Re: [PATCH v2] usb: atm: cxacru: fix NULL deref of atm_dev on sysfs writes

[Greg Kroah-Hartman]

On Tue, Sep 08, 2026 at 03:02:03PM +0000, Jie Wang wrote:
> The adsl_state and adsl_config sysfs attributes are created via
> dev_groups, so the driver core exposes them as soon as ->probe()
> returns. At that point instance->atm_dev can still be NULL:
> usbatm_heavy_init() only waits for the heavy-init kthread to start, not
> to finish, and instance->atm_dev is assigned later, in usbatm_atm_init().
> 
> A write to either attribute in that window passes the existing
> "instance == NULL" check and reaches atm_err()/atm_info() on the error
> path (and, for adsl_config, on the success path). Both expand to
> instance->atm_dev->number and dereference the NULL atm_dev.
> 
> Fix this by logging with usb_err()/usb_info() instead. They reference the
> USB interface device, which stays valid for the whole write, and
> usbatm_atm_init() already logs this way before atm_dev exists.
> 
> adsl_state_store() also calls cxacru_poll_status() directly, which
> dereferences atm_dev via atm_dev_signal_change() and atm_dev->link_rate.
> Return early from the poll when atm_dev is not yet set.
> 
> Fixes: e605c30977bb ("USB: atm: cxacru: convert to use dev_groups")
> Reported-by: syzbot+9b195c4f412ea5c4e56a@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=9b195c4f412ea5c4e56a
> Tested-by: syzbot+9b195c4f412ea5c4e56a@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Jie Wang <jie.wang@xxxxxxxxx>

Did you forget an assisted-by: tag?


> ---
> Changes since v1 [1]:
>  - v1 gated on ->atm_dev at handler entry, but that check is an
>    unsynchronized TOCTOU; remove the ->atm_dev dereference from these
>    paths instead.

Sashiko still has some objections:
	https://sashiko.dev/#/patchset/20260908150203.2119844-1-jie.wang@xxxxxxxxx