close(struct atm_vcc *vcc)
>>  	module_put(THIS_MODULE);
>>  }
>>  
>> +static int atmarpd_send(struct atm_vcc *vcc, struct sk_buff *skb)
>> +{
>> +	dev_kfree_skb_any(skb);
> 
> This is not enough, see:

Thanks, will check this and rework.

> commit 7851263998d4269125fd6cb3fdbfc7c6db853859
> Author: Kuniyuki Iwashima <kuniyu@...gle.com>
> Date:   Mon Jun 16 18:21:15 2025
> 
>     atm: Revert atm_account_tx() if copy_from_iter_full() fails.
> 
> 
>> +	return 0;
>> +}
>> +
>>  static const struct atmdev_ops atmarpd_dev_ops = {
>> -	.close = atmarpd_close
>> +	.close = atmarpd_close,
>> +	.send = atmarpd_send
>>  };
>>  
>>  
>> -- 
>> 2.34.1