syzbot


WARNING: refcount bug in netdev_queue_update_kobjects

Status: closed as invalid on 2021/12/14 20:02
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 389d, last: 375d

Sample crash report:
team0 (unregistering): Port device team_slave_0 removed
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
------------[ cut here ]------------
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 0 PID: 30866 at lib/refcount.c:31 refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31
Modules linked in:
CPU: 0 PID: 30866 Comm: kworker/u4:22 Not tainted 5.16.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31
Code: d5 8a 31 c0 e8 c5 43 38 fd 0f 0b e9 64 ff ff ff e8 19 6a 6e fd c6 05 94 38 d5 09 01 48 c7 c7 80 02 d5 8a 31 c0 e8 a4 43 38 fd <0f> 0b e9 43 ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a2 fe ff
RSP: 0018:ffffc90004c677c0 EFLAGS: 00010246
RAX: 5e92940694b8c400 RBX: 0000000000000004 RCX: ffff888023290000
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000004 R08: ffffffff8169fd72 R09: ffffed1017344f2c
R10: ffffed1017344f2c R11: 0000000000000000 R12: ffffffff8c5c5848
R13: ffff8880763b8018 R14: ffff8880145da850 R15: 1ffff1100ec77003
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9e6993e000 CR3: 0000000070994000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kobject_cleanup+0x1c0/0x280 lib/kobject.c:705
 netdev_queue_update_kobjects+0x3c2/0x430 net/core/net-sysfs.c:1725
 remove_queue_kobjects net/core/net-sysfs.c:1822 [inline]
 netdev_unregister_kobject+0x100/0x1b0 net/core/net-sysfs.c:1972
 unregister_netdevice_many+0x148b/0x19e0 net/core/dev.c:11104
 default_device_exit_batch+0x44b/0x4b0 net/core/dev.c:11607
 ops_exit_list net/core/net_namespace.c:171 [inline]
 cleanup_net+0x7ec/0xc50 net/core/net_namespace.c:593
 process_one_work+0x853/0x1140 kernel/workqueue.c:2298
 worker_thread+0xac1/0x1320 kernel/workqueue.c:2445
 kthread+0x468/0x490 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30
 </TASK>

Crashes (4):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2021/11/25 17:55 upstream 5f53fa508db0 63eeac02 .config log report info WARNING: refcount bug in netdev_queue_update_kobjects
ci-upstream-kasan-gce-smack-root 2021/11/18 09:32 upstream 42eb8fdac2fc cafff8b6 .config log report info WARNING: refcount bug in netdev_queue_update_kobjects
ci-upstream-kasan-gce-smack-root 2021/11/16 13:08 upstream 8ab774587903 600426bd .config log report info WARNING: refcount bug in netdev_queue_update_kobjects
ci-upstream-kasan-gce-smack-root 2021/11/12 00:41 upstream 5833291ab6de 75b04091 .config log report info WARNING: refcount bug in netdev_queue_update_kobjects
* Struck through repros no longer work on HEAD.