Re: [PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

[Tetsuo Handa]

On 2026/08/27 15:56, Eric Dumazet wrote:
>> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
>> Reported-by: syzbot+d3f912a2e30e2079a512@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> Missing `Closes:` tag makes analysis cumbersome.

You can derive Closes: tag from the Reported-by: tag.

https://syzkaller.appspot.com/bug?extid=d3f912a2e30e2079a512

> I am a bit confused. I thought this was already discussed and fixed by
> Tetsuo Handa?
> 
> f85dc137aabf ("net: add missing ref_tracker_dir_exit() to net_passive_dec()")
> should be fixing this?

I made this patch based on sashiko's review.
But it turned out that syzbot was already reporting the same problem. ;-)

#syz fix: net: add missing ref_tracker_dir_exit() to net_passive_dec()