[PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()

[PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()

[Tetsuo Handa]

I found that trying to read /sys/kernel/debug/ref_tracker/* causes NULL
pointer dereference crash when alloc_netdev_mqs() via unshare() returned
NULL, for commit 9ba74e6c9e9d ("net: add networking namespace refcount
tracker") added ref_tracker_dir_exit(&net->refcnt_tracker) to only
__put_net() path.

Since preinit_net() calls ref_tracker_dir_init(&net->refcnt_tracker) and
ref_tracker_dir_init(&net->notrefcnt_tracker), we need to make sure that
both ref_tracker_dir_exit(&net->refcnt_tracker) and
ref_tracker_dir_exit(&net->notrefcnt_tracker) are called before
net_passive_dec() schedules for kmem_cache_free() via net_complete_free().

ref_tracker_dir_exit(&net->refcnt_tracker) is called via put_net() when
ns_ref_put() returned true. But put_net() is not called when copy_net_ns()
fails. Therefore, call ref_tracker_dir_exit() from net_passive_dec() if
put_net() is not yet called.

Analyzed-by: sashiko.dev (no mail address)
Link: https://sashiko.dev/#/patchset/b06ce35d-e7bc-47a5-8e0a-e82be7e4dd08%40I-love.SAKURA.ne.jp
Fixes: 9ba74e6c9e9d ("net: add networking namespace refcount tracker")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
 net/core/net_namespace.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 6e9a0c29a9a0..4915ea7b2374 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -530,6 +530,8 @@ void net_passive_dec(struct net *net)
 
 		/* There should not be any trackers left there. */
 		ref_tracker_dir_exit(&net->notrefcnt_tracker);
+		if (!net->refcnt_tracker.dead)
+			ref_tracker_dir_exit(&net->refcnt_tracker);
 
 		/* Wait for an extra rcu_barrier() before final free. */
 		llist_add(&net->defer_free_list, &defer_free_list);
-- 
2.55.0

Re: [PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()

[Eric Dumazet]

On Sun, Aug 16, 2026 at 2:26 PM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
>
> I found that trying to read /sys/kernel/debug/ref_tracker/* causes NULL
> pointer dereference crash when alloc_netdev_mqs() via unshare() returned
> NULL, for commit 9ba74e6c9e9d ("net: add networking namespace refcount
> tracker") added ref_tracker_dir_exit(&net->refcnt_tracker) to only
> __put_net() path.
>
> Since preinit_net() calls ref_tracker_dir_init(&net->refcnt_tracker) and
> ref_tracker_dir_init(&net->notrefcnt_tracker), we need to make sure that
> both ref_tracker_dir_exit(&net->refcnt_tracker) and
> ref_tracker_dir_exit(&net->notrefcnt_tracker) are called before
> net_passive_dec() schedules for kmem_cache_free() via net_complete_free().
>
> ref_tracker_dir_exit(&net->refcnt_tracker) is called via put_net() when
> ns_ref_put() returned true. But put_net() is not called when copy_net_ns()
> fails. Therefore, call ref_tracker_dir_exit() from net_passive_dec() if
> put_net() is not yet called.
>
> Analyzed-by: sashiko.dev (no mail address)
> Link: https://sashiko.dev/#/patchset/b06ce35d-e7bc-47a5-8e0a-e82be7e4dd08%40I-love.SAKURA.ne.jp
> Fixes: 9ba74e6c9e9d ("net: add networking namespace refcount tracker")

Note that the crash only became possible when debugfs support was
added to ref_tracker (via Jeff Layton's
patch series: "ref_tracker: add ability to register a debugfs file for
a ref_tracker_dir").

Once ref_tracker_dir_init() started registering entries in debugfs,
failing to call ref_tracker_dir_exit()
left dangling debugfs nodes / state pointing to freed memory after
kmem_cache_free().

