ax25: properly unshare skbs in ax25_kiss_rcv()

Bernard Pidoux reported a regression apparently caused by commit
c353e89 ("net: introduce per netns packet chains").

skb->dev becomes NULL and we crash in __netif_receive_skb_core().

Before above commit, different kind of bugs or corruptions could happen
without a major crash.

But the root cause is that ax25_kiss_rcv() can queue/mangle input skb
without checking if this skb is shared or not.

Many thanks to Bernard Pidoux for his help, diagnosis and tests.

We had a similar issue years ago fixed with commit 7aaed57
("phonet: properly unshare skbs in phonet_rcv()").

Fixes: 1da177e ("Linux-2.6.12-rc2")
Reported-by: Bernard Pidoux <[email protected]>
Closes: https://lore.kernel.org/netdev/[email protected]/
Tested-by: Bernard Pidoux <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Cc: Joerg Reuter <[email protected]>
Cc: David Ranch <[email protected]>
Cc: Folkert van Heusden <[email protected]>
Reviewed-by: Dan Cross <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

Author: edumazet

net/ax25/ax25_in.c

@@ -433,6 +433,10 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev,
 int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
 		  struct packet_type *ptype, struct net_device *orig_dev)
 {
+	skb = skb_share_check(skb, GFP_ATOMIC);
+	if (!skb)
+		return NET_RX_DROP;
+
 	skb_orphan(skb);
 
 	if (!net_eq(dev_net(dev), &init_net)) {