WARNING: refcount bug in __sk_destruct

Status: auto-obsoleted due to no activity on 2022/09/09 05:05
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+dd803bc0e8adf0003261@syzkaller.appspotmail.com
First crash: 2391d, last: 2242d
Cause bisection: introduced by (bisect log) :
commit 14215108a1fd7e002c0a1f9faf8fbaf41fdda50d
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date: Thu Feb 21 05:37:42 2019 +0000

  net_sched: initialize net pointer inside tcf_exts_init()

Crash: WARNING in ex_handler_refcount (log)
Repro: C syz .config
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
WARNING: refcount bug in __sk_destruct 3 (4) 2020/03/02 02:49
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2022/09/09 01:27 17m retest repro net-next-old OK log
2022/08/30 18:27 19m retest repro upstream OK log
2022/08/30 17:27 19m retest repro upstream OK log
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2020/05/17 02:10 0m bisect fix net-next-old error job log
2020/04/16 21:12 20m bisect fix net-next-old OK (0) job log log
2020/03/14 09:12 19m bisect fix net-next-old OK (0) job log log

Sample crash report:
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 2 PID: 22 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Kernel panic - not syncing: panic_on_warn set ...
CPU: 2 PID: 22 Comm: ksoftirqd/2 Not tainted 5.6.0-rc6-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:221
 __warn.cold+0x2f/0x35 kernel/panic.c:582
 report_bug+0x27b/0x2f0 lib/bug.c:195
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 fixup_bug arch/x86/kernel/traps.c:169 [inline]
 do_error_trap+0x12b/0x220 arch/x86/kernel/traps.c:267
 do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:286
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 0c 06 20 fe e9 8a fe ff ff e8 d2 47 e3 fd 48 c7 c7 00 aa 51 88 c6 05 24 4e d2 06 01 e8 b7 58 b5 fd <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55
RSP: 0018:ffffc90000517c18 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff815c06c1 RDI: fffff520000a2f75
RBP: 0000000000000003 R08: ffff88802c7506c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888000598000
R13: ffff888021fa0040 R14: ffff888021fa0044 R15: ffff88802c7506c0
 refcount_sub_and_test include/linux/refcount.h:261 [inline]
 refcount_dec_and_test include/linux/refcount.h:281 [inline]
 put_net include/net/net_namespace.h:259 [inline]
 __sk_destruct+0x696/0x7c0 net/core/sock.c:1723
 sk_destruct+0xc6/0x100 net/core/sock.c:1739
 __sk_free+0xef/0x3d0 net/core/sock.c:1750
 sk_free+0x78/0xa0 net/core/sock.c:1761
 deferred_put_nlk_sk+0x151/0x2e0 net/netlink/af_netlink.c:729
 rcu_do_batch kernel/rcu/tree.c:2186 [inline]
 rcu_core+0x5a4/0x12d0 kernel/rcu/tree.c:2410
 __do_softirq+0x26c/0x99d kernel/softirq.c:292
 run_ksoftirqd kernel/softirq.c:603 [inline]
 run_ksoftirqd+0x89/0x100 kernel/softirq.c:595
 smpboot_thread_fn+0x653/0x9e0 kernel/smpboot.c:165
 kthread+0x357/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/17 15:39 upstream fb33c6510d55 749688d2 .config console log report syz C ci-qemu-upstream
2020/06/07 04:39 upstream 435faf5c218a e6b89e4e .config console log report syz C ci-qemu-upstream-386
2020/01/23 18:19 net-next-old fd786fb1d2ca 3334d684 .config console log report syz C ci-upstream-net-kasan-gce
2020/01/10 13:42 net-old e267371dd376 4de4e9f0 .config console log report ci-upstream-net-this-kasan-gce
* Struck through repros no longer work on HEAD.