6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bernard Pidoux rose_transmit_link() queues an outgoing frame on rose_neigh->queue instead of sending it immediately whenever the neighbour isn't "restarted" yet (link not up) -- notably the CLEAR_REQUEST built by rose_write_internal() when a socket is released (e.g. its owning process is killed) while the underlying AX.25 link to that neighbour is still coming up. rose_neigh_put() already tears down both timers and drops the ax25/ digipeat references before freeing the neighbour, but never empties this queue. kfree(rose_neigh) only frees the rose_neigh struct itself (the sk_buff_head embedded in it is just three next/prev/len words), not the skbs still linked into it -- every frame still queued here at that point leaks for good. rose_remove_neigh() (rose_route.c) already purges this same queue, but it is only one of about two dozen call sites that can drop the last reference and trigger the real kfree() in rose_neigh_put() -- every socket releasing its own rose->neighbour reference (af_rose.c, rose_in.c, rose_timer.c) can just as well be the one that does. Doing the purge once, centrally, in rose_neigh_put() itself covers all of them regardless of which call site happens to be last, rather than relying on whichever caller happened to remember it. Matches a leak pattern observed and documented back in May 2026 (mailbbs killed -> rose_release() -> rose_write_internal() -> rose_transmit_link() queues the CLEAR_REQUEST -> skb never freed), never root-caused until now. Deployed and running since 2026-09-13/15 on three independent nodes (f6bvp-12, f6bvp-8, f6bvp-10 -- three different kernel bases, 6.12.94/6.18.46/6.18.34), no regression observed. Signed-off-by: Bernard Pidoux (cherry picked from commit e59e4523182e4f58f4f29b5e4bce44c1ef152d70) Signed-off-by: Sasha Levin --- include/net/rose.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/include/net/rose.h b/include/net/rose.h index 0d957b8dd0ba3..49140668b3dd0 100644 --- a/include/net/rose.h +++ b/include/net/rose.h @@ -180,6 +180,18 @@ static inline void rose_neigh_put(struct rose_neigh *rose_neigh) */ timer_shutdown_sync(&rose_neigh->ftimer); timer_shutdown_sync(&rose_neigh->t0timer); + /* rose_transmit_link() queues a frame here instead of sending + * it immediately whenever the neighbour isn't "restarted" yet + * (link not up) -- e.g. the CLEAR_REQUEST built by + * rose_write_internal() when a socket is released while its + * underlying AX.25 link is still coming up. If this neighbour + * is freed before that link ever comes up, nothing else ever + * empties this queue: kfree() below only frees the + * rose_neigh struct itself (including the three next/prev/len + * words of the sk_buff_head), not the skbs it points to, + * leaking every frame still queued here. + */ + skb_queue_purge(&rose_neigh->queue); if (rose_neigh->ax25) ax25_cb_put(rose_neigh->ax25); kfree(rose_neigh->digipeat); -- 2.53.0