Reviewed-by: Eric Dumazet <edumazet@google.com>

> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> ---
>  net/core/net_namespace.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
> index 6e9a0c29a9a0..4915ea7b2374 100644
> --- a/net/core/net_namespace.c
> +++ b/net/core/net_namespace.c
> @@ -530,6 +530,8 @@ void net_passive_dec(struct net *net)
>
>                 /* There should not be any trackers left there. */
>                 ref_tracker_dir_exit(&net->notrefcnt_tracker);
> +               if (!net->refcnt_tracker.dead)
> +                       ref_tracker_dir_exit(&net->refcnt_tracker);
>
>                 /* Wait for an extra rcu_barrier() before final free. */
>                 llist_add(&net->defer_free_list, &defer_free_list);
> --
> 2.55.0
>

Re: [PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()

[kernel test robot]

:::::: 
:::::: Manual check reason: "linux-review patch is more than 7 days old, verify it wasn't already superseded"
:::::: 

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <af7dabf3-d0d7-46dc-a878-e1715b3c9ac6@I-love.SAKURA.ne.jp>
References: <af7dabf3-d0d7-46dc-a878-e1715b3c9ac6@I-love.SAKURA.ne.jp>
TO: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
TO: Eric Dumazet <edumazet@google.com>
TO: Jakub Kicinski <kuba@kernel.org>
TO: Network Development <netdev@vger.kernel.org>

Hi Tetsuo,

kernel test robot noticed the following build errors:

[auto build test ERROR on net-next/main]
[also build test ERROR on linus/master horms-ipvs/master v7.2]
[cannot apply to net/main next-20260821]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Tetsuo-Handa/net-add-missing-ref_tracker_dir_exit-to-net_passive_dec/20260816-212649
base:   net-next/main
patch link:    https://lore.kernel.org/r/af7dabf3-d0d7-46dc-a878-e1715b3c9ac6%40I-love.SAKURA.ne.jp
patch subject: [PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()
:::::: branch date: 22 hours ago
:::::: commit date: 22 hours ago
config: alpha-defconfig (https://download.01.org/0day-ci/archive/20260825/202608251243.dC6F8tYQ-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260825/202608251243.dC6F8tYQ-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/r/202608251243.dC6F8tYQ-lkp@intel.com/

All errors (new ones prefixed by >>):

   net/core/net_namespace.c: In function 'net_passive_dec':
>> net/core/net_namespace.c:541:41: error: 'struct ref_tracker_dir' has no member named 'dead'
     541 |                 if (!net->refcnt_tracker.dead)
         |                                         ^


vim +541 net/core/net_namespace.c

0f6ede9fbc747e Eric Dumazet       2024-12-04  533  
e57a6320215c39 Kuniyuki Iwashima  2025-02-17  534  void net_passive_dec(struct net *net)
486a87f1e56240 Daniel Lezcano     2009-02-22  535  {
41467d2ff4dfe1 Yajun Deng         2021-08-17  536  	if (refcount_dec_and_test(&net->passive)) {
416c51e17b8b31 Eric Dumazet       2014-09-09  537  		kfree(rcu_access_pointer(net->gen));
0cafd77dcd032d Eric Dumazet       2022-10-20  538  
0cafd77dcd032d Eric Dumazet       2022-10-20  539  		/* There should not be any trackers left there. */
0cafd77dcd032d Eric Dumazet       2022-10-20  540  		ref_tracker_dir_exit(&net->notrefcnt_tracker);
08b1eada860370 Tetsuo Handa       2026-08-16 @541  		if (!net->refcnt_tracker.dead)
08b1eada860370 Tetsuo Handa       2026-08-16  542  			ref_tracker_dir_exit(&net->refcnt_tracker);
0cafd77dcd032d Eric Dumazet       2022-10-20  543  
0f6ede9fbc747e Eric Dumazet       2024-12-04  544  		/* Wait for an extra rcu_barrier() before final free. */
0f6ede9fbc747e Eric Dumazet       2024-12-04  545  		llist_add(&net->defer_free_list, &defer_free_list);
45a19b0a725a04 Johann Felix Soden 2007-11-07  546  	}
41467d2ff4dfe1 Yajun Deng         2021-08-17  547  }
45a19b0a725a04 Johann Felix Soden 2007-11-07  548  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()

