On Fri, 15 Jul 2022 17:59:06 +0200 Bernard f6bvp wrote:
> Here is the context.
>
> This patch adds dev_put(dev) in order to allow removal of rose module
> after use of AX25 and ROSE via rose0 device.
>
> Otherwise when trying to remove rose module via rmmod rose an infinite
> loop message was displayed on all consoles with xx being a random number.
>
> unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
>
> unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
>
> ...
>
> With the patch it is ok to rmmod rose.
>
> This bug appeared with kernel 4.10 and was tentatively repaired five
> years ago.
Please try resending with git send-email.
Your current email contains HTML so it won't make it to netdev@
and other vger lists.
> *Subject: [BUG] unregistered netdevice: wainting for rose0 to become
> free. Usage count = xx <https://marc.info/?t=148811830800001&r=1&w=2>
> From: f6bvp <f6bvp () free ! fr>
> <https://marc.info/?a=128152583500001&r=1&w=2> Date: 2017-02-26 14:09:08
> <https://marc.info/?l=linux-hams&r=1&w=2&b=201702> Message-ID:
> ce03a972-a3b0-ca24-5195-2fe2fd5c44d3 () free ! fr
> <https://marc.info/?i=ce03a972-a3b0-ca24-5195-2fe2fd5c44d3%20()%20free%20!%20fr>*
>
>
> Since then the bug reamains.
Is it possible to use a link to the lore.kernel.org archive? It's the
most common way of referring to past threads these days.
> Signed-off-by: Bernard f6bvp / ai7bg
Well formed s-o-b is required, "the name you'd use if you were signing
a legal document".
> diff --git a/a/net/rose/af_rose.c b/b/net/rose/af_rose.c
> index bf2d986..41e106a 100644
> --- a/a/net/rose/af_rose.c
> +++ b/b/net/rose/af_rose.c
> @@ -711,6 +711,7 @@ static int rose_bind(struct socket *sock, struct
> sockaddr *uaddr, int addr_len)
> rose_insert_socket(sk);
>
> sock_reset_flag(sk, SOCK_ZAPPED);
> + dev_put(dev);
>
> return 0;
> }
Here is the context.
This patch adds dev_put(dev) in order to allow removal of rose module
after use of AX25 and ROSE via rose0 device.
Otherwise when trying to remove rose module via rmmod rose an infinite
loop message was displayed on all consoles with xx being a random number.
unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
...
With the patch it is ok to rmmod rose.
This bug appeared with kernel 4.10 and has been only partially repaired
by adding two dev_put(dev).
Signed-off-by: Bernard Pidoux <[email protected]>
---
net/rose/af_rose.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index bf2d986a6bc3..4163171ce3a6 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -711,6 +711,8 @@ static int rose_bind(struct socket *sock, struct
sockaddr *uaddr, int addr_len)
rose_insert_socket(sk);
sock_reset_flag(sk, SOCK_ZAPPED);
+
+ dev_put(dev);
return 0;
}
--
2.34.1
[master da21d19e920d] [PATCH] net: rose: fix unregistered netdevice:
waiting for rose0 to become free
Date: Mon Jul 18 16:23:54 2022 +0200
1 file changed, 2 insertions(+)
On Fri, Jul 22, 2022 at 6:41 PM Bernard f6bvp <[email protected]> wrote:
>
> Here is the context.
>
> This patch adds dev_put(dev) in order to allow removal of rose module
> after use of AX25 and ROSE via rose0 device.
>
> Otherwise when trying to remove rose module via rmmod rose an infinite
> loop message was displayed on all consoles with xx being a random number.
>
> unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
>
> unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
>
> ...
>
> With the patch it is ok to rmmod rose.
>
> This bug appeared with kernel 4.10 and has been only partially repaired
> by adding two dev_put(dev).
>
> Signed-off-by: Bernard Pidoux <[email protected]>
>
> ---
> net/rose/af_rose.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
> index bf2d986a6bc3..4163171ce3a6 100644
> --- a/net/rose/af_rose.c
> +++ b/net/rose/af_rose.c
> @@ -711,6 +711,8 @@ static int rose_bind(struct socket *sock, struct
> sockaddr *uaddr, int addr_len)
> rose_insert_socket(sk);
>
> sock_reset_flag(sk, SOCK_ZAPPED);
> +
> + dev_put(dev);
But, we have at line 698 :
rose->device = dev;
So we can not keep a pointer to a device without holding a reference on it.
