[PATCH net] atm: clip: prevent NULL deref in clip_push()

[PATCH net] atm: clip: prevent NULL deref in clip_push()

[Eric Dumazet]

Blamed commit missed that vcc_destroy_socket() calls
clip_push() with a NULL skb.

If clip_devs is NULL, clip_push() then crashes when reading
skb->truesize.

Fixes: 93a2014afbac ("atm: fix a UAF in lec_arp_clear_vccs()")
Reported-by: syzbot+1316233c4c6803382a8b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68556f59.a00a0220.137b3.004e.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Gengming Liu <l.dmxcsnsbh@gmail.com>
---
 net/atm/clip.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/net/atm/clip.c b/net/atm/clip.c
index 61b5b700817de541d2882fb21f07992648460d4a..b234dc3bcb0d4aea0febff50d1b023cb7ad9dfe8 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -193,12 +193,6 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb)
 
 	pr_debug("\n");
 
-	if (!clip_devs) {
-		atm_return(vcc, skb->truesize);
-		kfree_skb(skb);
-		return;
-	}
-
 	if (!skb) {
 		pr_debug("removing VCC %p\n", clip_vcc);
 		if (clip_vcc->entry)
@@ -208,6 +202,11 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb)
 		return;
 	}
 	atm_return(vcc, skb->truesize);
+	if (!clip_devs) {
+		kfree_skb(skb);
+		return;
+	}
+
 	skb->dev = clip_vcc->entry ? clip_vcc->entry->neigh->dev : clip_devs;
 	/* clip_vcc->entry == NULL if we don't have an IP address yet */
 	if (!skb->dev) {
-- 
2.50.0.rc2.701.gf1e915cc24-goog

Re: [PATCH net] atm: clip: prevent NULL deref in clip_push()

[Simon Horman]

On Fri, Jun 20, 2025 at 02:28:44PM +0000, Eric Dumazet wrote:
> Blamed commit missed that vcc_destroy_socket() calls
> clip_push() with a NULL skb.
> 
> If clip_devs is NULL, clip_push() then crashes when reading
> skb->truesize.
> 
> Fixes: 93a2014afbac ("atm: fix a UAF in lec_arp_clear_vccs()")
> Reported-by: syzbot+1316233c4c6803382a8b@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/68556f59.a00a0220.137b3.004e.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Cong Wang <xiyou.wangcong@gmail.com>
> Cc: Gengming Liu <l.dmxcsnsbh@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net] atm: clip: prevent NULL deref in clip_push()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Fri, 20 Jun 2025 14:28:44 +0000 you wrote:
> Blamed commit missed that vcc_destroy_socket() calls
> clip_push() with a NULL skb.
> 
> If clip_devs is NULL, clip_push() then crashes when reading
> skb->truesize.
> 
> Fixes: 93a2014afbac ("atm: fix a UAF in lec_arp_clear_vccs()")
> Reported-by: syzbot+1316233c4c6803382a8b@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/68556f59.a00a0220.137b3.004e.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Cong Wang <xiyou.wangcong@gmail.com>
> Cc: Gengming Liu <l.dmxcsnsbh@gmail.com>
> 
> [...]

Here is the summary with links:
  - [net] atm: clip: prevent NULL deref in clip_push()
    https://git.kernel.org/netdev/net/c/b993ea46b3b6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html