[kernel test robot]

:::::: 
:::::: Manual check reason: "linux-review patch is more than 7 days old, verify it wasn't already superseded"
:::::: 

BCC: lkp@intel.com
CC: llvm@lists.linux.dev
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <af7dabf3-d0d7-46dc-a878-e1715b3c9ac6@I-love.SAKURA.ne.jp>
References: <af7dabf3-d0d7-46dc-a878-e1715b3c9ac6@I-love.SAKURA.ne.jp>
TO: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
TO: Eric Dumazet <edumazet@google.com>
TO: Jakub Kicinski <kuba@kernel.org>
TO: Network Development <netdev@vger.kernel.org>

Hi Tetsuo,

kernel test robot noticed the following build errors:

[auto build test ERROR on net-next/main]
[also build test ERROR on linus/master v7.2]
[cannot apply to net/main next-20260821]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Tetsuo-Handa/net-add-missing-ref_tracker_dir_exit-to-net_passive_dec/20260816-212649
base:   net-next/main
patch link:    https://lore.kernel.org/r/af7dabf3-d0d7-46dc-a878-e1715b3c9ac6%40I-love.SAKURA.ne.jp
patch subject: [PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()
:::::: branch date: 24 hours ago
:::::: commit date: 24 hours ago
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20260825/202608251419.KDzuLP1i-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 771bdfdab2d66a4eb85b8ea7673cfa30152718b1)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260825/202608251419.KDzuLP1i-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/r/202608251419.KDzuLP1i-lkp@intel.com/

All errors (new ones prefixed by >>):

>> net/core/net_namespace.c:541:28: error: no member named 'dead' in 'struct ref_tracker_dir'
     541 |                 if (!net->refcnt_tracker.dead)
         |                      ~~~~~~~~~~~~~~~~~~~ ^
   net/core/net_namespace.c:52:13: warning: variable 'init_net_initialized' set but not used [-Wunused-but-set-global]
      52 | static bool init_net_initialized;
         |             ^
   1 warning and 1 error generated.


vim +541 net/core/net_namespace.c

0f6ede9fbc747e2 Eric Dumazet       2024-12-04  533  
e57a6320215c396 Kuniyuki Iwashima  2025-02-17  534  void net_passive_dec(struct net *net)
486a87f1e562409 Daniel Lezcano     2009-02-22  535  {
41467d2ff4dfe18 Yajun Deng         2021-08-17  536  	if (refcount_dec_and_test(&net->passive)) {
416c51e17b8b31b Eric Dumazet       2014-09-09  537  		kfree(rcu_access_pointer(net->gen));
0cafd77dcd032d1 Eric Dumazet       2022-10-20  538  
0cafd77dcd032d1 Eric Dumazet       2022-10-20  539  		/* There should not be any trackers left there. */
0cafd77dcd032d1 Eric Dumazet       2022-10-20  540  		ref_tracker_dir_exit(&net->notrefcnt_tracker);
08b1eada8603705 Tetsuo Handa       2026-08-16 @541  		if (!net->refcnt_tracker.dead)
08b1eada8603705 Tetsuo Handa       2026-08-16  542  			ref_tracker_dir_exit(&net->refcnt_tracker);
0cafd77dcd032d1 Eric Dumazet       2022-10-20  543  
0f6ede9fbc747e2 Eric Dumazet       2024-12-04  544  		/* Wait for an extra rcu_barrier() before final free. */
0f6ede9fbc747e2 Eric Dumazet       2024-12-04  545  		llist_add(&net->defer_free_list, &defer_free_list);
45a19b0a725a04f Johann Felix Soden 2007-11-07  546  	}
41467d2ff4dfe18 Yajun Deng         2021-08-17  547  }
45a19b0a725a04f Johann Felix Soden 2007-11-07  548  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki