From nobody Sat Feb 7 08:44:37 2026 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00BB82D060D for ; Fri, 23 Jan 2026 20:24:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769199844; cv=none; b=axMh9Sn3q1EvKjO1M29qWdzhIWi90lIi3/RKelVyVzTsimjC638it4/DNysLUGYwWtPLYdjmC7bwYkXvflyXMbmk2ZU4K1vhvPgKnoOzqUVOrzBdFxEmD6fFmrFHCypF72wxYKK70wbM+J5Jlkt4TCW61O+EnzaiBqVpR1wXqDU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769199844; c=relaxed/simple; bh=a6ukDfiHiKi5XfccsBsdGT3goJVGQDGOaNtK1WCRH7Y=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Ky8bvahzJZnBPbFzVH6IvKGOcE2rKkSfqzzhdB5QFDglQn1SijDFajzFlJ2K3cBfPAr3wJsfUytH20UVeEJIT6MsUKknaQwpNwUJogYjRAWgiR6Vbi7Mnd4fOEGLP7Mwde7sLs8hHTpbvasE8uLDpn3yf+fzaYmRN8D9LrkpRac= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=V/K+HMfQ; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="V/K+HMfQ" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-8217f2ad01eso2488835b3a.2 for ; Fri, 23 Jan 2026 12:24:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1769199842; x=1769804642; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=y/+MCAvn6zq49yLies7LM3lPpbdAqnm4aVigMaiLOu0=; b=V/K+HMfQGmwqeILt8BpalJC4oSp3ITAYCS8YKp/YBx5V91IflKJ7v+6vnyOS3f4moV jxt3GIE0zXQQaBj8juijK1MbCCBa9Nuu8eqJVR6O9dzn9iijwruE5fDKYpJnEC9lRPvu b4gSIuL7AeEcPp0/J9b7tbGroHmN4sH7Iq9SnyRD1PlqkTZIjRbfAbdlc7s6kwgiIBty jKcnnx4m4MV5UztsZTe3A31VvFZgSOCcmxi6EDDVUDoF3ROSKTNXEXG38NyN/BYgIRDi VoadTjSrDsg6w2ECUEaNFL3Umk0GmSGVqS3XOnpNs6dED5eu+gjzWa6OoSBNUbc461K4 0Z6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769199842; x=1769804642; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=y/+MCAvn6zq49yLies7LM3lPpbdAqnm4aVigMaiLOu0=; b=kyjTjvrIdhbNE5gPVuhqflSeuZA6wAxSM35/03weJG3TpQKM/T6L9HT3VvnLHA69UF QFJxDTsNiTsGXB088oA5tyqGZ6s8u6xyekLG90PoFwwxZ1crGD836a/V7joExj/F7Ug7 q6eWHfQr18XuEDgPqyJnb+cfPOmK6EBeLnEGyXhIxQ2C+UxKqvwAs9cpzh3ZxMIu9QDS mbVQvKzfVmDPjiICFwWtdqehqoWnBswYR2FSlpuUJB2Jun/RFdQgwqS9p7RNthaqA3+h r1miBPiWN4IgZ07jrpkTTXZo1KaH/VwGPCUPgTbgeQJfQmxSujpEfIkQFSkZuTNkgERP YmGw== X-Forwarded-Encrypted: i=1; AJvYcCVL/M8z9vdtf80VpZG5v4pvLx1Jqbe67lBT0LtTeYTTJNFPH/kC6jpXGzBtqrtvgqsmLzCWCJifs44KKsM=@vger.kernel.org X-Gm-Message-State: AOJu0YwDCdnVAz/lnJ+KjK2uAMWyea3/LZhM846ns3zwG1wE5fQCOCqe TPbxKC+vE1W6GdRo7VgIJpn1hZ5jZhjIqUV6trCpuBbjjm5zBgH+Of8= X-Gm-Gg: AZuq6aKqv0G9ZqP9AskvXLunHDTu75KMa/9MFbdL3zttklDb94+pLRuQL+/ln0Fp4Cg recQyktQQk2menAqSN3x3jQCO0JHxKOJpDep6tQ1uVxH1oTN0sojt5hS4hz6nH57bZx0Xbp8lNx mQ0Q6fVlzNlbAmkH9SoRtOx8hISAjVRF/wou4Vm8vqxR3OT7M7UwnbDHfF00Zs63V0rB4rrOkL3 QEWy+6e75eMI04Bk4HrGdY2tE1X2uh1tpY3pptdUnOamDznp1aV7z3P2cbR+iuZGtv8pa7xUNPd o9cfVANad5jRJD4aaPpK2qt1fFXcLEbCMqI+z61FQuslKduPxFOMkp+xbMMMdLgOVVNfhWsYMup e454Xo8xysv6E7kccNf2s/SLZEVK6mEou8Payx7m5qNR3wBOmYBQI8Y/RoSkJ1wy9PHqqFvCzso ykW99L285ALH2rEFA= X-Received: by 2002:a05:6a00:419a:b0:81f:de60:39b0 with SMTP id d2e1a72fcca58-82317d956f8mr3031318b3a.13.1769199841993; Fri, 23 Jan 2026 12:24:01 -0800 (PST) Received: from DESKTOP-BKIPFGN ([38.76.140.13]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8231866b92csm2889233b3a.25.2026.01.23.12.23.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 23 Jan 2026 12:24:01 -0800 (PST) From: Kery Qi To: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: horms@kernel.org, mingo@kernel.org, tglx@kernel.org, acme@mandriva.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Kery Qi Subject: [PATCH] llc: fix resource exhaustion in llc_conn_handler() Date: Sat, 24 Jan 2026 04:22:11 +0800 Message-ID: <20260123202211.2082-2-qikeyu2017@gmail.com> X-Mailer: git-send-email 2.50.1.windows.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" llc_conn_handler() does not check the accept queue limit before creating a new socket for incoming connections. This allows an attacker to send a large number of SABME PDUs to exhaust system memory by creating unlimited sockets. The issue is similar to the TCP SYN flood problem, but LLC lacks the protection mechanisms that TCP has (like SYN cookies and accept queue limits). Add sk_acceptq_is_full() check before creating new socket and call sk_acceptq_added() after successful socket creation to properly track the accept queue length. This ensures that the backlog limit set by listen() is respected. Fixes: d389424e00f90 ("[LLC]: Fix the accept path") Signed-off-by: Kery Qi --- net/llc/llc_conn.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c index 5c0ac243b248..9296b5d6b04a 100644 --- a/net/llc/llc_conn.c +++ b/net/llc/llc_conn.c @@ -802,10 +802,15 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_= buff *skb) * in the newly created struct sock private area. -acme */ if (unlikely(sk->sk_state =3D=3D TCP_LISTEN)) { - struct sock *newsk =3D llc_create_incoming_sock(sk, skb->dev, - &saddr, &daddr); + struct sock *newsk; + + if (sk_acceptq_is_full(sk)) + goto drop_unlock; + newsk =3D llc_create_incoming_sock(sk, skb->dev, + &saddr, &daddr); if (!newsk) goto drop_unlock; + sk_acceptq_added(sk); skb_set_owner_r(skb, newsk); } else { /* --=20 2.34.1