Re: [PATCH] atm: clip: Fix NULL pointer dereference in vcc_sendmsg()

[Yue Haibing <yuehaibing@huawei.com>]

On 2025/7/4 14:53, Kuniyuki Iwashima wrote:
> Please specify 'net' in subject:
> 
>   [PATCH net v2] atm: clip: ...
> 
> From: Yue Haibing <yuehaibing@huawei.com>
> Date: Fri, 4 Jul 2025 10:39:14 +0800
[...]
>> as above.
> 
> Please move commit message before the splat.

ok
> 
> 
>>
>> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>> Reported-by: syzbot+e34e5e6b5eddb0014def@syzkaller.appspotmail.com
>> Closes: https://lore.kernel.org/all/682f82d5.a70a0220.1765ec.0143.GAE@google.com/T
>> Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
>> ---
>>  net/atm/clip.c | 9 ++++++++-
>>  1 file changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/net/atm/clip.c b/net/atm/clip.c
>> index b234dc3bcb0d..c02ba9d64bc3 100644
>> --- a/net/atm/clip.c
>> +++ b/net/atm/clip.c
>> @@ -616,8 +616,15 @@ static void atmarpd_close(struct atm_vcc *vcc)
>>  	module_put(THIS_MODULE);
>>  }
>>  
>> +static int atmarpd_send(struct atm_vcc *vcc, struct sk_buff *skb)
>> +{
>> +	dev_kfree_skb_any(skb);
> 
> This is not enough, see:

Thanks, will check this and rework.

> commit 7851263998d4269125fd6cb3fdbfc7c6db853859
> Author: Kuniyuki Iwashima <kuniyu@google.com>
> Date:   Mon Jun 16 18:21:15 2025
> 
>     atm: Revert atm_account_tx() if copy_from_iter_full() fails.
> 
> 
>> +	return 0;
>> +}
>> +
>>  static const struct atmdev_ops atmarpd_dev_ops = {
>> -	.close = atmarpd_close
>> +	.close = atmarpd_close,
>> +	.send = atmarpd_send
>>  };
>>  
>>  
>> -- 
>> 2.34.1