Re: [syzbot] [net?] WARNING in cleanup_net (2)

[syzbot <syzbot+7e1e1bdb852961150198@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

_sys_unshare+0x31/0x40
[   60.089065][ T5080]  do_syscall_64+0x39/0xb0
[   60.093476][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.099416][ T5080] leaked reference.
[   60.103225][ T5080]  sk_alloc+0x717/0x7f0
[   60.107391][ T5080]  __netlink_create+0x63/0x380
[   60.112349][ T5080]  __netlink_kernel_create+0x114/0x860
[   60.117843][ T5080]  crypto_netlink_init+0x9c/0x120
[   60.122881][ T5080]  ops_init+0xb9/0x6b0
[   60.126951][ T5080]  setup_net+0x5d1/0xc50
[   60.131198][ T5080]  copy_net_ns+0x4ef/0x990
[   60.135615][ T5080]  create_new_namespaces+0x3f6/0xb20
[   60.140898][ T5080]  unshare_nsproxy_namespaces+0xc1/0x1f0
[   60.146532][ T5080]  ksys_unshare+0x449/0x920
[   60.151164][ T5080]  __x64_sys_unshare+0x31/0x40
[   60.155969][ T5080]  do_syscall_64+0x39/0xb0
[   60.160406][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.166329][ T5080] leaked reference.
[   60.170228][ T5080]  sk_alloc+0x717/0x7f0
[   60.174564][ T5080]  inet_create+0x399/0xfa0
[   60.179077][ T5080]  __sock_create+0x380/0x850
[   60.183859][ T5080]  inet_ctl_sock_create+0x8d/0x220
[   60.189007][ T5080]  igmp_net_init+0xd0/0x1b0
[   60.193561][ T5080]  ops_init+0xb9/0x6b0
[   60.197658][ T5080]  setup_net+0x5d1/0xc50
[   60.201917][ T5080]  copy_net_ns+0x4ef/0x990
[   60.206779][ T5080]  create_new_namespaces+0x3f6/0xb20
[   60.212172][ T5080]  unshare_nsproxy_namespaces+0xc1/0x1f0
[   60.217901][ T5080]  ksys_unshare+0x449/0x920
[   60.222502][ T5080]  __x64_sys_unshare+0x31/0x40
[   60.227420][ T5080]  do_syscall_64+0x39/0xb0
[   60.232021][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.238038][ T5080] leaked reference.
[   60.241836][ T5080]  sk_alloc+0x717/0x7f0
[   60.246001][ T5080]  __netlink_create+0x63/0x380
[   60.250780][ T5080]  __netlink_kernel_create+0x114/0x860
[   60.256275][ T5080]  fib_net_init+0x21b/0x3c0
[   60.260822][ T5080]  ops_init+0xb9/0x6b0
[   60.264991][ T5080]  setup_net+0x5d1/0xc50
[   60.269240][ T5080]  copy_net_ns+0x4ef/0x990
[   60.273676][ T5080]  create_new_namespaces+0x3f6/0xb20
[   60.278962][ T5080]  unshare_nsproxy_namespaces+0xc1/0x1f0
[   60.284599][ T5080]  ksys_unshare+0x449/0x920
[   60.289103][ T5080]  __x64_sys_unshare+0x31/0x40
[   60.294136][ T5080]  do_syscall_64+0x39/0xb0
[   60.298561][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.304582][ T5080] leaked reference.
[   60.308472][ T5080]  sk_alloc+0x717/0x7f0
[   60.312637][ T5080]  __netlink_create+0x63/0x380
[   60.317502][ T5080]  __netlink_kernel_create+0x114/0x860
[   60.323005][ T5080]  uevent_net_init+0xfb/0x360
[   60.327693][ T5080]  ops_init+0xb9/0x6b0
[   60.331776][ T5080]  setup_net+0x5d1/0xc50
[   60.336670][ T5080]  copy_net_ns+0x4ef/0x990
[   60.341169][ T5080]  create_new_namespaces+0x3f6/0xb20
[   60.346653][ T5080]  unshare_nsproxy_namespaces+0xc1/0x1f0
[   60.352347][ T5080]  ksys_unshare+0x449/0x920
[   60.356956][ T5080]  __x64_sys_unshare+0x31/0x40
[   60.361933][ T5080]  do_syscall_64+0x39/0xb0
[   60.366386][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.372606][ T5080] leaked reference.
