Re: [PATCH] net: add missing ref_tracker_dir_exit() to net_passive_dec()

On Sun, Aug 16, 2026 at 2:26 PM Tetsuo Handa
<[email protected]> wrote:
>
> I found that trying to read /sys/kernel/debug/ref_tracker/* causes NULL
> pointer dereference crash when alloc_netdev_mqs() via unshare() returned
> NULL, for commit 9ba74e6c9e9d ("net: add networking namespace refcount
> tracker") added ref_tracker_dir_exit(&net->refcnt_tracker) to only
> __put_net() path.
>
> Since preinit_net() calls ref_tracker_dir_init(&net->refcnt_tracker) and
> ref_tracker_dir_init(&net->notrefcnt_tracker), we need to make sure that
> both ref_tracker_dir_exit(&net->refcnt_tracker) and
> ref_tracker_dir_exit(&net->notrefcnt_tracker) are called before
> net_passive_dec() schedules for kmem_cache_free() via net_complete_free().
>
> ref_tracker_dir_exit(&net->refcnt_tracker) is called via put_net() when
> ns_ref_put() returned true. But put_net() is not called when copy_net_ns()
> fails. Therefore, call ref_tracker_dir_exit() from net_passive_dec() if
> put_net() is not yet called.
>
> Analyzed-by: sashiko.dev (no mail address)
> Link: https://sashiko.dev/#/patchset/b06ce35d-e7bc-47a5-8e0a-e82be7e4dd08%40I-love.SAKURA.ne.jp
> Fixes: 9ba74e6c9e9d ("net: add networking namespace refcount tracker")

Note that the crash only became possible when debugfs support was
added to ref_tracker (via Jeff Layton's
patch series: "ref_tracker: add ability to register a debugfs file for
a ref_tracker_dir").

Once ref_tracker_dir_init() started registering entries in debugfs,
failing to call ref_tracker_dir_exit()
left dangling debugfs nodes / state pointing to freed memory after
kmem_cache_free().

Reviewed-by: Eric Dumazet <[email protected]>

> Signed-off-by: Tetsuo Handa <[email protected]>
> ---
>  net/core/net_namespace.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
> index 6e9a0c29a9a0..4915ea7b2374 100644
> --- a/net/core/net_namespace.c
> +++ b/net/core/net_namespace.c
> @@ -530,6 +530,8 @@ void net_passive_dec(struct net *net)
>
>                 /* There should not be any trackers left there. */
>                 ref_tracker_dir_exit(&net->notrefcnt_tracker);
> +               if (!net->refcnt_tracker.dead)
> +                       ref_tracker_dir_exit(&net->refcnt_tracker);
>
>                 /* Wait for an extra rcu_barrier() before final free. */
>                 llist_add(&net->defer_free_list, &defer_free_list);
> --
> 2.55.0
>