Re: [syzbot] [net?] KASAN: null-ptr-deref Write in send_to_lecd

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 014441d1e4b2

This crash does not have a reproducer. I cannot test it.

>
> net: atm: lec: fix null-ptr-deref in send_to_lecd
>
> A null pointer dereference occurs in send_to_lecd() when accessing
> priv->lecd. Although priv->lecd is checked at the function's entry,
> it can be cleared by lec_atm_close() before it is actually used.
>
> Use READ_ONCE() to load priv->lecd into a local variable and check
> it before use.
>
> Reported-by: syzbot+e1d2b8...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=e1d2b89a60c8bb9a7f33
> Signed-off-by: Minu Jin <s943...@naver.com>
>
> ---
> net/atm/lec.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/net/atm/lec.c b/net/atm/lec.c
> index fb93c6e1c329..34f4c32acadb 100644
> --- a/net/atm/lec.c
> +++ b/net/atm/lec.c
> @@ -512,10 +512,16 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
> {
> struct sock *sk;
> struct sk_buff *skb;
> + struct atm_vcc *lecd;
> struct atmlec_msg *mesg;
>
> - if (!priv || !priv->lecd)
> + if (!priv)
> return -1;
> +
> + lecd = READ_ONCE(priv->lecd);
> + if (!lecd)
> + return -1;
> +
> skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
> if (!skb)
> return -1;
> @@ -532,14 +538,14 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
> if (atm_addr)
> memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);
>
> - atm_force_charge(priv->lecd, skb->truesize);
> - sk = sk_atm(priv->lecd);
> + atm_force_charge(lecd, skb->truesize);
> + sk = sk_atm(lecd);
> skb_queue_tail(&sk->sk_receive_queue, skb);
> sk->sk_data_ready(sk);
>
> if (data != NULL) {
> pr_debug("about to send %d bytes of data\n", data->len);
> - atm_force_charge(priv->lecd, data->truesize);
> + atm_force_charge(lecd, data->truesize);
> skb_queue_tail(&sk->sk_receive_queue, data);
> sk->sk_data_ready(sk);
> }
> --
> 2.43.0