[PATCH net 0/2] Fix ref_tracker warnings at boot

[Jiangshan Yi]

This series fixes two ref_tracker warnings that appear at boot on
both TCG and KVM:

  WARNING: lib/ref_tracker.c:322 at ref_tracker_free
  WARNING: lib/ref_tracker.c:246 at ref_tracker_dir_exit

Patch 1 fixes the root cause: pending netdev_work is not canceled
during device unregistration, leaving a stale work_tracker.  When
netdev_work_proc() later runs during the RTNL release window of
netdev_wait_allrefs_any(), it triggers the double-free and leak
warnings.

Patch 2 is a defensive hardening: netdev_put() unconditionally calls
__dev_put() even when ref_tracker_free() returns -EINVAL (double-free),
over-decrementing the device refcount.  While patch 1 prevents the
double-free from occurring in the netdev_work path, patch 2 ensures
that any double-free from any source does not corrupt the refcount.

Tested on KVM (16 vCPU, 8 GB RAM) with KASAN/UBSAN/KFENCE enabled:
  Before: 2 ref_tracker WARNINGs, 80 UBSAN reports
  After:  0 WARNINGs, 53 UBSAN reports (23 network-related fixed)
          0 KASAN, 0 BUG, no regressions

Jiangshan Yi (2):
  net: cancel pending netdev_work on device unregistration
  net: guard refcount against tracker double-free

 include/linux/netdevice.h | 19 ++++++++++++-------
 net/core/dev.c            |  2 +-
 net/core/dev.h            |  2 ++
 net/core/netdev_work.c    | 10 ++++++++++
 4 files changed, 25 insertions(+), 8 deletions(-)

-- 
2.25.1