Re: [PATCH] net: wwan: iosm: fix NULL skb deref in ul_td_process

[Loic Poulain]

On Tue, Oct 20, 2026 at 12:11 PM liuc63 <liuc63@xxxxxxxxxxxx> wrote:
>
> From: Liu Chao <liuc63@xxxxxxxxxxxx>
>
> ipc_protocol_ul_td_process() fetches the skb for the current tail
> entry and then dereferences IPC_CB(skb) when comparing the TD buffer
> address against the skb DMA mapping. If the skb slot is NULL (e.g.
> the entry was never populated or was already consumed), this results
> in a NULL pointer dereference.
>
> Validate skb before dereferencing it, mirroring the existing check on
> p_td->buffer.address. Return NULL and log the error when the skb is
> missing so the caller can handle the malformed descriptor.
>
> Fixes: 64516f633bfd ("net: iosm: protocol operations")
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
> Signed-off-by: Liu Chao <liuc63@xxxxxxxxxxxx>
> ---
>  drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
> index f2f86f41fd10..dee2e6607f77 100644
> --- a/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
> +++ b/drivers/net/wwan/iosm/iosm_ipc_protocol_ops.c
> @@ -302,6 +302,11 @@ struct sk_buff *ipc_protocol_ul_td_process(struct iosm_protocol *ipc_protocol,
>         if (pipe->old_tail >= pipe->nr_of_entries)
>                 pipe->old_tail = 0;
>
> +       if (!skb) {
> +               dev_err(ipc_protocol->dev, "skb is null");
> +               return NULL;

Look like the caller(s) already check/report for null skb, so instead
of adding another print here, maybe it would be simpler to check for
skb in the condition where IPC_CB(skb) is used:
`if (skb && p_td->buffer.address != IPC_CB(skb)->mapping)`

> +
>         if (!p_td->buffer.address) {
>                 dev_err(ipc_protocol->dev, "Td buffer address is NULL");
>                 return NULL;
> --
> 2.50.1
>