Re: [PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

[Jiayuan Chen <jiayuan.chen@linux.dev>]

在 8/27/26 2:56 PM, Eric Dumazet 写道:
> On Thu, Aug 27, 2026 at 7:22 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>> The copy_net_ns() error path tears the net down via net_passive_dec(),
>> which only exits notrefcnt_tracker. refcnt_tracker is exited in
>> __put_net(), which this path never reaches, so it is left alive.
>>
>> Since ref_tracker_dir_init() started registering a debugfs file per
>> dir, that file must be dropped by ref_tracker_dir_exit(). The missing
>> exit leaves the file pointing at the freed net, so reading it walks
>> net->refcnt_tracker.lock and hits a use-after-free.
>>
>> The missing exit has been there all along, but before the debugfs file
>> refcnt_tracker was just an in-memory ledger and empty on this path, so
>> skipping it leaked nothing and did no harm. Only the commit below, which
>> gives every dir a debugfs file, turned it into a use-after-free, so
>> Fixes points there.
>>
>> Exit refcnt_tracker on the failure path.
>>
>> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
>> Reported-by: syzbot+d3f912a2e30e2079a512@syzkaller.appspotmail.com
> Missing `Closes:` tag makes analysis cumbersome.
>
>> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>> ---
>>   net/core/net_namespace.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
>> index a91d2b58aadd..0c3f169d9afb 100644
>> --- a/net/core/net_namespace.c
>> +++ b/net/core/net_namespace.c
>> @@ -591,6 +591,10 @@ struct net *copy_net_ns(u64 flags,
>>                  key_remove_domain(net->key_domain);
>>   #endif
>>                  put_user_ns(user_ns);
>> +               /* setup_net() failure is not routed through __put_net(), so the
>> +                * refcnt_tracker (and its debugfs file) has to be released here.
>> +                */
>> +               ref_tracker_dir_exit(&net->refcnt_tracker);
>>                  net_passive_dec(net);
>>   dec_ucounts:
>>                  dec_net_namespaces(ucounts);
> I am a bit confused. I thought this was already discussed and fixed by
> Tetsuo Handa?
>
> f85dc137aabf ("net: add missing ref_tracker_dir_exit() to net_passive_dec()")
> should be fixing this?


Thanks Eric, now I find it it in net tree. I should anylyze it base net 
tree not net-next.

Please ignore my patch.


pw-bot:cr


>
> Tetsuo also followed up with 3220b62fbb8a  ("net: fix a resource leak
> in copy_net_ns() error handling path").