In `dgram_ioctl()` (`SIOCINQ`), the queued skb at the head of `sk->sk_receive_queue` has already had its MAC header stripped by `ieee802154_subif_frame()` prior to `dgram_deliver()`, so `skb->len` is already the exact payload length that `dgram_recvmsg()` will return to userspace. However, `dgram_ioctl()` computes `*karg = skb->len - ieee802154_hdr_length(skb)`. Calling `ieee802154_hdr_length(skb)` re-parses the payload bytes as an 802.15.4 MAC header and calls `pskb_may_pull(skb, ...)` while holding `sk->sk_receive_queue.lock`. When multiple `SOCK_DGRAM` sockets receive a cloned copy of the frame (`skb_shared(skb)` is true) and the payload is non-linear, `pskb_may_pull()` calls `pskb_expand_head()`, which triggers `BUG_ON(skb_shared(skb))`. Even on unshared linear skbs, subtracting `ieee802154_hdr_length(skb)` a second time underflows `*karg` to a negative value when the payload is shorter than the bogus parsed header length. Set `*karg = skb->len` directly in `dgram_ioctl()`. Fixes: e1d001fa5b47 ("net: ioctl: Use kernel memory on protocol ioctl callbacks") Assisted-by: LLM Signed-off-by: Hui Peng --- net/ieee802154/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c index 5a36e87893f6..8d660fe87d4e 100644 --- a/net/ieee802154/socket.c +++ b/net/ieee802154/socket.c @@ -552,7 +552,7 @@ static int dgram_ioctl(struct sock *sk, int cmd, int *karg) * of this packet since that is all * that will be read. */ - *karg = skb->len - ieee802154_hdr_length(skb); + *karg = skb->len; } spin_unlock_bh(&sk->sk_receive_queue.lock); return 0; -- 2.55.0.1082.g2b9226bbc0-goog