net: fix refcnt_tracker use-after-free on netns creation failure

[PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

Posted by Jiayuan Chen 1 month ago

The copy_net_ns() error path tears the net down via net_passive_dec(),
which only exits notrefcnt_tracker. refcnt_tracker is exited in
__put_net(), which this path never reaches, so it is left alive.

Since ref_tracker_dir_init() started registering a debugfs file per
dir, that file must be dropped by ref_tracker_dir_exit(). The missing
exit leaves the file pointing at the freed net, so reading it walks
net->refcnt_tracker.lock and hits a use-after-free.

The missing exit has been there all along, but before the debugfs file
refcnt_tracker was just an in-memory ledger and empty on this path, so
skipping it leaked nothing and did no harm. Only the commit below, which
gives every dir a debugfs file, turned it into a use-after-free, so
Fixes points there.

Exit refcnt_tracker on the failure path.

Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
Reported-by: syzbot+d3f912a2e30e2079a512@syzkaller.appspotmail.com
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 net/core/net_namespace.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index a91d2b58aadd..0c3f169d9afb 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -591,6 +591,10 @@ struct net *copy_net_ns(u64 flags,
 		key_remove_domain(net->key_domain);
 #endif
 		put_user_ns(user_ns);
+		/* setup_net() failure is not routed through __put_net(), so the
+		 * refcnt_tracker (and its debugfs file) has to be released here.
+		 */
+		ref_tracker_dir_exit(&net->refcnt_tracker);
 		net_passive_dec(net);
 dec_ucounts:
 		dec_net_namespaces(ucounts);
-- 
2.43.0

Re: [PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

Posted by Eric Dumazet 1 month ago

On Thu, Aug 27, 2026 at 7:22 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
> The copy_net_ns() error path tears the net down via net_passive_dec(),
> which only exits notrefcnt_tracker. refcnt_tracker is exited in
> __put_net(), which this path never reaches, so it is left alive.
>
> Since ref_tracker_dir_init() started registering a debugfs file per
> dir, that file must be dropped by ref_tracker_dir_exit(). The missing
> exit leaves the file pointing at the freed net, so reading it walks
> net->refcnt_tracker.lock and hits a use-after-free.
>
> The missing exit has been there all along, but before the debugfs file
> refcnt_tracker was just an in-memory ledger and empty on this path, so
> skipping it leaked nothing and did no harm. Only the commit below, which
> gives every dir a debugfs file, turned it into a use-after-free, so
> Fixes points there.
>
> Exit refcnt_tracker on the failure path.
>
> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
> Reported-by: syzbot+d3f912a2e30e2079a512@syzkaller.appspotmail.com

Missing `Closes:` tag makes analysis cumbersome.

> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
>  net/core/net_namespace.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
> index a91d2b58aadd..0c3f169d9afb 100644
> --- a/net/core/net_namespace.c
> +++ b/net/core/net_namespace.c
> @@ -591,6 +591,10 @@ struct net *copy_net_ns(u64 flags,
>                 key_remove_domain(net->key_domain);
>  #endif
>                 put_user_ns(user_ns);
> +               /* setup_net() failure is not routed through __put_net(), so the
> +                * refcnt_tracker (and its debugfs file) has to be released here.
> +                */
> +               ref_tracker_dir_exit(&net->refcnt_tracker);
>                 net_passive_dec(net);
>  dec_ucounts:
>                 dec_net_namespaces(ucounts);

I am a bit confused. I thought this was already discussed and fixed by
Tetsuo Handa?

f85dc137aabf ("net: add missing ref_tracker_dir_exit() to net_passive_dec()")
should be fixing this?

Tetsuo also followed up with 3220b62fbb8a  ("net: fix a resource leak
in copy_net_ns() error handling path").

Re: [PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

Posted by Tetsuo Handa 4 weeks ago

On 2026/08/27 15:56, Eric Dumazet wrote:
>> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
>> Reported-by: syzbot+d3f912a2e30e2079a512@syzkaller.appspotmail.com
> 
> Missing `Closes:` tag makes analysis cumbersome.

You can derive Closes: tag from the Reported-by: tag.

https://syzkaller.appspot.com/bug?extid=d3f912a2e30e2079a512

> I am a bit confused. I thought this was already discussed and fixed by
> Tetsuo Handa?
> 
> f85dc137aabf ("net: add missing ref_tracker_dir_exit() to net_passive_dec()")
> should be fixing this?

