Re: [PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

[Eric Dumazet]

On Thu, Aug 27, 2026 at 7:22 AM Jiayuan Chen <jiayuan.chen@xxxxxxxxx> wrote:
>
> The copy_net_ns() error path tears the net down via net_passive_dec(),
> which only exits notrefcnt_tracker. refcnt_tracker is exited in
> __put_net(), which this path never reaches, so it is left alive.
>
> Since ref_tracker_dir_init() started registering a debugfs file per
> dir, that file must be dropped by ref_tracker_dir_exit(). The missing
> exit leaves the file pointing at the freed net, so reading it walks
> net->refcnt_tracker.lock and hits a use-after-free.
>
> The missing exit has been there all along, but before the debugfs file
> refcnt_tracker was just an in-memory ledger and empty on this path, so
> skipping it leaked nothing and did no harm. Only the commit below, which
> gives every dir a debugfs file, turned it into a use-after-free, so
> Fixes points there.
>
> Exit refcnt_tracker on the failure path.
>
> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
> Reported-by: syzbot+d3f912a2e30e2079a512@xxxxxxxxxxxxxxxxxxxxxxxxx

Missing `Closes:` tag makes analysis cumbersome.

> Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
> ---
>  net/core/net_namespace.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
> index a91d2b58aadd..0c3f169d9afb 100644
> --- a/net/core/net_namespace.c
> +++ b/net/core/net_namespace.c
> @@ -591,6 +591,10 @@ struct net *copy_net_ns(u64 flags,
>                 key_remove_domain(net->key_domain);
>  #endif
>                 put_user_ns(user_ns);
> +               /* setup_net() failure is not routed through __put_net(), so the
> +                * refcnt_tracker (and its debugfs file) has to be released here.
> +                */
> +               ref_tracker_dir_exit(&net->refcnt_tracker);
>                 net_passive_dec(net);
>  dec_ucounts:
>                 dec_net_namespaces(ucounts);

I am a bit confused. I thought this was already discussed and fixed by
Tetsuo Handa?

f85dc137aabf ("net: add missing ref_tracker_dir_exit() to net_passive_dec()")
should be fixing this?

Tetsuo also followed up with 3220b62fbb8a  ("net: fix a resource leak
in copy_net_ns() error handling path").