Eric Dumazet 2bd0f67212 ax25: properly unshare skbs in ax25_kiss_rcv() ... [ Upstream commit 8156210d36a43e76372312c87eb5ea3dbb405a85 ] Bernard Pidoux reported a regression apparently caused by commit c353e8983e ("net: introduce per netns packet chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c ("phonet: properly unshare skbs in phonet_rcv()"). Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: Bernard Pidoux <f6bvp@free.fr> Closes: https://lore.kernel.org/netdev/1713f383-c538-4918-bc64-13b3288cd542@free.fr/ Tested-by: Bernard Pidoux <f6bvp@free.fr> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Joerg Reuter <jreuter@yaina.de> Cc: David Ranch <dranch@trinnet.net> Cc: Folkert van Heusden <folkert@vanheusden.com> Reviewed-by: Dan Cross <crossd@gmail.com> Link: https://patch.msgid.link/20250902124642.212705-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-09-09 18:50:20 +02:00
..
af_ax25.c	net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg	2022-06-22 14:22:01 +02:00
ax25_addr.c
ax25_dev.c	ax25: fix reference count leaks of ax25_dev	2022-04-20 09:34:22 +02:00
ax25_ds_in.c
ax25_ds_subr.c
ax25_ds_timer.c
ax25_iface.c
ax25_in.c	ax25: properly unshare skbs in ax25_kiss_rcv()	2025-09-09 18:50:20 +02:00
ax25_ip.c
ax25_out.c
ax25_route.c	ax25: fix reference count leaks of ax25_dev	2022-04-20 09:34:22 +02:00
ax25_std_in.c
ax25_std_subr.c
ax25_std_timer.c
ax25_subr.c	ax25: Fix NULL pointer dereferences in ax25 timers	2022-04-20 09:34:22 +02:00
ax25_timer.c
ax25_uid.c
Kconfig
Makefile
sysctl_net_ax25.c