[PATCH] net: llc: clean up unaccepted child sockets in llc_ui_release()

[Hui Peng]

When an `AF_LLC` listening socket (`sk->sk_state == TCP_LISTEN`) accepts
an incoming connection request in `llc_conn_state_process()`, it
allocates a new child `sock` via `llc_sk_alloc()`, holds a `netdev`
reference on `child_llc->dev`, attaches `child` to `child_llc->sap`,
sets `skb->sk = child`, and queues `skb` onto the listener's
`sk->sk_receive_queue` waiting for `llc_ui_accept()`.

If the listening socket is closed without calling `accept()`,
`llc_ui_release()` calls `skb_queue_purge(&sk->sk_receive_queue)` in
`llc_sk_Component` / `llc_sk_free()`, which frees the queued `skb`s
without removing the unaccepted `child` sockets from `child_llc->sap`,
releasing `child_llc->dev`, or freeing `child`. This permanently leaks
the child `sock`, its `llc_sap` reference, and the `net_device`
reference (blocking `unregister_netdevice()`).

In `llc_ui_release()`, drain `sk->sk_receive_queue` when `sk->sk_state
== TCP_LISTEN`, and for each unaccepted child socket, orphan `skb`,
remove `child` from `child_llc->sap`, release `child_llc->dev`, and free
`child` via `llc_sk_free()`.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>

---
 net/llc/af_llc.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index b0447c33dbf0..4bc7839127aa 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -204,6 +204,25 @@ static int llc_ui_release(struct socket *sock)
 	llc = llc_sk(sk);
 	dprintk("%s: closing local(%02X) remote(%02X)\n", __func__,
 		llc->laddr.lsap, llc->daddr.lsap);
+	if (sk->sk_state == TCP_LISTEN) {
+		struct sk_buff *skb;
+
+		while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+			struct sock *child = skb->sk;
+
+			if (child) {
+				struct llc_sock *child_llc = llc_sk(child);
+
+				skb_orphan(skb);
+				if (child_llc->sap)
+					llc_sap_remove_socket(child_llc->sap, child);
+				netdev_put(child_llc->dev, &child_llc->dev_tracker);
+				sock_orphan(child);
+				llc_sk_free(child);
+			}
+			kfree_skb(skb);
+		}
+	}
 	if (!llc_send_disc(sk))
 		llc_ui_wait_for_disc(sk, READ_ONCE(sk->sk_rcvtimeo));
 	if (!sock_flag(sk, SOCK_ZAPPED)) {