From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590929; b=pr5sYrpxFZu7FkXUN/42qW3tewlD9R654MwPRLeEC8vm6ZqwGo3k7upxY48OdD3x2i2I ggYFxRtvMSt3lw9zVJHrbq4DQfVvnwuegjBkPB2WyF18CpMNOwelUsbW3AvG8w1Vnpyni kN+wEe9Fk8fszn20Pw5AR0EmBFsobN3kDZ8ylecpJ68y5rSIoxzi/lf8mHoPEstsIBpUG 7/ayT5TnK90m8ZXxiuKpmEFyZVslc4QH4pXVakNX0JZ5SrCAamUQZqfwriy+wW1pnSkVi 75KXk33DqXOgAQrZ5aXghspRpdxtXv7Pr4YcdEcu8OwYDjQ8Oe17RYGPIhCrKSVHtuw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590929; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=vXD1WUxLxilGnF1Dv5boO5AmKWD12N4FnQnYtqAZSN4=; b=A7RWrTfULa8pDtxHqxy8PwvlhJui0ltLUOsqb74Xu9TFc2p74PW7dFhJN/k3+xvz1IzW 2NFrGvTUwgbvJbCsF2gGnGrGQ3+N6ymnux+oUkG9+5VfkMgZu2hgtaH+jQX54YQRIH1pS Kg3fkFtX6nu43ml+9iBBytdLMsMt9HgOTGJ+HP8spzdJoxZgSWGbYYDWm5Iq2hQQQ6tTL 96SdGIaiQNdYxD0KBZ/irDb61wSwkcANI/tHD9HD5ofCIlRk3dFqBcOEGp8bUc/PHwGZ8 +wNXkjVt4nXUfkpoFb6Kwf9p1PEGd5tIWqGWi7rVUGfiOjOAHacDdgfS/Xz9VhWcDrQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="T/yFVmF+"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9169F606E676; Fri, 13 Nov 2026 17:28:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=T/yFVmF+ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 14A051F000C5; Fri, 13 Nov 2026 17:28:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590929; bh=vXD1WUxLxilGnF1Dv5boO5AmKWD12N4FnQnYtqAZSN4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=T/yFVmF+ngO5W5ZO955bcgoNUUttsA/2m/kz9F2cNvK0em9lpRM0BFNZVLj+1Hsvd qjCQODzfYomEbCm/7zy50nW8RiekqK+BJqay8EjVp3SLzewd5rNjuBJw80dp59n1NT Aj8y+22zq9Cc1gJVHvJLaVfczm6Rf2m/BVFv2IFw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bernard Pidoux , Sasha Levin Subject: [PATCH 6.12 116/670] ax25: put an incoming connection on the listeners queue once it is set up Date: Fri, 13 Nov 2026 10:44:40 -0500 Message-ID: <20261113153815.761977827@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bernard Pidoux On a SABM for a listening socket, ax25_rcv() puts the skb on the listener's receive queue as soon as the new socket is made, then releases the listener and only afterwards fills in the connection: addresses, digipeater path, modulus and window (read from the skb), UA, state 3, ax25_cb_add() and the timers. accept() can take the socket in between. If its owner closes it at once, ax25_release() finds it in state 0 and frees it, and ax25_rcv() goes on writing to the freed control block, adds it to ax25_list and reads the freed skb. Keep a place in the listener's backlog when the socket is made, and put the skb on its queue once the connection is complete. If the listener has been closed meanwhile, leave the connection to its heartbeat, as ax25_destroy_socket() does with the connections that were still waiting on its queue. Tested on a QEMU bench (6.12.94 with KASAN and lockdep, two guests over a KISS serial link). A listens on TESTA-9 and a thread calls accept() in a loop on the non-blocking socket, closing each socket it gets at once; B calls TESTA-9 five times: before: BUG: KASAN: slab-use-after-free in ax25_rcv (write of 7 bytes), refcount_t: addition on 0, and a stale entry left in /proc/net/ax25, without any delay added after: no report, ax25 refcount back to its starting value, /proc/net/ax25 empty, five runs out of five With an mdelay(300) after the listener is released in ax25_rcv() the results are the same. A third case closes the listener while ax25_rcv() is held just before queueing the skb: the connection is freed by its heartbeat, with no report and nothing left behind, three runs out of three. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Bernard Pidoux Assisted-by: Claude:claude-opus-5-5 (cherry picked from commit d25d30927389f49e902185ef4647861f7654270e) Signed-off-by: Sasha Levin --- net/ax25/ax25_in.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c index cb48a479ba3cc..fd8669e5b7313 100644 --- a/net/ax25/ax25_in.c +++ b/net/ax25/ax25_in.c @@ -401,11 +401,12 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev, } } - skb_set_owner_r(skb, make); - skb_queue_head(&sk->sk_receive_queue, skb); - - make->sk_state = TCP_ESTABLISHED; - + /* + * Keep a place in the backlog, but put the skb on the + * listener's queue only once the connection is set up + * below: accept() takes it from there, and close() on the + * new socket frees the connection. + */ sk_acceptq_added(sk); bh_unlock_sock(sk); } else { @@ -488,8 +489,25 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev, ax25_kick(ax25); if (sk) { - if (!sock_flag(sk, SOCK_DEAD)) + bh_lock_sock(sk); + skb_set_owner_r(skb, make); + if (sk->sk_state == TCP_LISTEN && !sock_flag(sk, SOCK_DEAD)) { + skb_queue_head(&sk->sk_receive_queue, skb); sk->sk_data_ready(sk); + } else { + /* + * The listener was closed meanwhile: leave the + * connection to its heartbeat, as + * ax25_destroy_socket() does with the connections + * that were still waiting on its queue. + */ + sk_acceptq_removed(sk); + kfree_skb(skb); + sock_orphan(make); + make->sk_state = TCP_LISTEN; + ax25->state = AX25_STATE_0; + } + bh_unlock_sock(sk); sock_put(sk); } else { free: -- 2.53.0