linux-kernel - Re: unregister_netdevice: waiting for DEV to become free [unbalanced refcount bug in dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250313224415.60894-1-kuniyu@amazon.com>
Date: Thu, 13 Mar 2025 15:44:06 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <kangyan91@...look.com>
CC: <aleksander.lobakin@...el.com>, <davem@...emloft.net>,
	<edumazet@...gle.com>, <florian.fainelli@...adcom.com>, <horms@...nel.org>,
	<kory.maincent@...tlin.com>, <kuba@...nel.org>, <kuniyu@...zon.com>,
	<linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>, <syzkaller@...glegroups.com>
Subject: Re: unregister_netdevice: waiting for DEV to become free [unbalanced refcount bug in dev_ifsioc]

From: YAN KANG <kangyan91@...look.com>
Date: Thu, 13 Mar 2025 16:18:22 +0000
> I have repro to trigger it.

FTR, I think the attached prog is not a repro by itself.

> ...
>
> Syzkaller reproducer:
> # {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false

This syz prog does not unshare() nor create necessary devices.
Someone must create a bridge and another device.

> r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
> ioctl$sock_SIOCGIFINDEX_802154(r0, 0x89a2, &(0x7f0000000a80)={'wpan3\x00'})
> r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
> ioctl$sock_SIOCGIFINDEX_802154(r1, 0x89a0, &(0x7f0000000a80)={'wpan3\x00'})
> r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
> ioctl$sock_SIOCGIFINDEX_802154(r2, 0x89a1, &(0x7f0000000a80)={'wpan3\x00'})

0x89a1 is SIOCBRDELBR, and wpan3 is the name of the bridge dev, which
looks correct from this line.

> unregister_netdevice: waiting for wpan3 to become free. Usage count = 2

But apparently SIOCBRDELIF (0x89a3) is missing in the repro, so
there must be another prog running that adds and removes a dev
to wpan3.

When you share a repro, please make sure it's standalone.

> I GET backtrace for panic by gdb
> (gdb) bt
> #0  netdev_wait_allrefs_any (list=0xffffc9001bfa7bc8) at net/core/dev.c:11151

Also, this should not panic.

Under RTNL pressure, the SIOCBRDELIF's thread may not be able to acquire
RTNL and complete SIOCBRDELIF, then netdev_wait_allrefs_any() will log the
message but it's not under RTNL.  Once the SIOCBRDELIF's thread acquire
RTNL, the refcnt will be released soon and __rtnl_unlock() will be
unblocked.

Thanks