Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: unregister_netdevice: waiting for DEV to become free (2)
To:     Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
        "David S. Miller" <davem@davemloft.net>
Cc:     Julian Anastasov <ja@ssi.bg>, Cong Wang <xiyou.wangcong@gmail.com>,
        syzbot <syzbot+30209ea299c09d8785c9@syzkaller.appspotmail.com>,
        ddstreet@ieee.org, dvyukov@google.com,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
References: <0000000000007d22100573d66078@google.com>
 <alpine.LFD.2.20.1808201527230.2758@ja.home.ssi.bg>
 <4684eef5-ea50-2965-86a0-492b8b1e4f52@I-love.SAKURA.ne.jp>
 <9d430543-33c3-0d9b-dc77-3a179a8e3919@I-love.SAKURA.ne.jp>
 <920ebaf1-ee87-0dbb-6805-660c1cbce3d0@I-love.SAKURA.ne.jp>
From:   David Ahern <dsahern@gmail.com>
Message-ID: <cc054b5c-4e95-8d30-d4bf-9c85f7e20092@gmail.com>
Date:   Sat, 27 Apr 2019 11:16:41 -0600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0)
 Gecko/20100101 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <920ebaf1-ee87-0dbb-6805-660c1cbce3d0@I-love.SAKURA.ne.jp>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 4/26/19 7:43 AM, Tetsuo Handa wrote:
> This bug is the top crasher for syzbot and thus we want to fix. I need your
> response regarding commit caacf05e5ad1abf0 ("ipv4: Properly purge netdev
> references on uncached routes.") why you chose "a loopback device in that
> namespace".
> 
> On 2019/04/16 23:00, Tetsuo Handa wrote:
>> Hello, David S. Miller.
>>
>> I have a question regarding rt_flush_dev() introduced by commit caacf05e5ad1abf0
>> ("ipv4: Properly purge netdev references on uncached routes.") which went to
>> Linux 3.6-rc1. That commit started replacing "a device to unregister" with
>> "a loopback device in that namespace", but there is no description why that
>> commit chose "a loopback device in that namespace". If a device to unregister
>> is "a loopback device in that namespace" itself, rt_flush_dev() becomes a no-op
>> because dev == net->loopback_dev from the beginning. Apart from a problem that
>> usage count keeps increasing because dev_put(rt->dst.dev) is not called after
>> rt->dst.dev was replaced with a loopback device, replacing "a device to unregister"
>> with "a loopback device in init namespace" (like shown below) avoids this problem.
>>

Moving resource use to the init namespace is not really solving the core
problem. It would be better to understand what changes are needed to the
shutdown sequence of a namespace to ensure proper cleanup.

In this case why are dst entries not getting cleaned up? This one is
referring to entries on the uncached list. What is using the dst entry
and why isn't it getting released?