Eric Dumazet 4ceb0bd4ff net: better track kernel sockets lifetime ... [ Upstream commit 5c70eb5c59 ] While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device queues, due to skb_set_owner_w() prior calls. This then trigger the following warning from ref_tracker_dir_exit() [1] To fix this, make sure that kernel sockets own a reference on net->passive. Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket is converted to a refcounted one. [1] [ 136.263918][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [ 136.263918][ T35] sk_alloc+0x2b3/0x370 [ 136.263918][ T35] inet6_create+0x6ce/0x10f0 [ 136.263918][ T35] __sock_create+0x4c0/0xa30 [ 136.263918][ T35] inet_ctl_sock_create+0xc2/0x250 [ 136.263918][ T35] igmp6_net_init+0x39/0x390 [ 136.263918][ T35] ops_init+0x31e/0x590 [ 136.263918][ T35] setup_net+0x287/0x9e0 [ 136.263918][ T35] copy_net_ns+0x33f/0x570 [ 136.263918][ T35] create_new_namespaces+0x425/0x7b0 [ 136.263918][ T35] unshare_nsproxy_namespaces+0x124/0x180 [ 136.263918][ T35] ksys_unshare+0x57d/0xa70 [ 136.263918][ T35] __x64_sys_unshare+0x38/0x40 [ 136.263918][ T35] do_syscall_64+0xf3/0x230 [ 136.263918][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.263918][ T35] [ 136.343488][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [ 136.343488][ T35] sk_alloc+0x2b3/0x370 [ 136.343488][ T35] inet6_create+0x6ce/0x10f0 [ 136.343488][ T35] __sock_create+0x4c0/0xa30 [ 136.343488][ T35] inet_ctl_sock_create+0xc2/0x250 [ 136.343488][ T35] ndisc_net_init+0xa7/0x2b0 [ 136.343488][ T35] ops_init+0x31e/0x590 [ 136.343488][ T35] setup_net+0x287/0x9e0 [ 136.343488][ T35] copy_net_ns+0x33f/0x570 [ 136.343488][ T35] create_new_namespaces+0x425/0x7b0 [ 136.343488][ T35] unshare_nsproxy_namespaces+0x124/0x180 [ 136.343488][ T35] ksys_unshare+0x57d/0xa70 [ 136.343488][ T35] __x64_sys_unshare+0x38/0x40 [ 136.343488][ T35] do_syscall_64+0xf3/0x230 [ 136.343488][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 0cafd77dcd ("net: add a refcount tracker for kernel sockets") Reported-by: syzbot+30a19e01a97420719891@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/67b72aeb.050a0220.14d86d.0283.GAE@google.com/T/#u Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://patch.msgid.link/20250220131854.4048077-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-08-20 18:30:56 +02:00
..
auth_gss
xprtrdma	svcrdma: Unregister the device if svc_rdma_accept() fails	2025-06-27 11:11:16 +01:00
.kunitconfig
addr.c
auth_null.c
auth_tls.c
auth_unix.c
auth.c
backchannel_rqst.c
cache.c
clnt.c	sunrpc: don't immediately retransmit on seqno miss	2025-07-06 11:01:32 +02:00
debugfs.c
fail.h
Kconfig
Makefile
netns.h
rpc_pipe.c	add a string-to-qstr constructor	2025-07-10 16:05:08 +02:00
rpcb_clnt.c	SUNRPC: rpcbind should never reset the port to the value '0'	2025-05-29 11:02:06 +02:00
sched.c	SUNRPC: Don't allow waiting for exiting tasks	2025-05-29 11:02:03 +02:00
socklib.c
socklib.h
stats.c
sunrpc_syms.c
sunrpc.h
svc_xprt.c
svc.c	sunrpc: handle SVC_GARBAGE during svc auth processing as auth error	2025-06-27 11:11:40 +01:00
svcauth_unix.c
svcauth.c
svcsock.c	net: better track kernel sockets lifetime	2025-08-20 18:30:56 +02:00
sysctl.c
sysfs.c
sysfs.h
timer.c
xdr.c
xprt.c
xprtmultipath.c
xprtsock.c	net: better track kernel sockets lifetime	2025-08-20 18:30:56 +02:00