Re: [syzbot] [net?] WARNING in cleanup_net (3)

From: Eric Dumazet
Date: Thu Nov 30 2023 - 04:39:13 EST


On Thu, Nov 30, 2023 at 9:46 AM Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
>
> On Thu, Nov 30, 2023 at 9:42 AM xingwei lee <xrivendell7@xxxxxxxxx> wrote:
> >
> > Hello
> > I reproduced this bug with repro.txt and repro.c
> >
> >
>
>
> Is your syzbot instance ready to accept patches for testing ?
>
> Otherwise, a repro which happens to work 'by luck' might not work for me.
>
> The bug here is a race condition with rds subsystem being dismantled
> at netns dismantle, the 'repro' could be anything really.

Can you test the following patch ?
Thanks.

diff --git a/net/core/sock.c b/net/core/sock.c
index fef349dd72fa735b5915fc03e29cbb155b2aff2c..36d2871ac24f383e4e5d1af1168000f076011aae
100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2197,8 +2197,6 @@ static void __sk_destruct(struct rcu_head *head)

if (likely(sk->sk_net_refcnt))
put_net_track(sock_net(sk), &sk->ns_tracker);
- else
- __netns_tracker_free(sock_net(sk), &sk->ns_tracker, false);

sk_prot_free(sk->sk_prot_creator, sk);
}
@@ -2212,6 +2210,9 @@ void sk_destruct(struct sock *sk)
use_call_rcu = true;
}

+ if (unlikely(!sk->sk_net_refcnt))
+ __netns_tracker_free(sock_net(sk), &sk->ns_tracker, false);
+
if (use_call_rcu)
call_rcu(&sk->sk_rcu, __sk_destruct);
else