netdev - Re: [ROSE] [AX25] 6.15.10 long term stable kernel oops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89i+Me3hgy05EK8sSCNkH1Wj5f49rv_UvgFNuFwPf4otu7w@mail.gmail.com>
Date: Mon, 1 Sep 2025 05:04:27 -0700
From: Eric Dumazet <edumazet@...gle.com>
To: F6BVP <f6bvp@...e.fr>
Cc: Paolo Abeni <pabeni@...hat.com>, Dan Carpenter <dan.carpenter@...aro.org>, 
	linux-hams@...r.kernel.org, netdev <netdev@...r.kernel.org>, 
	Dan Cross <crossd@...il.com>, David Ranch <dranch@...nnet.net>, 
	Folkert van Heusden <folkert@...heusden.com>, Florian Westphal <fw@...len.de>
Subject: Re: [ROSE] [AX25] 6.15.10 long term stable kernel oops

On Sat, Aug 30, 2025 at 4:37 PM F6BVP <f6bvp@...e.fr> wrote:
>
> Here is a bad commit report by git bisect and the corresponding decoded
> stack trace of kernel panic triggered when mkiss receives AX25 packet.
>
> All kernels following 6.14.11, i.e. starting with 6.15.1 until net-next
> are affected by the issue.
>
> I would be pleased to check any patch correcting the issue.
>

Thanks for the report.

At some point we will have to remove ax25, this has been quite broken
for a long time.

Please try :

diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 1cac25aca637..f2d66af86359 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -433,6 +433,10 @@ static int ax25_rcv(struct sk_buff *skb, struct
net_device *dev,
 int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
                  struct packet_type *ptype, struct net_device *orig_dev)
 {
+       skb = skb_share_check(skb, GFP_ATOMIC);
+       if (!skb)
+               return NET_RX_DROP;
+
        skb_orphan(skb);

        if (!net_eq(dev_net(dev), &init_net)) {