Re: [PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

[Jiayuan Chen]

在 8/27/26 2:56 PM, Eric Dumazet 写道:
> On Thu, Aug 27, 2026 at 7:22 AM Jiayuan Chen <jiayuan.chen@xxxxxxxxx> wrote:
> > The copy_net_ns() error path tears the net down via net_passive_dec(),
> > which only exits notrefcnt_tracker. refcnt_tracker is exited in
> > __put_net(), which this path never reaches, so it is left alive.
> >
> > Since ref_tracker_dir_init() started registering a debugfs file per
> > dir, that file must be dropped by ref_tracker_dir_exit(). The missing
> > exit leaves the file pointing at the freed net, so reading it walks
> > net->refcnt_tracker.lock and hits a use-after-free.
> >
> > The missing exit has been there all along, but before the debugfs file
> > refcnt_tracker was just an in-memory ledger and empty on this path, so
> > skipping it leaked nothing and did no harm. Only the commit below, which
> > gives every dir a debugfs file, turned it into a use-after-free, so
> > Fixes points there.
> >
> > Exit refcnt_tracker on the failure path.
> >
> > Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
> > Reported-by: syzbot+d3f912a2e30e2079a512@xxxxxxxxxxxxxxxxxxxxxxxxx
> Missing `Closes:` tag makes analysis cumbersome.
>
> > Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
> > ---
> >   net/core/net_namespace.c | 4 ++++
> >   1 file changed, 4 insertions(+)
> >
> > diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
> > index a91d2b58aadd..0c3f169d9afb 100644
> > --- a/net/core/net_namespace.c
> > +++ b/net/core/net_namespace.c
> > @@ -591,6 +591,10 @@ struct net *copy_net_ns(u64 flags,
> >                  key_remove_domain(net->key_domain);
> >   #endif
> >                  put_user_ns(user_ns);
> > +               /* setup_net() failure is not routed through __put_net(), so the
> > +                * refcnt_tracker (and its debugfs file) has to be released here.
> > +                */
> > +               ref_tracker_dir_exit(&net->refcnt_tracker);
> >                  net_passive_dec(net);
> >   dec_ucounts:
> >                  dec_net_namespaces(ucounts);
> I am a bit confused. I thought this was already discussed and fixed by
> Tetsuo Handa?
>
> f85dc137aabf ("net: add missing ref_tracker_dir_exit() to net_passive_dec()")
> should be fixing this?


Thanks Eric, now I find it it in net tree. I should anylyze it base net 
tree not net-next.

Please ignore my patch.


pw-bot:cr


> Tetsuo also followed up with 3220b62fbb8a  ("net: fix a resource leak
> in copy_net_ns() error handling path").