netdev - Re: loopback device reference count leakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpXQ5MyL_KYNctZuZLv_w-ai3pmXKswOLXYeEYmVBdQqJA@mail.gmail.com>
Date:   Wed, 25 Jan 2017 11:50:25 -0800
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Kaiwen Xu <kevin@...xu.net>
Cc:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: loopback device reference count leakage

Hello,

On Mon, Jan 23, 2017 at 9:17 PM, Kaiwen Xu <kevin@...xu.net> wrote:
> Hi netdev folks,
>
> I am currently experiencing an issue related with the loopback during
> network devices shutdown inside a network namespace, which mainfested as
>
>     unregister_netdevice: waiting for lo to become free. Usage count = 1
>
> showing up every 10 seconds or so in the kernel log. It eventually
> causes a deadlock on new network namespace creation.

It is at least the 3rd time I saw this bug report. ;)

>
> When I was trying to debug the issue, I tested from latest kernel 4.10-rc
> back to 3.19, which all can be reproduced on. I also tried to disable
> IPv6, which doesn't help either.
>
> So I tried to patch the kernel with following change to add addtional
> logging message for dev_put() and dev_hold().
>
>     https://lkml.org/lkml/2008/7/20/5
>
> Here are all the dev_put/hold() calls for the loopback device inside a
> namespace from creation to shutdown, when the issue occurs.

Excellent debugging!

>From your debugging output, the dst_ifdown() looks suspicious to me,
it seems to be the reason why we miss one dev_put().


> Could you please give me some pointers why this issue could occur? I can
> also provide addtional information if needed.
>

Do you mind to try the attached patch (compile only)? Try it with your
debugging printk's in case it doesn't fix this bug, but it should make some
difference at least.

Thanks!

View attachment "dst-loopback.diff" of type "text/plain" (540 bytes)