I made this patch based on sashiko's review.
But it turned out that syzbot was already reporting the same problem. ;-)

#syz fix: net: add missing ref_tracker_dir_exit() to net_passive_dec()

Re: [PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

Posted by Jiayuan Chen 1 month ago

在 8/27/26 2:56 PM, Eric Dumazet 写道:
> On Thu, Aug 27, 2026 at 7:22 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>> The copy_net_ns() error path tears the net down via net_passive_dec(),
>> which only exits notrefcnt_tracker. refcnt_tracker is exited in
>> __put_net(), which this path never reaches, so it is left alive.
>>
>> Since ref_tracker_dir_init() started registering a debugfs file per
>> dir, that file must be dropped by ref_tracker_dir_exit(). The missing
>> exit leaves the file pointing at the freed net, so reading it walks
>> net->refcnt_tracker.lock and hits a use-after-free.
>>
>> The missing exit has been there all along, but before the debugfs file
>> refcnt_tracker was just an in-memory ledger and empty on this path, so
>> skipping it leaked nothing and did no harm. Only the commit below, which
>> gives every dir a debugfs file, turned it into a use-after-free, so
>> Fixes points there.
>>
>> Exit refcnt_tracker on the failure path.
>>
>> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
>> Reported-by: syzbot+d3f912a2e30e2079a512@syzkaller.appspotmail.com
> Missing `Closes:` tag makes analysis cumbersome.
>
>> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>> ---
>>   net/core/net_namespace.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
>> index a91d2b58aadd..0c3f169d9afb 100644
>> --- a/net/core/net_namespace.c
>> +++ b/net/core/net_namespace.c
>> @@ -591,6 +591,10 @@ struct net *copy_net_ns(u64 flags,
>>                  key_remove_domain(net->key_domain);
>>   #endif
>>                  put_user_ns(user_ns);
>> +               /* setup_net() failure is not routed through __put_net(), so the
>> +                * refcnt_tracker (and its debugfs file) has to be released here.
>> +                */
>> +               ref_tracker_dir_exit(&net->refcnt_tracker);
>>                  net_passive_dec(net);
>>   dec_ucounts:
>>                  dec_net_namespaces(ucounts);
> I am a bit confused. I thought this was already discussed and fixed by
> Tetsuo Handa?
>
> f85dc137aabf ("net: add missing ref_tracker_dir_exit() to net_passive_dec()")
> should be fixing this?


Thanks Eric, now I find it it in net tree. I should anylyze it base net 
tree not net-next.

Please ignore my patch.


pw-bot:cr


>
> Tetsuo also followed up with 3220b62fbb8a  ("net: fix a resource leak
> in copy_net_ns() error handling path").

Re: [PATCH net] net: fix refcnt_tracker use-after-free on netns creation failure

Posted by Jiayuan Chen 1 month ago

在 8/27/26 2:56 PM, Eric Dumazet 写道:
> On Thu, Aug 27, 2026 at 7:22 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>> The copy_net_ns() error path tears the net down via net_passive_dec(),
>> which only exits notrefcnt_tracker. refcnt_tracker is exited in
>> __put_net(), which this path never reaches, so it is left alive.
>>
>> Since ref_tracker_dir_init() started registering a debugfs file per
>> dir, that file must be dropped by ref_tracker_dir_exit(). The missing
>> exit leaves the file pointing at the freed net, so reading it walks
>> net->refcnt_tracker.lock and hits a use-after-free.
>>
>> The missing exit has been there all along, but before the debugfs file
>> refcnt_tracker was just an in-memory ledger and empty on this path, so
>> skipping it leaked nothing and did no harm. Only the commit below, which
>> gives every dir a debugfs file, turned it into a use-after-free, so
>> Fixes points there.
>>
>> Exit refcnt_tracker on the failure path.
>>
>> Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir")
>> Reported-by: syzbot+d3f912a2e30e2079a512@syzkaller.appspotmail.com
> Missing `Closes:` tag makes analysis cumbersome.
>
>> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>> ---
>>   net/core/net_namespace.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
>> index a91d2b58aadd..0c3f169d9afb 100644
>> --- a/net/core/net_namespace.c
>> +++ b/net/core/net_namespace.c
>> @@ -591,6 +591,10 @@ struct net *copy_net_ns(u64 flags,
>>                  key_remove_domain(net->key_domain);
>>   #endif
>>                  put_user_ns(user_ns);
>> +               /* setup_net() failure is not routed through __put_net(), so the
>> +                * refcnt_tracker (and its debugfs file) has to be released here.
>> +                */
>> +               ref_tracker_dir_exit(&net->refcnt_tracker);
>>                  net_passive_dec(net);
>>   dec_ucounts:
>>                  dec_net_namespaces(ucounts);
> I am a bit confused. I thought this was already discussed and fixed by
> Tetsuo Handa?
>
> f85dc137aabf ("net: add missing ref_tracker_dir_exit() to net_passive_dec()")
> should be fixing this?


Thanks Eric, now I find it it in net tree. I should anylyze it base net 
tree not net-next.

Please ignore my patch.


pw-bot:cr


>
> Tetsuo also followed up with 3220b62fbb8a  ("net: fix a resource leak
> in copy_net_ns() error handling path").