Re: unregister_netdevice: waiting for DEV to become free [unbalanced refcount bug in dev_ifsioc]

[Kuniyuki Iwashima <kuniyu@amazon.com>]

From: YAN KANG <kangyan91@outlook.com>
Date: Thu, 13 Mar 2025 16:18:22 +0000
> I have repro to trigger it.

FTR, I think the attached prog is not a repro by itself.

> ...
>
> Syzkaller reproducer:
> # {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false

This syz prog does not unshare() nor create necessary devices.
Someone must create a bridge and another device.


> r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
> ioctl$sock_SIOCGIFINDEX_802154(r0, 0x89a2, &(0x7f0000000a80)={'wpan3\x00'})
> r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
> ioctl$sock_SIOCGIFINDEX_802154(r1, 0x89a0, &(0x7f0000000a80)={'wpan3\x00'})
> r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
> ioctl$sock_SIOCGIFINDEX_802154(r2, 0x89a1, &(0x7f0000000a80)={'wpan3\x00'})

0x89a1 is SIOCBRDELBR, and wpan3 is the name of the bridge dev, which
looks correct from this line.

> unregister_netdevice: waiting for wpan3 to become free. Usage count = 2

But apparently SIOCBRDELIF (0x89a3) is missing in the repro, so
there must be another prog running that adds and removes a dev
to wpan3.

When you share a repro, please make sure it's standalone.


> I GET backtrace for panic by gdb
> (gdb) bt
> #0  netdev_wait_allrefs_any (list=0xffffc9001bfa7bc8) at net/core/dev.c:11151

Also, this should not panic.

Under RTNL pressure, the SIOCBRDELIF's thread may not be able to acquire
RTNL and complete SIOCBRDELIF, then netdev_wait_allrefs_any() will log the
message but it's not under RTNL.  Once the SIOCBRDELIF's thread acquire
RTNL, the refcnt will be released soon and __rtnl_unlock() will be
unblocked.

Thanks