Eric Dumazet 5c70eb5c59 net: better track kernel sockets lifetime ... While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device queues, due to skb_set_owner_w() prior calls. This then trigger the following warning from ref_tracker_dir_exit() [1] To fix this, make sure that kernel sockets own a reference on net->passive. Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket is converted to a refcounted one. [1] [ 136.263918][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [ 136.263918][ T35] sk_alloc+0x2b3/0x370 [ 136.263918][ T35] inet6_create+0x6ce/0x10f0 [ 136.263918][ T35] __sock_create+0x4c0/0xa30 [ 136.263918][ T35] inet_ctl_sock_create+0xc2/0x250 [ 136.263918][ T35] igmp6_net_init+0x39/0x390 [ 136.263918][ T35] ops_init+0x31e/0x590 [ 136.263918][ T35] setup_net+0x287/0x9e0 [ 136.263918][ T35] copy_net_ns+0x33f/0x570 [ 136.263918][ T35] create_new_namespaces+0x425/0x7b0 [ 136.263918][ T35] unshare_nsproxy_namespaces+0x124/0x180 [ 136.263918][ T35] ksys_unshare+0x57d/0xa70 [ 136.263918][ T35] __x64_sys_unshare+0x38/0x40 [ 136.263918][ T35] do_syscall_64+0xf3/0x230 [ 136.263918][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.263918][ T35] [ 136.343488][ T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at [ 136.343488][ T35] sk_alloc+0x2b3/0x370 [ 136.343488][ T35] inet6_create+0x6ce/0x10f0 [ 136.343488][ T35] __sock_create+0x4c0/0xa30 [ 136.343488][ T35] inet_ctl_sock_create+0xc2/0x250 [ 136.343488][ T35] ndisc_net_init+0xa7/0x2b0 [ 136.343488][ T35] ops_init+0x31e/0x590 [ 136.343488][ T35] setup_net+0x287/0x9e0 [ 136.343488][ T35] copy_net_ns+0x33f/0x570 [ 136.343488][ T35] create_new_namespaces+0x425/0x7b0 [ 136.343488][ T35] unshare_nsproxy_namespaces+0x124/0x180 [ 136.343488][ T35] ksys_unshare+0x57d/0xa70 [ 136.343488][ T35] __x64_sys_unshare+0x38/0x40 [ 136.343488][ T35] do_syscall_64+0xf3/0x230 [ 136.343488][ T35] entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 0cafd77dcd ("net: add a refcount tracker for kernel sockets") Reported-by: syzbot+30a19e01a97420719891@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/67b72aeb.050a0220.14d86d.0283.GAE@google.com/T/#u Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://patch.msgid.link/20250220131854.4048077-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2025-02-21 16:00:58 -08:00
..
acpi	LoongArch changes for v6.14	2025-01-28 08:52:01 -08:00
asm-generic	kbuild: keep symbols for symbol_get() even with CONFIG_TRIM_UNUSED_KSYMS	2025-02-06 01:08:58 +09:00
clocksource	KVM/arm64 updates for 6.14	2025-01-28 09:01:36 -08:00
crypto	crypto: skcipher - document skcipher_walk_done() and rename some vars	2025-01-14 11:38:32 +08:00
cxl	cxl/events: Update Memory Module Event Record to CXL spec rev 3.1	2025-01-13 09:33:21 -07:00
drm	drm: Fix DSC BPP increment decoding	2025-02-13 10:20:30 +02:00
dt-bindings	dt-bindings: clock: qcom: Add CAMCC clocks for QCS8300	2025-02-02 20:59:04 -06:00
hyperv	hyperv: Add new Hyper-V headers in include/hyperv	2025-01-10 00:54:20 +00:00
keys	keys: drop shadowing dead prototype	2025-01-21 11:25:23 +02:00
kunit	linux_kselftest-kunit-6.14-rc1	2025-01-22 12:32:39 -08:00
kvm	Merge branch kvm-arm64/pkvm-memshare-declutter into kvmarm-master/next	2025-01-17 11:05:18 +00:00
linux	Smaller than usual with no fixes from any subtree.	2025-02-20 10:19:54 -08:00
math-emu
media	media: cec: include linux/debugfs.h and linux/seq_file.h where needed	2025-01-07 12:21:38 +01:00
memory
misc
net	net: better track kernel sockets lifetime	2025-02-21 16:00:58 -08:00
pcmcia
ras
rdma	RDMA/core: Support link status events dispatching	2024-12-24 05:22:18 -05:00
rv	rv: Reset per-task monitors also for idle tasks	2025-01-23 12:16:04 -05:00
scsi	Driver core and debugfs updates	2025-01-28 12:25:12 -08:00
soc	soc: driver updates for 6.14	2025-01-24 14:56:59 -08:00
sound	sound updates for 6.14-rc1	2025-01-24 07:54:34 -08:00
target
trace	afs: Give an afs_server object a ref on the afs_cell object it points to	2025-02-21 15:06:29 -08:00
uapi	18 hotfixes. 5 are cc:stable and the remainder address post-6.13 issues	2025-02-19 18:11:28 -08:00
ufs	scsi: ufs: core: Fix use-after free in init error and remove paths	2025-02-03 17:20:01 -05:00
vdso	vdso: Correct typo in PAGE_SHIFT comment	2025-01-15 11:07:08 +01:00
video
xen