syzbot


WARNING: refcount bug in in_dev_finish_destroy

Status: fixed on 2021/11/10 00:50
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 0d7a7b2014b1 ipv6: remove extra dev_hold() for fallback tunnels
First crash: 546d, last: 319d

Cause bisection: introduced by (bisect log) [merge commit]:
commit d64c6f96ba86bd8b97ed8d6762a8c8cc1770d214
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Thu Dec 17 21:45:24 2020 +0000

  Merge tag 'net-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Crash: WARNING: ODEBUG bug in netdev_run_todo (log)
Repro: C syz .config
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: refcount bug in in_dev_finish_destroy (2) 42 301d 316d 22/24 fixed on 2022/03/08 16:11

Sample crash report:
------------[ cut here ]------------
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 1 PID: 19 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Modules linked in:
CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Code: 1d 6a 5a e8 09 31 ff 89 de e8 8d 1a ab fd 84 db 75 e0 e8 d4 13 ab fd 48 c7 c7 a0 e1 c1 89 c6 05 4a 5a e8 09 01 e8 2e 36 fb 04 <0f> 0b eb c4 e8 b8 13 ab fd 0f b6 1d 39 5a e8 09 31 ff 89 de e8 58
RSP: 0018:ffffc90000d97ca8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8880115d54c0 RSI: ffffffff815c51f5 RDI: fffff520001b2f87
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815bdf8e R11: 0000000000000000 R12: ffff8880339aa000
R13: ffff8880339aa568 R14: ffff88804253a9e0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000046dec0 CR3: 000000003342f000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __refcount_dec include/linux/refcount.h:344 [inline]
 refcount_dec include/linux/refcount.h:359 [inline]
 dev_put include/linux/netdevice.h:4135 [inline]
 in_dev_finish_destroy+0x172/0x1b0 net/ipv4/devinet.c:244
 in_dev_put include/linux/inetdevice.h:265 [inline]
 in_dev_rcu_put+0x83/0xb0 net/ipv4/devinet.c:301
 rcu_do_batch kernel/rcu/tree.c:2559 [inline]
 rcu_core+0x74a/0x12f0 kernel/rcu/tree.c:2794
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:345
 run_ksoftirqd kernel/softirq.c:652 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:644
 smpboot_thread_fn+0x655/0x9e0 kernel/smpboot.c:165
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Crashes (463):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-net-kasan-gce 2021/03/27 19:38 net-next a1281601f88e a8529b82 .config log report syz C WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/03/27 14:28 bpf-next 36e798516078 a8529b82 .config log report syz C WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/27 11:44 net-next a1281601f88e a8529b82 .config log report syz C WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/29 01:14 net-next a1281601f88e a8529b82 .config log report syz WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/03/28 01:01 bpf-next 36e798516078 a8529b82 .config log report syz WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/27 21:06 net-next a1281601f88e a8529b82 .config log report syz WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/27 14:09 net-next a1281601f88e a8529b82 .config log report syz WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-linux-next-kasan-gce-root 2021/03/27 15:25 linux-next 931294922e65 a8529b82 .config log report syz WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-this-kasan-gce 2021/11/09 10:37 net c45231a7668d 8ab17e57 .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-this-kasan-gce 2021/11/09 06:07 net c45231a7668d 8ab17e57 .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-this-kasan-gce 2021/11/07 15:19 net 70bf363d7adb 4c1be0be .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-this-kasan-gce 2021/11/07 12:45 net 70bf363d7adb 4c1be0be .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-this-kasan-gce 2021/11/07 09:24 net 70bf363d7adb 4c1be0be .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-this-kasan-gce 2021/11/07 00:11 net 70bf363d7adb 4c1be0be .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-this-kasan-gce 2021/11/06 15:24 net 70bf363d7adb 4c1be0be .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/02 22:28 bpf-next 89d69c5d0fbc 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/02 21:05 bpf-next 89d69c5d0fbc 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/02 19:35 bpf-next 89d69c5d0fbc 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/02 18:31 bpf-next 89d69c5d0fbc 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/02 12:57 bpf-next 89d69c5d0fbc 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/02 08:09 bpf-next 89d69c5d0fbc 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/02 06:38 bpf-next 89d69c5d0fbc 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/02 04:23 bpf-next 89d69c5d0fbc 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/01 19:31 bpf-next 89d69c5d0fbc 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/01 17:53 bpf-next e27bfefb21f2 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/01 16:15 bpf-next e27bfefb21f2 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/01 13:22 bpf-next e27bfefb21f2 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/01 07:10 bpf-next e27bfefb21f2 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/01 05:49 bpf-next e27bfefb21f2 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/04/01 04:39 bpf-next 235fc0e36d35 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/03/31 23:57 bpf-next 235fc0e36d35 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/03/31 22:37 bpf-next 235fc0e36d35 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/03/31 21:30 bpf-next 235fc0e36d35 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 20:17 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 19:05 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 18:02 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 16:37 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 15:46 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/03/31 14:43 bpf-next 235fc0e36d35 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 13:19 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/03/31 11:54 bpf-next 2976706f3408 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 10:07 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 08:53 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 07:55 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 06:28 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 04:17 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 03:16 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 02:49 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/31 00:19 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/30 21:18 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/30 20:19 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/03/30 18:58 bpf-next 7aae231ac93b 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/30 17:52 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-net-kasan-gce 2021/03/30 16:49 net-next 37f368d8d09d 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-bpf-next-kasan-gce 2021/03/27 06:53 bpf-next 36e798516078 a8529b82 .config log report info WARNING: refcount bug in in_dev_finish_destroy
ci-upstream-linux-next-kasan-gce-root 2021/03/30 22:26 linux-next 931294922e65 6a81331a .config log report info WARNING: refcount bug in in_dev_finish_destroy
* Struck through repros no longer work on HEAD.