Re: [PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()
From: Eric Dumazet <edumazet@google.com>
Date: 2026-08-17 05:36:48
On Sun, Aug 16, 2026 at 2:26 PM Tetsuo Handa [off-list ref] wrote:
I found that trying to read /sys/kernel/debug/ref_tracker/* causes NULL
pointer dereference crash when alloc_netdev_mqs() via unshare() returned
NULL, for commit 9ba74e6c9e9d ("net: add networking namespace refcount
tracker") added ref_tracker_dir_exit(&net->refcnt_tracker) to only
__put_net() path.
Since preinit_net() calls ref_tracker_dir_init(&net->refcnt_tracker) and
ref_tracker_dir_init(&net->notrefcnt_tracker), we need to make sure that
both ref_tracker_dir_exit(&net->refcnt_tracker) and
ref_tracker_dir_exit(&net->notrefcnt_tracker) are called before
net_passive_dec() schedules for kmem_cache_free() via net_complete_free().
ref_tracker_dir_exit(&net->refcnt_tracker) is called via put_net() when
ns_ref_put() returned true. But put_net() is not called when copy_net_ns()
fails. Therefore, call ref_tracker_dir_exit() from net_passive_dec() if
put_net() is not yet called.
Analyzed-by: sashiko.dev (no mail address)
Link: https://sashiko.dev/#/patchset/b06ce35d-e7bc-47a5-8e0a-e82be7e4dd08%40I-love.SAKURA.ne.jp
Fixes: 9ba74e6c9e9d ("net: add networking namespace refcount tracker")Note that the crash only became possible when debugfs support was added to ref_tracker (via Jeff Layton's patch series: "ref_tracker: add ability to register a debugfs file for a ref_tracker_dir"). Once ref_tracker_dir_init() started registering entries in debugfs, failing to call ref_tracker_dir_exit() left dangling debugfs nodes / state pointing to freed memory after kmem_cache_free(). Reviewed-by: Eric Dumazet <edumazet@google.com>
quoted hunk ↗ jump to hunk
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> --- net/core/net_namespace.c | 2 ++ 1 file changed, 2 insertions(+)diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index 6e9a0c29a9a0..4915ea7b2374 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c@@ -530,6 +530,8 @@ void net_passive_dec(struct net *net) /* There should not be any trackers left there. */ ref_tracker_dir_exit(&net->notrefcnt_tracker); + if (!net->refcnt_tracker.dead) + ref_tracker_dir_exit(&net->refcnt_tracker); /* Wait for an extra rcu_barrier() before final free. */ llist_add(&net->defer_free_list, &defer_free_list); --2.55.0