[   60.376436][ T5080]  sk_alloc+0x717/0x7f0
[   60.380606][ T5080]  __netlink_create+0x63/0x380
[   60.385389][ T5080]  __netlink_kernel_create+0x114/0x860
[   60.390890][ T5080]  audit_net_init+0x1b8/0x450
[   60.395770][ T5080]  ops_init+0xb9/0x6b0
[   60.399934][ T5080]  setup_net+0x5d1/0xc50
[   60.404274][ T5080]  copy_net_ns+0x4ef/0x990
[   60.408698][ T5080]  create_new_namespaces+0x3f6/0xb20
[   60.413992][ T5080]  unshare_nsproxy_namespaces+0xc1/0x1f0
[   60.419761][ T5080]  ksys_unshare+0x449/0x920
[   60.424277][ T5080]  __x64_sys_unshare+0x31/0x40
[   60.429041][ T5080]  do_syscall_64+0x39/0xb0
[   60.433541][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.439452][ T5080] leaked reference.
[   60.443257][ T5080]  sk_alloc+0x717/0x7f0
[   60.447508][ T5080]  __netlink_create+0x63/0x380
[   60.452281][ T5080]  __netlink_kernel_create+0x114/0x860
[   60.457852][ T5080]  genl_pernet_init+0xad/0x160
[   60.462721][ T5080]  ops_init+0xb9/0x6b0
[   60.466802][ T5080]  setup_net+0x5d1/0xc50
[   60.471096][ T5080]  copy_net_ns+0x4ef/0x990
[   60.475515][ T5080]  create_new_namespaces+0x3f6/0xb20
[   60.480816][ T5080]  unshare_nsproxy_namespaces+0xc1/0x1f0
[   60.486749][ T5080]  ksys_unshare+0x449/0x920
[   60.491259][ T5080]  __x64_sys_unshare+0x31/0x40
[   60.496026][ T5080]  do_syscall_64+0x39/0xb0
[   60.500447][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.506359][ T5080] leaked reference.
[   60.510169][ T5080]  sk_alloc+0x717/0x7f0
[   60.514334][ T5080]  __netlink_create+0x63/0x380
[   60.519108][ T5080]  __netlink_kernel_create+0x114/0x860
[   60.524631][ T5080]  rtnetlink_net_init+0xbc/0x140
[   60.529576][ T5080]  ops_init+0xb9/0x6b0
[   60.533669][ T5080]  setup_net+0x5d1/0xc50
[   60.537917][ T5080]  copy_net_ns+0x4ef/0x990
[   60.542337][ T5080]  create_new_namespaces+0x3f6/0xb20
[   60.547624][ T5080]  unshare_nsproxy_namespaces+0xc1/0x1f0
[   60.553256][ T5080]  ksys_unshare+0x449/0x920
executing program
[   60.557763][ T5080]  __x64_sys_unshare+0x31/0x40
[   60.562564][ T5080]  do_syscall_64+0x39/0xb0
[   60.567064][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.602770][ T5080] ------------[ cut here ]------------
[   60.608665][ T5080] WARNING: CPU: 0 PID: 5080 at lib/ref_tracker.c:39 ref_tracker_dir_exit+0x3a2/0x600
[   60.618219][ T5080] Modules linked in:
[   60.622147][ T5080] CPU: 0 PID: 5080 Comm: syz-executor.0 Not tainted 6.3.0-rc3-syzkaller-00148-gf33642224e38-dirty #0
[   60.633255][ T5080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
[   60.643391][ T5080] RIP: 0010:ref_tracker_dir_exit+0x3a2/0x600
[   60.649568][ T5080] Code: 0f 84 c3 fe ff ff e8 2d 3d 44 fd 44 89 ff e8 c5 f9 ff ff e9 b1 fe ff ff e8 1b 3d 44 fd 48 8b 74 24 10 4c 89 ef e8 de 99 c6 05 <0f> 0b e8 07 3d 44 fd 49 8d 6d 44 be 04 00 00 00 48 89 ef e8 e6 4e
[   60.669510][ T5080] RSP: 0018:ffffc90003faf9c8 EFLAGS: 00010246
[   60.675617][ T5080] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
[   60.683768][ T5080] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000001
[   60.691917][ T5080] RBP: ffff888023b48210 R08: 0000000000000001 R09: 0000000000000001
[   60.699984][ T5080] R10: fffffbfff1cef7a2 R11: 0000000000094001 R12: ffff888023b48210
[   60.708199][ T5080] R13: ffff888023b481c0 R14: ffff888023b48210 R15: ffff88802a589e48
[   60.716273][ T5080] FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[   60.725599][ T5080] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   60.732293][ T5080] CR2: 0000555559c04160 CR3: 0000000029c85000 CR4: 00000000003506f0
[   60.740532][ T5080] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   60.748686][ T5080] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   60.756820][ T5080] Call Trace:
[   60.760129][ T5080]  <TASK>
[   60.763123][ T5080]  __put_net+0x25/0x80
[   60.767379][ T5080]  __sk_destruct+0x60e/0x770
[   60.772271][ T5080]  __sk_free+0x175/0x460
[   60.776616][ T5080]  sk_free+0x7c/0xa0
[   60.780546][ T5080]  tun_chr_close+0x1df/0x240
[   60.785553][ T5080]  __fput+0x27c/0xa90
[   60.790245][ T5080]  ? __tun_detach+0x1400/0x1400
[   60.795309][ T5080]  task_work_run+0x16f/0x270
[   60.800935][ T5080]  ? task_work_cancel+0x30/0x30
[   60.806925][ T5080]  do_exit+0xad3/0x2960
[   60.811399][ T5080]  ? find_held_lock+0x2d/0x110
[   60.816301][ T5080]  ? get_signal+0x89d/0x25b0
[   60.821047][ T5080]  ? mm_update_next_owner+0x7b0/0x7b0
[   60.826545][ T5080]  ? do_raw_spin_lock+0x124/0x2b0
[   60.831705][ T5080]  ? spin_bug+0x1c0/0x1c0
[   60.836578][ T5080]  do_group_exit+0xd4/0x2a0
[   60.841144][ T5080]  get_signal+0x2315/0x25b0
[   60.845750][ T5080]  ? lockdep_hardirqs_on+0x7d/0x100
[   60.851290][ T5080]  ? exit_signals+0x910/0x910
[   60.856012][ T5080]  ? slab_free_freelist_hook+0x8b/0x1c0
[   60.862100][ T5080]  ? putname+0x102/0x140
[   60.866524][ T5080]  arch_do_signal_or_restart+0x79/0x5c0
[   60.872130][ T5080]  ? get_sigframe_size+0x10/0x10
[   60.877309][ T5080]  ? putname+0x102/0x140
[   60.881790][ T5080]  ? __x64_sys_umount+0x118/0x190
[   60.887118][ T5080]  exit_to_user_mode_prepare+0x15f/0x250
[   60.892903][ T5080]  syscall_exit_to_user_mode+0x1d/0x50
[   60.898430][ T5080]  do_syscall_64+0x46/0xb0
[   60.902969][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.909014][ T5080] RIP: 0033:0x7f669c08d567
[   60.913716][ T5080] Code: Unable to access opcode bytes at 0x7f669c08d53d.
[   60.920796][ T5080] RSP: 002b:00007fffe9735458 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[   60.929995][ T5080] RAX: fffffffffffffffe RBX: 0000000000000003 RCX: 00007f669c08d567
[   60.938218][ T5080] RDX: 00007fffe973552c RSI: 000000000000000a RDI: 00007fffe9735520
[   60.947047][ T5080] RBP: 00007fffe9735520 R08: 00000000ffffffff R09: 00007fffe97352f0
[   60.955920][ T5080] R10: 0000555555e11853 R11: 0000000000000246 R12: 00007f669c0e6b74
[   60.963947][ T5080] R13: 00007fffe97365e0 R14: 0000555555e11810 R15: 00007fffe9736620
[   60.972140][ T5080]  </TASK>
[   60.975349][ T5080] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   60.982626][ T5080] CPU: 0 PID: 5080 Comm: syz-executor.0 Not tainted 6.3.0-rc3-syzkaller-00148-gf33642224e38-dirty #0
[   60.993470][ T5080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
[   61.003796][ T5080] Call Trace:
[   61.007088][ T5080]  <TASK>
[   61.010074][ T5080]  dump_stack_lvl+0xd9/0x150
[   61.014684][ T5080]  panic+0x688/0x730
[   61.018593][ T5080]  ? panic_smp_self_stop+0x90/0x90
[   61.024596][ T5080]  ? show_trace_log_lvl+0x285/0x390
[   61.030052][ T5080]  ? ref_tracker_dir_exit+0x3a2/0x600
[   61.035663][ T5080]  check_panic_on_warn+0xb1/0xc0
[   61.040823][ T5080]  __warn+0xf2/0x390
[   61.044735][ T5080]  ? ref_tracker_dir_exit+0x3a2/0x600
[   61.050157][ T5080]  report_bug+0x2da/0x500
[   61.054588][ T5080]  handle_bug+0x3c/0x70
[   61.058761][ T5080]  exc_invalid_op+0x18/0x50
[   61.063728][ T5080]  asm_exc_invalid_op+0x1a/0x20
[   61.068869][ T5080] RIP: 0010:ref_tracker_dir_exit+0x3a2/0x600
[   61.074898][ T5080] Code: 0f 84 c3 fe ff ff e8 2d 3d 44 fd 44 89 ff e8 c5 f9 ff ff e9 b1 fe ff ff e8 1b 3d 44 fd 48 8b 74 24 10 4c 89 ef e8 de 99 c6 05 <0f> 0b e8 07 3d 44 fd 49 8d 6d 44 be 04 00 00 00 48 89 ef e8 e6 4e
[   61.095761][ T5080] RSP: 0018:ffffc90003faf9c8 EFLAGS: 00010246
[   61.102393][ T5080] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
[   61.110743][ T5080] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000001
[   61.118811][ T5080] RBP: ffff888023b48210 R08: 0000000000000001 R09: 0000000000000001
[   61.126880][ T5080] R10: fffffbfff1cef7a2 R11: 0000000000094001 R12: ffff888023b48210
