netdev - Re: [syzbot] [net?] WARNING in cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iJ7h_LFSV6n_9WmbTMwTMsZ0UgdBj_oGrnzcrZu7oCxFw@mail.gmail.com>
Date: Thu, 30 Nov 2023 10:38:57 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: xingwei lee <xrivendell7@...il.com>
Cc: syzbot+9ada62e1dc03fdc41982@...kaller.appspotmail.com, davem@...emloft.net, 
	kuba@...nel.org, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, 
	pabeni@...hat.com, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] WARNING in cleanup_net (3)

On Thu, Nov 30, 2023 at 9:46 AM Eric Dumazet <edumazet@...gle.com> wrote:
>
> On Thu, Nov 30, 2023 at 9:42 AM xingwei lee <xrivendell7@...il.com> wrote:
> >
> > Hello
> > I reproduced this bug with repro.txt and repro.c
> >
> >
>
>
> Is your syzbot instance ready to accept patches for testing ?
>
> Otherwise, a repro which happens to  work 'by luck' might not work for me.
>
> The bug here is a race condition with rds subsystem being dismantled
> at netns dismantle, the 'repro' could be anything really.

Can you test the following patch ?
Thanks.

diff --git a/net/core/sock.c b/net/core/sock.c
index fef349dd72fa735b5915fc03e29cbb155b2aff2c..36d2871ac24f383e4e5d1af1168000f076011aae
100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2197,8 +2197,6 @@ static void __sk_destruct(struct rcu_head *head)

        if (likely(sk->sk_net_refcnt))
                put_net_track(sock_net(sk), &sk->ns_tracker);
-       else
-               __netns_tracker_free(sock_net(sk), &sk->ns_tracker, false);

        sk_prot_free(sk->sk_prot_creator, sk);
 }
@@ -2212,6 +2210,9 @@ void sk_destruct(struct sock *sk)
                use_call_rcu = true;
        }

+       if (unlikely(!sk->sk_net_refcnt))
+               __netns_tracker_free(sock_net(sk), &sk->ns_tracker, false);
+
        if (use_call_rcu)
                call_rcu(&sk->sk_rcu, __sk_destruct);
        else