[PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

[Jiayuan Chen]

The copy_net_ns() error path tears the net down via net_passive_dec(),
which only exits notrefcnt_tracker. refcnt_tracker is exited in
__put_net(), which this path never reaches, so it is left alive.

Since ref_tracker_dir_init() started registering a debugfs file per
dir, that file must be dropped by ref_tracker_dir_exit(). The missing
exit leaves the file pointing at the freed net, so reading it walks
net->refcnt_tracker.lock and hits a use-after-free.

The missing exit has been there all along, but before the debugfs file
refcnt_tracker was just an in-memory ledger and empty on this path, so
skipping it leaked nothing and did no harm. Only the commit below, which
gives every dir a debugfs file, turned it into a use-after-free, so
Fixes points there.

Exit refcnt_tracker on the failure path.

Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
Reported-by: syzbot+d3f912a2e30e2079a512@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
---
 net/core/net_namespace.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index a91d2b58aadd..0c3f169d9afb 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -591,6 +591,10 @@ struct net *copy_net_ns(u64 flags,
 		key_remove_domain(net->key_domain);
 #endif
 		put_user_ns(user_ns);
+		/* setup_net() failure is not routed through __put_net(), so the
+		 * refcnt_tracker (and its debugfs file) has to be released here.
+		 */
+		ref_tracker_dir_exit(&net->refcnt_tracker);
 		net_passive_dec(net);
 dec_ucounts:
 		dec_net_namespaces(ucounts);
-- 
2.43.0