[android-common:android14-5.15 28/28] net/netfilter/nf_conntrack_core.c:1660 nf_conntrack_free() error: double free of 'ct' (line 1656)

BCC: [email protected]
CC: [email protected]
TO: [email protected]

tree:   https://android.googlesource.com/kernel/common android14-5.15
head:   ced98912a0d86b6d7c7365664b2df779bf159018
commit: 88ca8a6cd68201e0b3ee0dc7ce4f8a98d9be0d19 [28/28] ANDROID: GKI: net: add vendor hooks for 'struct nf_conn' lifecycle
:::::: branch date: 3 days ago
:::::: commit date: 4 years ago
config: x86_64-randconfig-161-20260717 (https://download.01.org/0day-ci/archive/20260719/[email protected]/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 5c0dfced1adc55429e32b1db08570abd3a219d85)
smatch: v0.5.0-9185-gbcc58b9c

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
net/netfilter/nf_conntrack_core.c:1660 nf_conntrack_free() error: double free of 'ct' (line 1656)

vim +/ct +1660 net/netfilter/nf_conntrack_core.c

9fb9cbb1082d6b Yasuyuki Kozakai        2005-11-09  1644  
c88130bcd546e7 Patrick McHardy         2008-01-31  1645  void nf_conntrack_free(struct nf_conn *ct)
76507f69c44ed1 Patrick McHardy         2008-01-31  1646  {
1d45209d89e647 Eric Dumazet            2009-03-24  1647  	struct net *net = nf_ct_net(ct);
c53bd0e96662c2 Florian Westphal        2021-04-12  1648  	struct nf_conntrack_net *cnet;
1d45209d89e647 Eric Dumazet            2009-03-24  1649  
e53376bef2cd97 Pablo Neira Ayuso       2014-02-03  1650  	/* A freed object has refcnt == 0, that's
5f0d5a3ae7cff0 Paul E. McKenney        2017-01-18  1651  	 * the golden rule for SLAB_TYPESAFE_BY_RCU
e53376bef2cd97 Pablo Neira Ayuso       2014-02-03  1652  	 */
bcba40bd36d705 Florian Westphal        2022-01-07  1653  	WARN_ON(refcount_read(&ct->ct_general.use) != 0);
e53376bef2cd97 Pablo Neira Ayuso       2014-02-03  1654  
ceeff7541e5a4b Patrick McHardy         2008-06-11  1655  	nf_ct_ext_destroy(ct);
0c5366b3a8c77f Florian Westphal        2016-05-09 @1656  	kmem_cache_free(nf_conntrack_cachep, ct);
0418b989a46788 Pablo Neira Ayuso       2021-06-02  1657  	cnet = nf_ct_pernet(net);
c53bd0e96662c2 Florian Westphal        2021-04-12  1658  
4e857c58efeb99 Peter Zijlstra          2014-03-17  1659  	smp_mb__before_atomic();
88ca8a6cd68201 Vignesh Saravanaperumal 2021-07-08 @1660  	trace_android_rvh_nf_conn_free(ct);
c53bd0e96662c2 Florian Westphal        2021-04-12  1661  	atomic_dec(&cnet->count);
76507f69c44ed1 Patrick McHardy         2008-01-31  1662  }
13b18339102052 Patrick McHardy         2006-12-02  1663  EXPORT_SYMBOL_GPL(nf_conntrack_free);
9fb9cbb1082d6b Yasuyuki Kozakai        2005-11-09  1664  
c539f01717c239 Florian Westphal        2013-01-11  1665  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki