8156210d36
Bernard Pidoux reported a regression apparently caused by commit
c353e8983e0d ("net: introduce per netns packet chains").
skb->dev becomes NULL and we crash in __netif_receive_skb_core().
Before above commit, different kind of bugs or corruptions could happen
without a major crash.
But the root cause is that ax25_kiss_rcv() can queue/mangle input skb
without checking if this skb is shared or not.
Many thanks to Bernard Pidoux for his help, diagnosis and tests.
We had a similar issue years ago fixed with commit 7aaed57c5c28
("phonet: properly unshare skbs in phonet_rcv()").
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Bernard Pidoux <f6bvp@free.fr>
Closes: https://lore.kernel.org/netdev/1713f383-c538-4918-bc64-13b3288cd542@free.fr/
Tested-by: Bernard Pidoux <f6bvp@free.fr>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Joerg Reuter <jreuter@yaina.de>
Cc: David Ranch <dranch@trinnet.net>
Cc: Folkert van Heusden <folkert@vanheusden.com>
Reviewed-by: Dan Cross <crossd@gmail.com>
Link: https://patch.msgid.link/20250902124642.212705-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||
|---|---|---|
| .. | ||
| af_ax25.c | ||
| ax25_addr.c | ||
| ax25_dev.c | ||
| ax25_ds_in.c | ||
| ax25_ds_subr.c | ||
| ax25_ds_timer.c | ||
| ax25_iface.c | ||
| ax25_in.c | ||
| ax25_ip.c | ||
| ax25_out.c | ||
| ax25_route.c | ||
| ax25_std_in.c | ||
| ax25_std_subr.c | ||
| ax25_std_timer.c | ||
| ax25_subr.c | ||
| ax25_timer.c | ||
| ax25_uid.c | ||
| Kconfig | ||
| Makefile | ||
| sysctl_net_ax25.c | ||