[PATCH] net: wwan: iosm: fix NULL skb deref in ul_td_process

[liuc63 <liuc63@xiaopeng.com>]

From: Liu Chao <liuc63@xiaopeng.com>

ipc_protocol_ul_td_process() fetches the skb for the current tail
entry and then dereferences IPC_CB(skb) when comparing the TD buffer
address against the skb DMA mapping. If the skb slot is NULL (e.g.
the entry was never populated or was already consumed), this results
in a NULL pointer dereference.

Validate skb before dereferencing it, mirroring the existing check on
p_td->buffer.address. Return NULL and log the error when the skb is
missing so the caller can handle the malformed descriptor.

Fixes: 64516f633bfd ("net: iosm: protocol operations")
Cc: stable@vger.kernel.org
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
index f2f86f41fd10..dee2e6607f77 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
@@ -302,6 +302,11 @@ struct sk_buff *ipc_protocol_ul_td_process(struct iosm_protocol *ipc_protocol,
 	if (pipe->old_tail >= pipe->nr_of_entries)
 		pipe->old_tail = 0;
 
+	if (!skb) {
+		dev_err(ipc_protocol->dev, "skb is null");
+		return NULL;
+	}
+
 	if (!p_td->buffer.address) {
 		dev_err(ipc_protocol->dev, "Td buffer address is NULL");
 		return NULL;
-- 
2.50.1