Eric Dumazet 4ceb0bd4ff net: better track kernel sockets lifetime ... [ Upstream commit 5c70eb5c59 ] While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device queues, due to skb_set_owner_w() prior calls. This then trigger the following warning from ref_tracker_dir_exit() [1] To fix this, make sure that kernel sockets own a reference on net->passive. Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket is converted to a refcounted one. [1] [ 136.263918][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [ 136.263918][ T35] sk_alloc+0x2b3/0x370 [ 136.263918][ T35] inet6_create+0x6ce/0x10f0 [ 136.263918][ T35] __sock_create+0x4c0/0xa30 [ 136.263918][ T35] inet_ctl_sock_create+0xc2/0x250 [ 136.263918][ T35] igmp6_net_init+0x39/0x390 [ 136.263918][ T35] ops_init+0x31e/0x590 [ 136.263918][ T35] setup_net+0x287/0x9e0 [ 136.263918][ T35] copy_net_ns+0x33f/0x570 [ 136.263918][ T35] create_new_namespaces+0x425/0x7b0 [ 136.263918][ T35] unshare_nsproxy_namespaces+0x124/0x180 [ 136.263918][ T35] ksys_unshare+0x57d/0xa70 [ 136.263918][ T35] __x64_sys_unshare+0x38/0x40 [ 136.263918][ T35] do_syscall_64+0xf3/0x230 [ 136.263918][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.263918][ T35] [ 136.343488][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [ 136.343488][ T35] sk_alloc+0x2b3/0x370 [ 136.343488][ T35] inet6_create+0x6ce/0x10f0 [ 136.343488][ T35] __sock_create+0x4c0/0xa30 [ 136.343488][ T35] inet_ctl_sock_create+0xc2/0x250 [ 136.343488][ T35] ndisc_net_init+0xa7/0x2b0 [ 136.343488][ T35] ops_init+0x31e/0x590 [ 136.343488][ T35] setup_net+0x287/0x9e0 [ 136.343488][ T35] copy_net_ns+0x33f/0x570 [ 136.343488][ T35] create_new_namespaces+0x425/0x7b0 [ 136.343488][ T35] unshare_nsproxy_namespaces+0x124/0x180 [ 136.343488][ T35] ksys_unshare+0x57d/0xa70 [ 136.343488][ T35] __x64_sys_unshare+0x38/0x40 [ 136.343488][ T35] do_syscall_64+0xf3/0x230 [ 136.343488][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 0cafd77dcd ("net: add a refcount tracker for kernel sockets") Reported-by: syzbot+30a19e01a97420719891@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/67b72aeb.050a0220.14d86d.0283.GAE@google.com/T/#u Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://patch.msgid.link/20250220131854.4048077-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-08-20 18:30:56 +02:00
..
auth_gss	gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey	2024-07-08 14:10:06 -04:00
xprtrdma	svcrdma: Unregister the device if svc_rdma_accept() fails	2025-06-27 11:11:16 +01:00
.kunitconfig
addr.c	net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()	2024-02-28 16:18:18 -05:00
auth_null.c
auth_tls.c
auth_unix.c
auth.c	cred: get rid of CONFIG_DEBUG_CREDENTIALS	2023-12-15 14:19:48 -08:00
backchannel_rqst.c	SUNRPC: change the back-channel queue to lwq	2023-10-16 12:44:08 -04:00
cache.c	sunrpc: suppress warnings for unused procfs functions	2025-03-07 18:25:28 +01:00
clnt.c	sunrpc: don't immediately retransmit on seqno miss	2025-07-06 11:01:32 +02:00
debugfs.c
fail.h
Kconfig
Makefile
netns.h
rpc_pipe.c	add a string-to-qstr constructor	2025-07-10 16:05:08 +02:00
rpcb_clnt.c	SUNRPC: rpcbind should never reset the port to the value '0'	2025-05-29 11:02:06 +02:00
sched.c	SUNRPC: Don't allow waiting for exiting tasks	2025-05-29 11:02:03 +02:00
socklib.c
socklib.h
stats.c	sunrpc: use the struct net as the svc proc private	2024-03-01 09:12:09 -05:00
sunrpc_syms.c	net: fill in MODULE_DESCRIPTION()s for Sun RPC	2024-01-11 16:16:08 -08:00
sunrpc.h	SUNRPC: make various functions static, or not exported.	2024-09-01 10:04:56 -04:00
svc_xprt.c	SUNRPC: replace program list with program array	2024-09-23 15:03:30 -04:00
svc.c	sunrpc: handle SVC_GARBAGE during svc auth processing as auth error	2025-06-27 11:11:40 +01:00
svcauth_unix.c	SUNRPC: replace program list with program array	2024-09-23 15:03:30 -04:00
svcauth.c	SUNRPC: add svcauth_map_clnt_to_svc_cred_local	2024-09-23 15:03:30 -04:00
svcsock.c	net: better track kernel sockets lifetime	2025-08-20 18:30:56 +02:00
sysctl.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
sysfs.c
sysfs.h
timer.c
xdr.c
xprt.c	SUNRPC: Add a transport callback to handle dequeuing of an RPC request	2024-02-28 15:00:14 -05:00
xprtmultipath.c	SUNRPC: fix _xprt_switch_find_current_entry logic	2024-01-04 10:47:56 -05:00
xprtsock.c	net: better track kernel sockets lifetime	2025-08-20 18:30:56 +02:00