netdev - Re: [ROSE] [AX25] 6.15.10 long term stable kernel oops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iLi=ObSPAg69uSPRS+pNwGw9jVSQJfT34ZAp3KtSrx2Gg@mail.gmail.com>
Date: Mon, 1 Sep 2025 05:05:37 -0700
From: Eric Dumazet <edumazet@...gle.com>
To: F6BVP <f6bvp@...e.fr>
Cc: Paolo Abeni <pabeni@...hat.com>, Dan Carpenter <dan.carpenter@...aro.org>, 
	linux-hams@...r.kernel.org, netdev <netdev@...r.kernel.org>, 
	Dan Cross <crossd@...il.com>, David Ranch <dranch@...nnet.net>, 
	Folkert van Heusden <folkert@...heusden.com>, Florian Westphal <fw@...len.de>
Subject: Re: [ROSE] [AX25] 6.15.10 long term stable kernel oops

On Mon, Sep 1, 2025 at 5:04 AM Eric Dumazet <edumazet@...gle.com> wrote:
>
> On Sat, Aug 30, 2025 at 4:37 PM F6BVP <f6bvp@...e.fr> wrote:
> >
> > Here is a bad commit report by git bisect and the corresponding decoded
> > stack trace of kernel panic triggered when mkiss receives AX25 packet.
> >
> > All kernels following 6.14.11, i.e. starting with 6.15.1 until net-next
> > are affected by the issue.
> >
> > I would be pleased to check any patch correcting the issue.
> >
>
> Thanks for the report.
>
> At some point we will have to remove ax25, this has been quite broken
> for a long time.
>
> Please try :
>
> diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
> index 1cac25aca637..f2d66af86359 100644
> --- a/net/ax25/ax25_in.c
> +++ b/net/ax25/ax25_in.c
> @@ -433,6 +433,10 @@ static int ax25_rcv(struct sk_buff *skb, struct
> net_device *dev,
>  int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
>                   struct packet_type *ptype, struct net_device *orig_dev)
>  {
> +       skb = skb_share_check(skb, GFP_ATOMIC);
> +       if (!skb)
> +               return NET_RX_DROP;
> +
>         skb_orphan(skb);
>
>         if (!net_eq(dev_net(dev), &init_net)) {

We had a similar fix in 2016 for phonet:

commit 7aaed57c5c2890634cfadf725173c7c68ea4cb4f
Author: Eric Dumazet <edumazet@...gle.com>
Date:   Tue Jan 12 08:58:00 2016 -0800

    phonet: properly unshare skbs in phonet_rcv()

    Ivaylo Dimitrov reported a regression caused by commit 7866a621043f
    ("dev: add per net_device packet type chains").

    skb->dev becomes NULL and we crash in __netif_receive_skb_core().

    Before above commit, different kind of bugs or corruptions could happen
    without major crash.

    But the root cause is that phonet_rcv() can queue skb without checking
    if skb is shared or not.

    Many thanks to Ivaylo Dimitrov for his help, diagnosis and tests.

    Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@...il.com>
    Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@...il.com>
    Signed-off-by: Eric Dumazet <edumazet@...gle.com>
    Cc: Remi Denis-Courmont <courmisch@...il.com>
    Signed-off-by: David S. Miller <davem@...emloft.net>