As a bonus we could convert these dev_put() to new infra added with
CONFIG_NET_DEV_REFCNT_TRACKER=y
>
> return 0;
> }
> --
> 2.34.1
>
> [master da21d19e920d] [PATCH] net: rose: fix unregistered netdevice:
> waiting for rose0 to become free
> Date: Mon Jul 18 16:23:54 2022 +0200
> 1 file changed, 2 insertions(+)
>
>
On Fri, 22 Jul 2022 18:41:28 +0200 Bernard f6bvp wrote:
> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
> Thunderbird/91.11.0
Still whitespace damaged, can you try git send-email ?
I modified .config according to
CONFIG_NET_DEV_REFCNT_TRACKER=y
then compiled moduled and ran my usual AX25 and ROSE applications.
Attached is (I hope) relevant dmesg dump.
I modified .config according to
CONFIG_NET_DEV_REFCNT_TRACKER=y
then compiled moduled and ran my usual AX25 and ROSE applications.
Attached is (I hope) relevant dmesg dump.
On Sat, Jul 23, 2022 at 1:21 PM Bernard F6BVP <[email protected]> wrote:
>
>
> I modified .config according to
> CONFIG_NET_DEV_REFCNT_TRACKER=y
> then compiled moduled and ran my usual AX25 and ROSE applications.
>
> Attached is (I hope) relevant dmesg dump.
Thanks !
There are a lot of problems really...
FIrst one being in ax25:
[ 205.798723] reference already released.
[ 205.798732] allocated in:
[ 205.798734] ax25_bind+0x1a2/0x230 [ax25]
[ 205.798747] __sys_bind+0xea/0x110
[ 205.798753] __x64_sys_bind+0x18/0x20
[ 205.798758] do_syscall_64+0x5c/0x80
[ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 205.798768] freed in:
[ 205.798770] ax25_release+0x115/0x370 [ax25]
[ 205.798778] __sock_release+0x42/0xb0
[ 205.798782] sock_close+0x15/0x20
[ 205.798785] __fput+0x9f/0x260
[ 205.798789] ____fput+0xe/0x10
[ 205.798792] task_work_run+0x64/0xa0
[ 205.798798] exit_to_user_mode_prepare+0x18b/0x190
[ 205.798804] syscall_exit_to_user_mode+0x26/0x40
[ 205.798808] do_syscall_64+0x69/0x80
[ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 205.798827] ------------[ cut here ]------------
[ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136
ref_tracker_free.cold+0x60/0x81
[ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac
algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1
i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci
intel_powerclamp rtw88_core snd_hda_codec_realtek
snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel
snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy
drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm
joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel
mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm
crypto_simd syscopyarea processor_thermal_device_pci_legacy
sysfillrect cryptd intel_soc_dts_iosf snd_seq sysimgblt ecdh_generic
fb_sys_fops rapl libarc4 processor_thermal_device intel_cstate
processor_thermal_rfim cec snd_timer ecc snd_seq_device cfg80211
processor_thermal_mbox mei_me processor_thermal_rapl mei rc_core at24
snd intel_pch_thermal intel_rapl_common ttm soundcore
int340x_thermal_zone video
[ 205.798948] mac_hid acpi_pad sch_fq_codel ipmi_devintf
ipmi_msghandler drm msr parport_pc ppdev lp parport ramoops pstore_blk
reed_solomon pstore_zone efi_pstore ip_tables x_tables autofs4
hid_generic usbhid hid i2c_i801 i2c_smbus r8169 xhci_pci ahci libahci
realtek lpc_ich xhci_pci_renesas [last unloaded: ax25]
[ 205.798992] CPU: 2 PID: 2605 Comm: ax25ipd Not tainted 5.18.11-F6BVP #3
