When an `AF_LLC` listening socket (`sk->sk_state == TCP_LISTEN`) accepts an incoming connection request in `llc_conn_state_process()`, it allocates a new child `sock` via `llc_sk_alloc()`, holds a `netdev` reference on `child_llc->dev`, attaches `child` to `child_llc->sap`, sets `skb->sk = child`, and queues `skb` onto the listener's `sk->sk_receive_queue` waiting for `llc_ui_accept()`. If the listening socket is closed without calling `accept()`, `llc_ui_release()` calls `skb_queue_purge(&sk->sk_receive_queue)` in `llc_sk_Component` / `llc_sk_free()`, which frees the queued `skb`s without removing the unaccepted `child` sockets from `child_llc->sap`, releasing `child_llc->dev`, or freeing `child`. This permanently leaks the child `sock`, its `llc_sap` reference, and the `net_device` reference (blocking `unregister_netdevice()`). In `llc_ui_release()`, drain `sk->sk_receive_queue` when `sk->sk_state == TCP_LISTEN`, and for each unaccepted child socket, orphan `skb`, remove `child` from `child_llc->sap`, release `child_llc->dev`, and free `child` via `llc_sk_free()`. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: LLM Signed-off-by: Hui Peng --- net/llc/af_llc.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index b0447c33dbf0..4bc7839127aa 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -204,6 +204,25 @@ static int llc_ui_release(struct socket *sock) llc = llc_sk(sk); dprintk("%s: closing local(%02X) remote(%02X)\n", __func__, llc->laddr.lsap, llc->daddr.lsap); + if (sk->sk_state == TCP_LISTEN) { + struct sk_buff *skb; + + while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) { + struct sock *child = skb->sk; + + if (child) { + struct llc_sock *child_llc = llc_sk(child); + + skb_orphan(skb); + if (child_llc->sap) + llc_sap_remove_socket(child_llc->sap, child); + netdev_put(child_llc->dev, &child_llc->dev_tracker); + sock_orphan(child); + llc_sk_free(child); + } + kfree_skb(skb); + } + } if (!llc_send_disc(sk)) llc_ui_wait_for_disc(sk, READ_ONCE(sk->sk_rcvtimeo)); if (!sock_flag(sk, SOCK_ZAPPED)) {