linux-kernel - Re: [syzbot] [net?] WARNING in cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240407103306.1364-1-hdanton@sina.com>
Date: Sun,  7 Apr 2024 18:33:06 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+9ada62e1dc03fdc41982@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] WARNING in cleanup_net (3)

On Thu, 04 Apr 2024 20:00:30 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel..
> git tree:       upstream
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16696223180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  fe46a7dd189e

--- x/include/net/net_namespace.h
+++ y/include/net/net_namespace.h
@@ -318,7 +318,7 @@ static inline int check_net(const struct
 	return 1;
 }
 
-#define net_drop_ns NULL
+static void net_drop_ns(void *p) {}
 #endif
 
 
@@ -353,6 +353,7 @@ static inline void __netns_tracker_free(
 static inline struct net *get_net_track(struct net *net,
 					netns_tracker *tracker, gfp_t gfp)
 {
+	refcount_inc(&net->passive);
 	get_net(net);
 	netns_tracker_alloc(net, tracker, gfp);
 	return net;
@@ -362,6 +363,7 @@ static inline void put_net_track(struct
 {
 	__netns_tracker_free(net, tracker, true);
 	put_net(net);
+	net_drop_ns(net);
 }
 
 typedef struct {
--- x/net/netfilter/nf_nat_masquerade.c
+++ y/net/netfilter/nf_nat_masquerade.c
@@ -123,11 +123,12 @@ static void nf_nat_masq_schedule(struct
 		INIT_WORK(&w->work, iterate_cleanup_work);
 		w->ifindex = ifindex;
 		w->net = net;
-		netns_tracker_alloc(net, &w->ns_tracker, gfp_flags);
+		get_net_track(net, &w->ns_tracker, gfp_flags);
 		w->iter = iter;
 		if (addr)
 			w->addr = *addr;
 		schedule_work(&w->work);
+		put_net(net);
 		return;
 	}
 
--