[ 205.798996] Hardware name: To be filled by O.E.M. To be filled by
O.E.M./CK3, BIOS 5.011 09/16/2020
[ 205.798999] RIP: 0010:ref_tracker_free.cold+0x60/0x81
[ 205.799005] Code: e8 d2 01 9b ff 83 7b 18 00 74 14 48 c7 c7 2f d7
ff 98 e8 10 6e fc ff 8b 7b 18 e8 b8 01 9b ff 4c 89 ee 4c 89 e7 e8 5d
fd 07 00 <0f> 0b b8 ea ff ff ff e9 30 05 9b ff 41 0f b6 f7 48 c7 c7 a0
fa 4e
[ 205.799008] RSP: 0018:ffffaf5281073958 EFLAGS: 00010286
[ 205.799011] RAX: 0000000080000000 RBX: ffff9a0bd687ebe0 RCX: 0000000000000000
[ 205.799014] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 00000000ffffffff
[ 205.799016] RBP: ffffaf5281073a10 R08: 0000000000000003 R09: fffffffffffd5618
[ 205.799019] R10: 0000000000ffff10 R11: 000000000000000f R12: ffff9a0bc53384d0
[ 205.799022] R13: 0000000000000282 R14: 00000000ae000001 R15: 0000000000000001
[ 205.799024] FS: 0000000000000000(0000) GS:ffff9a0d0f300000(0000)
knlGS:0000000000000000
[ 205.799028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 205.799031] CR2: 00007ff6b8311554 CR3: 000000001ac10004 CR4: 00000000001706e0
[ 205.799033] Call Trace:
[ 205.799035] <TASK>
[ 205.799038] ? ax25_dev_device_down+0xd9/0x1b0 [ax25]
[ 205.799047] ? ax25_device_event+0x9f/0x270 [ax25]
[ 205.799055] ? raw_notifier_call_chain+0x49/0x60
[ 205.799060] ? call_netdevice_notifiers_info+0x52/0xa0
[ 205.799065] ? dev_close_many+0xc8/0x120
[ 205.799070] ? unregister_netdevice_many+0x13d/0x890
[ 205.799073] ? unregister_netdevice_queue+0x90/0xe0
[ 205.799076] ? unregister_netdev+0x1d/0x30
[ 205.799080] ? mkiss_close+0x7c/0xc0 [mkiss]
[ 205.799084] ? tty_ldisc_close+0x2e/0x40
[ 205.799089] ? tty_ldisc_hangup+0x137/0x210
[ 205.799092] ? __tty_hangup.part.0+0x208/0x350
[ 205.799098] ? tty_vhangup+0x15/0x20
[ 205.799103] ? pty_close+0x127/0x160
[ 205.799108] ? tty_release+0x139/0x5e0
[ 205.799112] ? __fput+0x9f/0x260
[ 205.799118] ax25_dev_device_down+0xd9/0x1b0 [ax25]
[ 205.799126] ax25_device_event+0x9f/0x270 [ax25]
[ 205.799135] raw_notifier_call_chain+0x49/0x60
[ 205.799140] call_netdevice_notifiers_info+0x52/0xa0
[ 205.799146] dev_close_many+0xc8/0x120
[ 205.799152] unregister_netdevice_many+0x13d/0x890
[ 205.799157] unregister_netdevice_queue+0x90/0xe0
[ 205.799161] unregister_netdev+0x1d/0x30
[ 205.799165] mkiss_close+0x7c/0xc0 [mkiss]
[ 205.799170] tty_ldisc_close+0x2e/0x40
[ 205.799173] tty_ldisc_hangup+0x137/0x210
[ 205.799178] __tty_hangup.part.0+0x208/0x350
[ 205.799184] tty_vhangup+0x15/0x20
[ 205.799188] pty_close+0x127/0x160
[ 205.799193] tty_release+0x139/0x5e0
[ 205.799199] __fput+0x9f/0x260
[ 205.799203] ____fput+0xe/0x10
[ 205.799208] task_work_run+0x64/0xa0
[ 205.799213] do_exit+0x33b/0xab0
[ 205.799217] ? __handle_mm_fault+0xc4f/0x15f0
[ 205.799224] do_group_exit+0x35/0xa0
[ 205.799228] __x64_sys_exit_group+0x18/0x20
[ 205.799232] do_syscall_64+0x5c/0x80
[ 205.799238] ? handle_mm_fault+0xba/0x290
[ 205.799242] ? debug_smp_processor_id+0x17/0x20
[ 205.799246] ? fpregs_assert_state_consistent+0x26/0x50
[ 205.799251] ? exit_to_user_mode_prepare+0x49/0x190
[ 205.799256] ? irqentry_exit_to_user_mode+0x9/0x20
[ 205.799260] ? irqentry_exit+0x33/0x40
[ 205.799263] ? exc_page_fault+0x87/0x170
[ 205.799268] ? asm_exc_page_fault+0x8/0x30
[ 205.799273] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 205.799277] RIP: 0033:0x7ff6b80eaca1
[ 205.799281] Code: Unable to access opcode bytes at RIP 0x7ff6b80eac77.
