From: Zihan Xi llc_conn_handler() allocates an incoming child socket for any frame received by a listening LLC socket before the frame is validated as a real passive-open request. Non-SABME traffic, such as DISC commands, can therefore create a child socket that is immediately driven through the ADM state tables instead of the passive-open path. The child remains hashed in the LLC SAP tables and keeps its device reference, so repeating such frames leaks sockets and memory until the host runs out of memory. Only create an incoming child socket when the listener actually receives a SABME command. Non-passive-open traffic then stays on the listening socket path and no orphan child socket is created. Fixes: d389424e00f9 ("[LLC]: Fix the accept path") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: Codex:gpt-5.4 Signed-off-by: Zihan Xi Signed-off-by: Ren Wei --- net/llc/llc_conn.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c index 0a3f5e0bec0..a235748e36d 100644 --- a/net/llc/llc_conn.c +++ b/net/llc/llc_conn.c @@ -801,7 +801,8 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb) * the originator of the new connection, and this state has to be * in the newly created struct sock private area. -acme */ - if (unlikely(sk->sk_state == TCP_LISTEN)) { + if (unlikely(sk->sk_state == TCP_LISTEN) && + !llc_conn_ev_rx_sabme_cmd_pbit_set_x(sk, skb)) { struct sock *newsk = llc_create_incoming_sock(sk, skb->dev, &saddr, &daddr); if (!newsk) -- 2.43.0