Received-SPF: pass (google.com: domain of linux-kernel+bounces-132482-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+9ada62e1dc03fdc41982@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] WARNING in cleanup_net (3)
Date: Fri,  5 Apr 2024 14:37:51 +0800
Message-Id: <20240405063751.835-1-hdanton@sina.com>
In-Reply-To: <0000000000009c0f98061550a827@google.com>
References: 
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On Thu, 04 Apr 2024 20:00:30 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel..
> git tree:       upstream
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16696223180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  fe46a7dd189e

--- x/include/net/net_namespace.h
+++ y/include/net/net_namespace.h
@@ -318,7 +318,7 @@ static inline int check_net(const struct
 	return 1;
 }
 
-#define net_drop_ns NULL
+static void net_drop_ns(void *p) {}
 #endif
 
 
@@ -353,7 +353,7 @@ static inline void __netns_tracker_free(
 static inline struct net *get_net_track(struct net *net,
 					netns_tracker *tracker, gfp_t gfp)
 {
-	get_net(net);
+	refcount_inc(&net->passive);
 	netns_tracker_alloc(net, tracker, gfp);
 	return net;
 }
@@ -361,7 +361,7 @@ static inline struct net *get_net_track(
 static inline void put_net_track(struct net *net, netns_tracker *tracker)
 {
 	__netns_tracker_free(net, tracker, true);
-	put_net(net);
+	net_drop_ns(net);
 }
 
 typedef struct {
--