[ 205.799283] RSP: 002b:00007fff6dfd4738 EFLAGS: 00000246 ORIG_RAX:
00000000000000e7
[ 205.799287] RAX: ffffffffffffffda RBX: 00007ff6b8215a00 RCX: 00007ff6b80eaca1
[ 205.799290] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
[ 205.799293] RBP: 0000000000000001 R08: ffffffffffffff80 R09: 0000000000000028
[ 205.799295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6b8215a00
[ 205.799298] R13: 0000000000000000 R14: 00007ff6b821aee8 R15: 00007ff6b821af00
[ 205.799304] </TASK>
Here is the context.
This patch adds dev_put(dev) in order to allow removal of rose module
after use of AX25 and ROSE via rose0 device.
Otherwise when trying to remove rose module via rmmod rose an infinite
loop message was displayed on all consoles with xx being a random number.
unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
...
With the patch it is ok to rmmod rose.
This bug appeared with kernel 4.10 and has been only partially repaired by adding two dev_put(dev).
Signed-off-by: Bernard Pidoux <[email protected]>
---
net/rose/af_rose.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index bf2d986a6bc3..4163171ce3a6 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -711,6 +711,8 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
rose_insert_socket(sk);
sock_reset_flag(sk, SOCK_ZAPPED);
+
+ dev_put(dev);
return 0;
}
--
2.34.1
[master da21d19e920d] [PATCH] net: rose: fix unregistered netdevice: waiting for rose0 to become free
Date: Mon Jul 18 16:23:54 2022 +0200
1 file changed, 2 insertions(+)
On Tue, Jul 26, 2022 at 8:25 PM Bernard Pidoux <[email protected]> wrote:
>
> Here is the context.
>
> This patch adds dev_put(dev) in order to allow removal of rose module
> after use of AX25 and ROSE via rose0 device.
>
> Otherwise when trying to remove rose module via rmmod rose an infinite
> loop message was displayed on all consoles with xx being a random number.
>
> unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
>
> unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
>
> ...
>
> With the patch it is ok to rmmod rose.
But removing a net device will leave a dangling pointer, leading to UAF.
We must keep a reference and remove it when the socket is dismantled.
Also rose_dev_first() is buggy, because it leaves the rcu section
without taking first a reference on the found device.
Here is a probably not complete patch, can you give it a try ?
(Also enable CONFIG_NET_DEV_REFCNT_TRACKER=y in your .config to ease debugging)
(I can send you privately the patch, just ask me, I include it inline
here for clarity only)
Thanks.
diff --git a/include/net/rose.h b/include/net/rose.h
index 0f0a4ce0fee7cc5e125507a8fc3cfb8cb826be73..64f808eed0e15a2482e8ce010d712eef1e0b9d85
100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -131,7 +131,8 @@ struct rose_sock {
ax25_address source_digis[ROSE_MAX_DIGIS];
ax25_address dest_digis[ROSE_MAX_DIGIS];
struct rose_neigh *neighbour;
- struct net_device *device;
+ struct net_device *device;
+ netdevice_tracker dev_tracker;
unsigned int lci, rand;
unsigned char state, condition, qbitincl, defer;
unsigned char cause, diagnostic;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index bf2d986a6bc392a9d830b1dfa7fbaa3bca969aa3..520a48999f1bf8a41d66e8a4f86606b66f2b9408
100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -192,6 +192,7 @@ static void rose_kill_by_device(struct net_device *dev)
rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
if (rose->neighbour)
rose->neighbour->use--;
+ dev_put_track(rose->device, &rose->dev_tracker);
rose->device = NULL;
}
}
@@ -592,6 +593,8 @@ static struct sock *rose_make_new(struct sock *osk)
rose->idle = orose->idle;
rose->defer = orose->defer;
rose->device = orose->device;
+ if (rose->device)
+ dev_hold_track(rose->device, &rose->dev_tracker, GFP_ATOMIC);
rose->qbitincl = orose->qbitincl;
return sk;
@@ -695,7 +698,11 @@ static int rose_bind(struct socket *sock, struct
sockaddr *uaddr, int addr_len)
}
rose->source_addr = addr->srose_addr;
+ // TODO: should probably hold socket lock at this point ?
+ WARN_ON_ONCE(rose->device);
rose->device = dev;
+ netdev_tracker_alloc(rose->device, &rose->dev_tracker, GFP_KERNEL);
+
rose->source_ndigis = addr->srose_ndigis;
if (addr_len == sizeof(struct full_sockaddr_rose)) {
@@ -721,7 +728,6 @@ static int rose_connect(struct socket *sock,
struct sockaddr *uaddr, int addr_le
struct rose_sock *rose = rose_sk(sk);
struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
unsigned char cause, diagnostic;
- struct net_device *dev;
ax25_uid_assoc *user;
int n, err = 0;
@@ -778,9 +784,12 @@ static int rose_connect(struct socket *sock,
struct sockaddr *uaddr, int addr_le
}
if (sock_flag(sk, SOCK_ZAPPED)) { /* Must bind first -
autobinding in this may or may not work */
+ struct net_device *dev;
+
sock_reset_flag(sk, SOCK_ZAPPED);
- if ((dev = rose_dev_first()) == NULL) {
+ dev = rose_dev_first();
+ if (!dev) {
err = -ENETUNREACH;
goto out_release;
}
@@ -788,12 +797,15 @@ static int rose_connect(struct socket *sock,
struct sockaddr *uaddr, int addr_le
user = ax25_findbyuid(current_euid());
if (!user) {
err = -EINVAL;
+ dev_put(dev);
goto out_release;
}
memcpy(&rose->source_addr, dev->dev_addr, ROSE_ADDR_LEN);
rose->source_call = user->call;
rose->device = dev;
+ netdev_tracker_alloc(rose->device, &rose->dev_tracker,
+ GFP_KERNEL);
ax25_uid_put(user);
rose_insert_socket(sk); /* Finish the bind */
@@ -1017,6 +1029,7 @@ int rose_rx_call_request(struct sk_buff *skb,
struct net_device *dev, struct ros
make_rose->source_digis[n] = facilities.source_digis[n];
make_rose->neighbour = neigh;
make_rose->device = dev;
+ dev_hold_track(make_rose->device, &make_rose->dev_tracker, GFP_ATOMIC);
make_rose->facilities = facilities;
make_rose->neighbour->use++;
Linux bernard-f6bvp 6.0.0-rc3-DEBUG+ #6 SMP PREEMPT_DYNAMIC Sun Sep 4
19:40:14 CEST 2022 x86_64 x86_64 x86_64 GNU/Linux
Trying to removing rose module when it is no more in use is still impossible
# lsmod
Module Size Used by
rose 53248 -1
ax25 65536 1 rose
#dmesg
..........
[17199.188170] NET: Unregistered PF_ROSE protocol family
[17209.327901] unregister_netdevice: waiting for rose0 to become free.
Usage count = 17
[17209.327910] leaked reference.
[17209.327913] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.327923] rose_route_frame+0x287/0x740 [rose]
[17209.327928] ax25_rx_iframe.part.0+0x8a/0x340 [ax25]
[17209.327936] ax25_rx_iframe+0x13/0x20 [ax25]
[17209.327942] ax25_std_frame_in+0x7ae/0x810 [ax25]
[17209.327948] ax25_rcv.constprop.0+0x5ee/0x880 [ax25]
[17209.327953] ax25_kiss_rcv+0x6c/0x90 [ax25]
[17209.327959] __netif_receive_skb_one_core+0x91/0xa0
[17209.327964] __netif_receive_skb+0x15/0x60
[17209.327968] process_backlog+0x96/0x140
[17209.327971] __napi_poll+0x33/0x190
[17209.327974] net_rx_action+0x19f/0x300
[17209.327977] __do_softirq+0x103/0x366
[17209.327983] leaked reference.
[17209.327985] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.327990] rose_loopback_timer+0xa3/0x1c0 [rose]
[17209.327995] call_timer_fn+0x2c/0x150
[17209.328000] __run_timers.part.0+0x1d9/0x280
[17209.328003] run_timer_softirq+0x3f/0xa0
[17209.328007] __do_softirq+0x103/0x366
[17209.328011] leaked reference.
