[BUG] drivers/net: NULL pointer dereference in rmnet_map_send_ack()

[co <co+4638111fe2a12980@bugs.sh>]

We found a bug reachable in:

    path    drivers/net/ethernet/qualcomm/rmnet
    crash   NULL pointer dereference in rmnet_map_send_ack()
    commit  b027ca66ec02

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you patch the bug based on our artifacts, a tag would be
    appreciated:

Reported-by: co+4638111fe2a12980@bugs.sh

    Everything in this mail is validated by the reproducer below.

    We also hold an LLM-generated root-cause analysis and a candidate
    patch. The patch passes an A/B test: the same reproducer panics the
    unpatched kernel and runs clean on the patched one. Neither has had
    human review, so both still require validation before you send or
    apply them. Available on:

        patch.diff  https://bugs.sh/b/4638111fe2a12980/patch.diff
        report.md   https://bugs.sh/b/4638111fe2a12980/report.md

    This is an open science project. The code and the full set of PoCs
    are not public at this moment, as we intend to disclose our findings
    in an ethical way.

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@bugs.sh

== Environment =========================================================
    Reproduced on  b027ca66ec02
    VM setup       https://bugs.sh/b/4638111fe2a12980/run.sh
    config         https://bugs.sh/b/4638111fe2a12980/config.gz
    poc            https://bugs.sh/b/4638111fe2a12980/repro.c

== Sanitizer Report ====================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc00000000b2: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000590-0x0000000000000597]
CPU: 0 UID: 0 PID: 5011 Comm: exploit Not tainted 7.2.0-rc7-00095-g24ef02f934ee #33 PREEMPT(full)
RIP: 0010:kasan_byte_accessible+0x15/0x30
Call Trace:
__kasan_check_byte+0x13/0x50
lock_acquire+0x136/0x360
_raw_spin_lock+0x2e/0x40
netif_tx_lock+0x19/0x30
rmnet_map_command+0x213/0x320
__rmnet_map_ingress_handler+0x57a/0x900
rmnet_rx_handler+0x350/0x4d0
__netif_receive_skb_core.constprop.0+0x6bf/0x3610
__netif_receive_skb_one_core+0xb0/0x1e0
__netif_receive_skb+0x1f/0x120
netif_receive_skb+0x13e/0x7d0
tun_rx_batched.isra.0+0x3ee/0x740
tun_get_user+0x2874/0x3aa0
tun_chr_write_iter+0xdc/0x210
vfs_write+0x6ac/0x1050
ksys_write+0x12a/0x250
do_syscall_64+0x116/0x7d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x4240c4
RIP: 0010:kasan_byte_accessible+0x15/0x30
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: disabled
Kernel panic - not syncing: Fatal exception in interrupt


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@bugs.sh

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup