Re: [syzbot] [sctp?] WARNING: refcount bug in sctp_transport_put (6)

[Xin Long]

On Mon, Aug 31, 2026 at 11:47 PM xietangxin <xietangxin@xxxxxxxxxxxxxx> wrote:
>
> Hi,
>
> I have analyzed this issue and successfully reproduced locally.
> The race occurs between the timer callback (`sctp_generate_heartbeat_event`) and
> the transport cleanup path (`sctp_transport_free`):
>
> Task 1(Timer Softirq)               Task 2(sctp_transport_free)
> ==========================              ===============================
> sctp_generate_heartbeat_event()
>   refcnt = 2
>
>   bh_lock_sock(sk)
>   sock_owned_by_user(sk)
>   mod_timer(&hb_timer) -> returns 0
>                                           sctp_transport_free()
>                                             transport->dead = 1
>                                             del_timer(&hb_timer) -> returns 1!
>                                               sctp_transport_put() (2 -> 1)
>                                             sctp_transport_put() (1 -> 0)
>                                               sctp_transport_destroy()
>
>   sctp_transport_hold()
>     -> refcnt is 0, increment fails

This should not be 0, as the transport must hold a refcnt to start the
hb_timer.

Also, the delay below is under bh_lock_sock(), so it should not be the
real cause of the issue.

Could you share the PoC for this issue?

Thanks.

>   out_unlock:
>     sctp_transport_put() (0 -> -1)
>     -> refcount underflow warning!
>
>
>
> Adding a small delay  after `mod_timer()` increases the reproduction rate:
>
> --- a/net/sctp/sm_sideeffect.c
> +++ b/net/sctp/sm_sideeffect.c
> @@ -373,8 +373,10 @@ void sctp_generate_heartbeat_event(struct timer_list *t)
>                 pr_debug("%s: sock is busy\n", __func__);
>
>                 /* Try again later.  */
> -               if (!mod_timer(&transport->hb_timer, jiffies + (HZ/20)))
> +               if (!mod_timer(&transport->hb_timer, jiffies + (HZ/20))) {
> +                       mdelay(1);
>                         sctp_transport_hold(transport);
> +               }
>                 goto out_unlock;
>         }
>
> Any feedback or guidance would be greatly appreciated.
>
> --
> Best regards,
> Tangxin Xie
>