On Tue, Sep 2, 2025 at 5:51 AM Dan Cross [off-list ref] wrote:

On Tue, Sep 2, 2025 at 8:46 AM Eric Dumazet [off-list ref] wrote:

quoted

Bernard Pidoux reported a regression apparently caused by commit
c353e8983e0d ("net: introduce per netns packet chains").

skb->dev becomes NULL and we crash in __netif_receive_skb_core().

Before above commit, different kind of bugs or corruptions could happen
without a major crash.

But the root cause is that ax25_kiss_rcv() can queue/mangle input skb
without checking if this skb is shared or not.

Many thanks to Bernard Pidoux for his help, diagnosis and tests.

We had a similar issue years ago fixed with commit 7aaed57c5c28
("phonet: properly unshare skbs in phonet_rcv()").

Please mention the analysis done here in the change description:
https://lore.kernel.org/linux-hams/CAEoi9W4FGoEv+2FUKs7zc=XoLuwhhLY8f8t_xQ6MgTJyzQPxXA@mail.gmail.com/#R (local)

I was not aware of all the long past discussions.

No need for me to respin this patch, there is the Closes: tag for this purpose.

Whoever wants to find all the details can follow it.

For this changelog, I basically copy/pasted my phonet change,
as it included all the relevant information for this old bug.

Thank you.

Reviewed-by: Dan Cross <redacted>

quoted

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Bernard Pidoux <redacted>
Closes: https://lore.kernel.org/netdev/1713f383-c538-4918-bc64-13b3288cd542@free.fr/ (local)
Tested-by: Bernard Pidoux <redacted>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Joerg Reuter <redacted>
Cc: linux-hams@vger.kernel.org
Cc: David Ranch <redacted>
Cc: Dan Cross <redacted>
Cc: Folkert van Heusden <redacted>
---
 net/ax25/ax25_in.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 1cac25aca637..f2d66af86359 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c

@@ -433,6 +433,10 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev,
 int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
                  struct packet_type *ptype, struct net_device *orig_dev)
 {
+       skb = skb_share_check(skb, GFP_ATOMIC);
+       if (!skb)
+               return NET_RX_DROP;
+
        skb_orphan(skb);

        if (!net_eq(dev_net(dev), &init_net)) {
--

2.51.0.318.gd7df087d1a-goog