[   61.134870][ T5080] R13: ffff888023b481c0 R14: ffff888023b48210 R15: ffff88802a589e48
[   61.142890][ T5080]  ? ref_tracker_dir_exit+0x3a2/0x600
[   61.148312][ T5080]  __put_net+0x25/0x80
[   61.154592][ T5080]  __sk_destruct+0x60e/0x770
[   61.160017][ T5080]  __sk_free+0x175/0x460
[   61.164288][ T5080]  sk_free+0x7c/0xa0
[   61.168205][ T5080]  tun_chr_close+0x1df/0x240
[   61.172919][ T5080]  __fput+0x27c/0xa90
[   61.176933][ T5080]  ? __tun_detach+0x1400/0x1400
[   61.181840][ T5080]  task_work_run+0x16f/0x270
[   61.186646][ T5080]  ? task_work_cancel+0x30/0x30
[   61.192320][ T5080]  do_exit+0xad3/0x2960
[   61.196604][ T5080]  ? find_held_lock+0x2d/0x110
[   61.201576][ T5080]  ? get_signal+0x89d/0x25b0
[   61.206271][ T5080]  ? mm_update_next_owner+0x7b0/0x7b0
[   61.211670][ T5080]  ? do_raw_spin_lock+0x124/0x2b0
[   61.216712][ T5080]  ? spin_bug+0x1c0/0x1c0
[   61.221063][ T5080]  do_group_exit+0xd4/0x2a0
[   61.225601][ T5080]  get_signal+0x2315/0x25b0
[   61.230139][ T5080]  ? lockdep_hardirqs_on+0x7d/0x100
[   61.235376][ T5080]  ? exit_signals+0x910/0x910
[   61.240106][ T5080]  ? slab_free_freelist_hook+0x8b/0x1c0
[   61.245774][ T5080]  ? putname+0x102/0x140
[   61.250057][ T5080]  arch_do_signal_or_restart+0x79/0x5c0
[   61.255632][ T5080]  ? get_sigframe_size+0x10/0x10
[   61.260677][ T5080]  ? putname+0x102/0x140
[   61.264951][ T5080]  ? __x64_sys_umount+0x118/0x190
[   61.271995][ T5080]  exit_to_user_mode_prepare+0x15f/0x250
[   61.277824][ T5080]  syscall_exit_to_user_mode+0x1d/0x50
[   61.283329][ T5080]  do_syscall_64+0x46/0xb0
[   61.287765][ T5080]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   61.293679][ T5080] RIP: 0033:0x7f669c08d567
[   61.298195][ T5080] Code: Unable to access opcode bytes at 0x7f669c08d53d.
[   61.305479][ T5080] RSP: 002b:00007fffe9735458 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[   61.313908][ T5080] RAX: fffffffffffffffe RBX: 0000000000000003 RCX: 00007f669c08d567
[   61.321887][ T5080] RDX: 00007fffe973552c RSI: 000000000000000a RDI: 00007fffe9735520
[   61.329889][ T5080] RBP: 00007fffe9735520 R08: 00000000ffffffff R09: 00007fffe97352f0
[   61.337891][ T5080] R10: 0000555555e11853 R11: 0000000000000246 R12: 00007f669c0e6b74
[   61.345873][ T5080] R13: 00007fffe97365e0 R14: 0000555555e11810 R15: 00007fffe9736620
[   61.353876][ T5080]  </TASK>
[   61.357151][ T5080] Kernel Offset: disabled
[   61.361660][ T5080] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs-2/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs-2/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.1"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build737377994=/tmp/go-build -gno-record-gcc-switches"

git status (err=<nil>)
HEAD detached at fbf0499ac
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=fbf0499acc828df26995835e51d83c3a0117e716 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230324-165937'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=fbf0499acc828df26995835e51d83c3a0117e716 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230324-165937'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=fbf0499acc828df26995835e51d83c3a0117e716 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230324-165937'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"fbf0499acc828df26995835e51d83c3a0117e716\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=13254763c80000


Tested on:

commit:         f3364222 ptp_qoriq: fix memory leak in probe()
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=ea09b0836073ee4
dashboard link: https://syzkaller.appspot.com/bug?extid=7e1e1bdb852961150198
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch:          https://syzkaller.appspot.com/x/patch.diff?x=14055c11c80000