netdev - [rdma/siw] unregister_netdevice: waiting for bond0 to become free. Usage count = 3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <30ec01df-6c32-490c-aa26-c41653f5a257@I-love.SAKURA.ne.jp>
Date: Tue, 25 Nov 2025 23:31:28 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: Bernard Metzler <bernard.metzler@...ux.dev>,
        OFED mailing list <linux-rdma@...r.kernel.org>,
        Network Development <netdev@...r.kernel.org>
Subject: [rdma/siw] unregister_netdevice: waiting for bond0 to become free.
 Usage count = 3

Hello.

I am using a debug printk() patch which records/counts where refcount for "struct
net_device" has changed, and syzbot succeeded to record/count a net_device leak
in next-20251121 ( https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 ).

The output from the debug printk() patch is attached (because it has 2500 lines).
You can see that there is one alloc_gid_entry() call in bond0[74] but there is
no corresponding put_gid_ndev() call. I suspect that there is a refcount leak in
"struct ib_gid_table_entry" handling. Where should we check next?

Regards.



unregister_netdevice: waiting for bond0 to become free. Usage count = 3
ref_tracker: netdev@...f888079890628 has 1/1 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4402 [inline]
     netdev_hold include/linux/netdevice.h:4431 [inline]
     ib_device_set_netdev+0x2e1/0x6d0 drivers/infiniband/core/device.c:2253
     siw_device_create drivers/infiniband/sw/siw/siw_main.c:320 [inline]
     siw_newlink+0x400/0xdf0 drivers/infiniband/sw/siw/siw_main.c:426
     nldev_newlink+0x4a5/0x5a0 drivers/infiniband/core/nldev.c:1797
     rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
     rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
     rdma_nl_rcv+0x6ae/0x980 drivers/infiniband/core/netlink.c:259
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg+0x21c/0x270 net/socket.c:746
     ____sys_sendmsg+0x505/0x870 net/socket.c:2634
     ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2688
     __sys_sendmsg net/socket.c:2720 [inline]
     __do_sys_sendmsg net/socket.c:2725 [inline]
     __se_sys_sendmsg net/socket.c:2723 [inline]
     __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2723
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
View attachment "report.txt" of type "text/plain" (150625 bytes)