WARNING: refcount bug in __sk

WARNING: refcount bug in __sk_destruct
Status: upstream: reported C repro on 2020/03/02 01:33
Reported-by: syzbot+dd803bc0e8adf0003261@syzkaller.appspotmail.com
First crash: 144d, last: 47d

Cause bisection: introduced by (bisect log):

commit 14215108a1fd7e002c0a1f9faf8fbaf41fdda50d
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date: Thu Feb 21 05:37:42 2019 +0000

net_sched: initialize net pointer inside tcf_exts_init()

Crash: WARNING in ex_handler_refcount (log)
Repro: C syz .config

Fix bisection: failed (bisect log)

Sample crash report:

------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 2 PID: 22 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Kernel panic - not syncing: panic_on_warn set ...
CPU: 2 PID: 22 Comm: ksoftirqd/2 Not tainted 5.6.0-rc6-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:221
 __warn.cold+0x2f/0x35 kernel/panic.c:582
 report_bug+0x27b/0x2f0 lib/bug.c:195
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 fixup_bug arch/x86/kernel/traps.c:169 [inline]
 do_error_trap+0x12b/0x220 arch/x86/kernel/traps.c:267
 do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:286
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 0c 06 20 fe e9 8a fe ff ff e8 d2 47 e3 fd 48 c7 c7 00 aa 51 88 c6 05 24 4e d2 06 01 e8 b7 58 b5 fd <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55
RSP: 0018:ffffc90000517c18 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff815c06c1 RDI: fffff520000a2f75
RBP: 0000000000000003 R08: ffff88802c7506c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888000598000
R13: ffff888021fa0040 R14: ffff888021fa0044 R15: ffff88802c7506c0
 refcount_sub_and_test include/linux/refcount.h:261 [inline]
 refcount_dec_and_test include/linux/refcount.h:281 [inline]
 put_net include/net/net_namespace.h:259 [inline]
 __sk_destruct+0x696/0x7c0 net/core/sock.c:1723
 sk_destruct+0xc6/0x100 net/core/sock.c:1739
 __sk_free+0xef/0x3d0 net/core/sock.c:1750
 sk_free+0x78/0xa0 net/core/sock.c:1761
 deferred_put_nlk_sk+0x151/0x2e0 net/netlink/af_netlink.c:729
 rcu_do_batch kernel/rcu/tree.c:2186 [inline]
 rcu_core+0x5a4/0x12d0 kernel/rcu/tree.c:2410
 __do_softirq+0x26c/0x99d kernel/softirq.c:292
 run_ksoftirqd kernel/softirq.c:603 [inline]
 run_ksoftirqd+0x89/0x100 kernel/softirq.c:595
 smpboot_thread_fn+0x653/0x9e0 kernel/smpboot.c:165
 kthread+0x357/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (3):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-qemu-upstream	2020/03/17 15:39	upstream	fb33c651	749688d2	.config	log	report	syz	C	ap420073@gmail.com, davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org, lirongqing@baidu.com, netdev@vger.kernel.org, nikolay@cumulusnetworks.com, penguin-kernel@I-love.SAKURA.ne.jp, tglx@linutronix.de
ci-upstream-net-kasan-gce	2020/01/23 18:19	net-next	fd786fb1	3334d684	.config	log	report	syz	C	andriin@fb.com, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, davem@davemloft.net, edumazet@google.com, hawk@kernel.org, jasowang@redhat.com, john.fastabend@gmail.com, kafai@fb.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, songliubraving@fb.com, yhs@fb.com
ci-upstream-net-this-kasan-gce	2020/01/10 13:42	net	e267371d	4de4e9f0	.config	log	report			davem@davemloft.net, linux-can@vger.kernel.org, linux-kernel@vger.kernel.org, mkl@pengutronix.de, netdev@vger.kernel.org, socketcan@hartkopp.net