Eric Dumazet 8156210d36 ax25: properly unshare skbs in ax25_kiss_rcv() ...

Bernard Pidoux reported a regression apparently caused by commit
c353e8983e ("net: introduce per netns packet chains").

skb->dev becomes NULL and we crash in __netif_receive_skb_core().

Before above commit, different kind of bugs or corruptions could happen
without a major crash.

But the root cause is that ax25_kiss_rcv() can queue/mangle input skb
without checking if this skb is shared or not.

Many thanks to Bernard Pidoux for his help, diagnosis and tests.

We had a similar issue years ago fixed with commit 7aaed57c5c
("phonet: properly unshare skbs in phonet_rcv()").

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Bernard Pidoux <f6bvp@free.fr>
Closes: https://lore.kernel.org/netdev/1713f383-c538-4918-bc64-13b3288cd542@free.fr/
Tested-by: Bernard Pidoux <f6bvp@free.fr>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Joerg Reuter <jreuter@yaina.de>
Cc: David Ranch <dranch@trinnet.net>
Cc: Folkert van Heusden <folkert@vanheusden.com>
Reviewed-by: Dan Cross <crossd@gmail.com>
Link: https://patch.msgid.link/20250902124642.212705-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2025-09-03 17:06:30 -07:00

..

af_ax25.c

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

ax25_addr.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ax25_dev.c

ax25: rcu protect dev->ax25_ptr

2025-01-06 15:57:01 -08:00

ax25_ds_in.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ax25_ds_subr.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ax25_ds_timer.c

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

ax25_iface.c

ax25: constify dev_addr passing

2021-10-13 09:40:45 -07:00

ax25_in.c

ax25: properly unshare skbs in ax25_kiss_rcv()

2025-09-03 17:06:30 -07:00

ax25_ip.c

ax25: rcu protect dev->ax25_ptr

2025-01-06 15:57:01 -08:00

ax25_out.c

ax25: rcu protect dev->ax25_ptr

2025-01-06 15:57:01 -08:00

ax25_route.c

ax25: Remove broken autobind

2025-03-24 10:26:53 +00:00

ax25_std_in.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ax25_std_subr.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ax25_std_timer.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ax25_subr.c

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05 10:30:12 +02:00

ax25_timer.c

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

ax25_uid.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

Kconfig

net: handle HAS_IOPORT dependencies

2024-04-08 11:56:56 +01:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

sysctl_net_ax25.c

ax.25: x.25: Remove the now superfluous sentinel elements from ctl_table array

2024-05-03 13:29:43 +01:00