Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38;
MIME-Version: 1.0
References: <CABOYnLy_ufLD=BWDJct2chXMDYdZK=dNb4cnPYD5xo3WW1YCrw@mail.gmail.com>
 <CANn89iKpO35x-mFNgGA1axhn1hrq2HZBOFXo+wkTRPKxCQyQKA@mail.gmail.com>
In-Reply-To: <CANn89iKpO35x-mFNgGA1axhn1hrq2HZBOFXo+wkTRPKxCQyQKA@mail.gmail.com>
From:   Eric Dumazet <edumazet@google.com>
Date:   Thu, 30 Nov 2023 10:38:57 +0100
Message-ID: <CANn89iJ7h_LFSV6n_9WmbTMwTMsZ0UgdBj_oGrnzcrZu7oCxFw@mail.gmail.com>
Subject: Re: [syzbot] [net?] WARNING in cleanup_net (3)
To:     xingwei lee <xrivendell7@gmail.com>
Cc:     syzbot+9ada62e1dc03fdc41982@syzkaller.appspotmail.com,
        davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, pabeni@redhat.com,
        syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, Nov 30, 2023 at 9:46=E2=80=AFAM Eric Dumazet <edumazet@google.com> =
wrote:
>
> On Thu, Nov 30, 2023 at 9:42=E2=80=AFAM xingwei lee <xrivendell7@gmail.co=
m> wrote:
> >
> > Hello
> > I reproduced this bug with repro.txt and repro.c
> >
> >
>
>
> Is your syzbot instance ready to accept patches for testing ?
>
> Otherwise, a repro which happens to  work 'by luck' might not work for me=
.
>
> The bug here is a race condition with rds subsystem being dismantled
> at netns dismantle, the 'repro' could be anything really.

Can you test the following patch ?
Thanks.

diff --git a/net/core/sock.c b/net/core/sock.c
index fef349dd72fa735b5915fc03e29cbb155b2aff2c..36d2871ac24f383e4e5d1af1168=
000f076011aae
100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2197,8 +2197,6 @@ static void __sk_destruct(struct rcu_head *head)

        if (likely(sk->sk_net_refcnt))
                put_net_track(sock_net(sk), &sk->ns_tracker);
-       else
-               __netns_tracker_free(sock_net(sk), &sk->ns_tracker, false);

        sk_prot_free(sk->sk_prot_creator, sk);
 }
@@ -2212,6 +2210,9 @@ void sk_destruct(struct sock *sk)
                use_call_rcu =3D true;
        }

+       if (unlikely(!sk->sk_net_refcnt))
+               __netns_tracker_free(sock_net(sk), &sk->ns_tracker, false);
+
        if (use_call_rcu)
                call_rcu(&sk->sk_rcu, __sk_destruct);
        else