On Tue, Sep 08, 2026 at 03:02:03PM +0000, Jie Wang wrote:
The adsl_state and adsl_config sysfs attributes are created via
dev_groups, so the driver core exposes them as soon as ->probe()
returns. At that point instance->atm_dev can still be NULL:
usbatm_heavy_init() only waits for the heavy-init kthread to start, not
to finish, and instance->atm_dev is assigned later, in usbatm_atm_init().
A write to either attribute in that window passes the existing
"instance == NULL" check and reaches atm_err()/atm_info() on the error
path (and, for adsl_config, on the success path). Both expand to
instance->atm_dev->number and dereference the NULL atm_dev.
Fix this by logging with usb_err()/usb_info() instead. They reference the
USB interface device, which stays valid for the whole write, and
usbatm_atm_init() already logs this way before atm_dev exists.
adsl_state_store() also calls cxacru_poll_status() directly, which
dereferences atm_dev via atm_dev_signal_change() and atm_dev->link_rate.
Return early from the poll when atm_dev is not yet set.
Fixes: e605c30977bb ("USB: atm: cxacru: convert to use dev_groups")
Reported-by: <redacted>
Closes: https://syzkaller.appspot.com/bug?extid=9b195c4f412ea5c4e56a
Tested-by: <redacted>
Signed-off-by: Jie Wang <redacted>
Did you forget an assisted-by: tag?
---
Changes since v1 [1]:
- v1 gated on ->atm_dev at handler entry, but that check is an
unsynchronized TOCTOU; remove the ->atm_dev dereference from these
paths instead.
Sashiko still has some objections:
https://sashiko.dev/#/patchset/20260908150203.2119844-1-jie.wang@intel.com