CVE-2024-40910: ax25: Fix refcount imbalance on inbound connections

In the Linux kernel, the following vulnerability has been resolved:

ax25: Fix refcount imbalance on inbound connections

When releasing a socket in ax25release(), we call netdevput() to decrease the refcount on the associated ax.25 device. However, the execution path for accepting an incoming connection never calls netdevhold(). This imbalance leads to refcount errors, and ultimately to kernel crashes.

A typical call trace for the above situation will start with one of the following errors:

refcountt: decrement hit 0; leaking memory. refcountt: underflow; use-after-free.

And will then have a trace like:

Call Trace: <TASK> ? showregs+0x64/0x70 ? warn+0x83/0x120 ? refcountwarnsaturate+0xb2/0x100 ? reportbug+0x158/0x190 ? prbreadvalid+0x20/0x30 ? handlebug+0x3e/0x70 ? excinvalidop+0x1c/0x70 ? asmexcinvalidop+0x1f/0x30 ? refcountwarnsaturate+0xb2/0x100 ? refcountwarnsaturate+0xb2/0x100 ax25release+0x2ad/0x360 sockrelease+0x35/0xa0 sockclose+0x19/0x20 [...]

On reboot (or any attempt to remove the interface), the kernel gets stuck in an infinite loop:

unregisternetdevice: waiting for ax0 to become free. Usage count = 0

This patch corrects these issues by ensuring that we call netdevhold() and ax25devhold() for new connections in ax25accept(). This makes the logic leading to ax25accept() match the logic for ax25bind(): in both cases we increment the refcount, which is ultimately decremented in ax25release().