netdev - unregister_netdevice: waiting for lo to become free. Usage count = 6659

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <8b470fda-515e-4ca8-89d4-3dcd7088f58b@I-love.SAKURA.ne.jp>
Date: Mon, 3 Nov 2025 22:39:45 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: Network Development <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>
Subject: unregister_netdevice: waiting for lo to become free. Usage count =
 6659

Hello.

A syzbot report at 2025/11/03 12:00 in
https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 showed
a huge refcount leak. The kernel commit is v6.18-rc4 of linux.git tree.
When is this refcount supposed to be released?

unregister_netdevice: waiting for lo to become free. Usage count = 6659
ref_tracker: netdev@...f88805f84a618 has 6658/6658 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4375 [inline]
     netdev_hold include/linux/netdevice.h:4404 [inline]
     dst_init+0xda/0x580 net/core/dst.c:52
     dst_alloc+0xbb/0x1a0 net/core/dst.c:93
     rt_dst_alloc+0x35/0x3a0 net/ipv4/route.c:1646
     ip_route_input_slow+0x16cb/0x3fa0 net/ipv4/route.c:2424
     ip_route_input_rcu net/ipv4/route.c:2538 [inline]
     ip_route_input_noref+0x120/0x2e0 net/ipv4/route.c:2549
     ip_rcv_finish_core+0x46f/0x2290 net/ipv4/ip_input.c:368
     ip_list_rcv_finish+0x1b8/0x780 net/ipv4/ip_input.c:619
     ip_sublist_rcv net/ipv4/ip_input.c:644 [inline]
     ip_list_rcv+0x335/0x450 net/ipv4/ip_input.c:678
     __netif_receive_skb_list_ptype net/core/dev.c:6122 [inline]
     __netif_receive_skb_list_core+0x752/0x950 net/core/dev.c:6169
     __netif_receive_skb_list net/core/dev.c:6221 [inline]
     netif_receive_skb_list_internal+0x75f/0xdc0 net/core/dev.c:6312
     netif_receive_skb_list net/core/dev.c:6364 [inline]
     netif_receive_skb_list+0x4d/0x4b0 net/core/dev.c:6354
     xdp_recv_frames net/bpf/test_run.c:269 [inline]
     xdp_test_run_batch.constprop.0+0x146b/0x1ad0 net/bpf/test_run.c:350
     bpf_test_run_xdp_live+0x365/0x770 net/bpf/test_run.c:379
     bpf_prog_test_run_xdp+0xd38/0x1660 net/bpf/test_run.c:1320
     bpf_prog_test_run kernel/bpf/syscall.c:4688 [inline]
     __sys_bpf+0x1035/0x4980 kernel/bpf/syscall.c:6167
     __do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
     __se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
     __ia32_sys_bpf+0x76/0xe0 kernel/bpf/syscall.c:6257