atm: clip: prevent NULL deref in clip_push()
authorEric Dumazet <edumazet@google.com>
Fri, 20 Jun 2025 14:28:44 +0000 (14:28 +0000)
committerDavid S. Miller <davem@davemloft.net>
Sun, 22 Jun 2025 18:31:14 +0000 (19:31 +0100)
commitb993ea46b3b601915ceaaf3c802adf11e7d6bac6
tree185e77ce5547f20aa42fee8c5fbeb76536c93c70
parent302251f1fdfd302ce99a619aac1a5164d0bb7c4b
atm: clip: prevent NULL deref in clip_push()

Blamed commit missed that vcc_destroy_socket() calls
clip_push() with a NULL skb.

If clip_devs is NULL, clip_push() then crashes when reading
skb->truesize.

Fixes: 93a2014afbac ("atm: fix a UAF in lec_arp_clear_vccs()")
Reported-by: syzbot+1316233c4c6803382a8b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68556f59.a00a0220.137b3.004e.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Gengming Liu <l.dmxcsnsbh@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/atm/clip.c