Commit 72f9dd522f8d for kernel

commit 72f9dd522f8d6c5a00be9695c7bb74631eb5069e
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Sep 24 08:29:48 2026 +0000

    llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

    In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()
    fails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks
    the newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),
    and double-frees skb when llc_conn_state_process() drops its reference.

    In llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is
    leaked if llc_mac_hdr_init() returns an error.

    Free nskb in all three error paths.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Closes: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20260924082951.1599377-2-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index 724ecd741d4c..1aa7fe28acdd 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -437,7 +437,7 @@ int llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(struct sock *sk,
 		if (likely(!rc))
 			llc_conn_send_pdu(sk, nskb);
 		else
-			kfree_skb(skb);
+			kfree_skb(nskb);
 	}
 	if (rc) {
 		nr = LLC_I_GET_NR(pdu);
diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c
index 98deee560373..831998211b52 100644
--- a/net/llc/llc_s_ac.c
+++ b/net/llc/llc_s_ac.c
@@ -121,6 +121,8 @@ int llc_sap_action_send_xid_r(struct llc_sap *sap, struct sk_buff *skb)
 	rc = llc_mac_hdr_init(nskb, mac_sa, mac_da);
 	if (likely(!rc))
 		rc = dev_queue_xmit(nskb);
+	else
+		kfree_skb(nskb);
 out:
 	return rc;
 }
@@ -170,6 +172,8 @@ int llc_sap_action_send_test_r(struct llc_sap *sap, struct sk_buff *skb)
 	rc = llc_mac_hdr_init(nskb, mac_sa, mac_da);
 	if (likely(!rc))
 		rc = dev_queue_xmit(nskb);
+	else
+		kfree_skb(nskb);
 out:
 	return rc;
 }