br2684_close_vcc() frees the br2684_vcc and NULLs atmvcc->user_back but
leaves atmvcc->push and atmvcc->pop pointing to br2684_push/br2684_pop.
If the ATM driver completes a TX after the close (delayed pop callback),
br2684_pop() dereferences the NULL user_back at offset 0x18, causing a
kernel panic.

Restore push and pop on the atmvcc before clearing user_back, matching
the pattern in pppoatm_unassign_vcc().

Fixes: 137742cf9738 ("atm/br2684: netif_stop_queue() when atm device busy and netif_wake_queue() when we can send packets again.")
Signed-off-by: Zhenghang Xiao <redacted>
---
 net/atm/br2684.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 6580d67c3456..dbdc31ce5c53 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c

@@ -412,6 +412,8 @@ static void br2684_close_vcc(struct br2684_vcc *brvcc)
 	write_lock_irq(&devs_lock);
 	list_del(&brvcc->brvccs);
 	write_unlock_irq(&devs_lock);
+	brvcc->atmvcc->push = brvcc->old_push;
+	brvcc->atmvcc->pop = brvcc->old_pop;
 	brvcc->atmvcc->user_back = NULL;	/* what about vcc->recvq ??? */
 	brvcc->atmvcc->release_cb = brvcc->old_release_cb;
 	brvcc->old_push(brvcc->atmvcc, NULL);	/* pass on the bad news */

-- 
2.50.1 (Apple Git-155)