[17209.328013] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.328018] rose_route_frame+0x287/0x740 [rose]
[17209.328023] ax25_rx_iframe.part.0+0x8a/0x340 [ax25]
[17209.328028] ax25_rx_iframe+0x13/0x20 [ax25]
[17209.328034] ax25_std_frame_in+0x7ae/0x810 [ax25]
[17209.328040] ax25_rcv.constprop.0+0x5ee/0x880 [ax25]
[17209.328045] ax25_kiss_rcv+0x6c/0x90 [ax25]
[17209.328050] __netif_receive_skb_one_core+0x91/0xa0
[17209.328054] __netif_receive_skb+0x15/0x60
[17209.328057] process_backlog+0x96/0x140
[17209.328060] __napi_poll+0x33/0x190
[17209.328063] net_rx_action+0x19f/0x300
[17209.328067] __do_softirq+0x103/0x366
[17209.328071] leaked reference.
[17209.328072] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.328077] rose_loopback_timer+0xa3/0x1c0 [rose]
[17209.328082] call_timer_fn+0x2c/0x150
[17209.328085] __run_timers.part.0+0x1d9/0x280
[17209.328089] run_timer_softirq+0x3f/0xa0
[17209.328092] __do_softirq+0x103/0x366
[17209.328096] leaked reference.
[17209.328098] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.328103] rose_loopback_timer+0xa3/0x1c0 [rose]
[17209.328107] call_timer_fn+0x2c/0x150
[17209.328111] __run_timers.part.0+0x1d9/0x280
[17209.328114] run_timer_softirq+0x3f/0xa0
[17209.328117] __do_softirq+0x103/0x366
[17209.328121] leaked reference.
[17209.328123] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.328128] rose_route_frame+0x287/0x740 [rose]
[17209.328133] ax25_rx_iframe.part.0+0x8a/0x340 [ax25]
[17209.328138] ax25_rx_iframe+0x13/0x20 [ax25]
[17209.328144] ax25_std_frame_in+0x7ae/0x810 [ax25]
[17209.328150] ax25_rcv.constprop.0+0x5ee/0x880 [ax25]
[17209.328155] ax25_kiss_rcv+0x6c/0x90 [ax25]
[17209.328160] __netif_receive_skb_one_core+0x91/0xa0
[17209.328164] __netif_receive_skb+0x15/0x60
[17209.328167] process_backlog+0x96/0x140
[17209.328170] __napi_poll+0x33/0x190
[17209.328173] net_rx_action+0x19f/0x300
[17209.328176] __do_softirq+0x103/0x366
[17209.328180] leaked reference.
[17209.328182] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.328187] rose_loopback_timer+0xa3/0x1c0 [rose]
[17209.328192] call_timer_fn+0x2c/0x150
[17209.328195] __run_timers.part.0+0x1d9/0x280
[17209.328198] run_timer_softirq+0x3f/0xa0
[17209.328202] __do_softirq+0x103/0x366
[17209.328206] leaked reference.
[17209.328208] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.328212] rose_loopback_timer+0xa3/0x1c0 [rose]
[17209.328217] call_timer_fn+0x2c/0x150
[17209.328220] __run_timers.part.0+0x1d9/0x280
[17209.328223] run_timer_softirq+0x3f/0xa0
[17209.328227] __do_softirq+0x103/0x366
[17209.328231] leaked reference.
[17209.328232] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.328237] rose_loopback_timer+0xa3/0x1c0 [rose]
[17209.328242] call_timer_fn+0x2c/0x150
[17209.328245] __run_timers.part.0+0x1d9/0x280
[17209.328248] run_timer_softirq+0x3f/0xa0
[17209.328252] __do_softirq+0x103/0x366
[17209.328256] leaked reference.
[17209.328258] rose_rx_call_request+0x334/0x7b0 [rose]
[17209.328262] rose_loopback_timer+0xa3/0x1c0 [rose]
[17209.328267] call_timer_fn+0x2c/0x150
[17209.328270] __run_timers.part.0+0x1d9/0x280
[17209.328273] run_timer_softirq+0x3f/0xa0
[17209.328277] __do_softirq+0x103/0x366