[BUG] WARNING: refcount bug in gsm_mux_net_start_xmit

[BUG] WARNING: refcount bug in gsm_mux_net_start_xmit

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/199-warning-refcount-bug-in-gsm-mux-net-start-xmit/

  refcount_t: addition on 0; use-after-free.
  WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110
lib/refcount.c:25, CPU#0: kworker/u8:1/14
  Workqueue: ipv6_addrconf addrconf_dad_work
  Call Trace:
   refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25
   __refcount_inc include/linux/refcount.h:366 [inline]
   refcount_inc include/linux/refcount.h:383 [inline]
   kref_get include/linux/kref.h:45 [inline]
   muxnet_get drivers/tty/n_gsm.c:3938 [inline]
   gsm_mux_net_start_xmit+0x3af/0x440 drivers/tty/n_gsm.c:3951
   __netdev_start_xmit include/linux/netdevice.h:5368 [inline]
   dev_hard_start_xmit+0x23b/0x620 net/core/dev.c:3904
   __dev_queue_xmit+0x160b/0x3250 net/core/dev.c:4831
   ip6_finish_output2+0xfd4/0x19b0 net/ipv6/ip6_output.c:136
   mld_sendpack+0x820/0xe00 net/ipv6/mcast.c:1855
   ipv6_mc_dad_complete+0x85/0x470 net/ipv6/mcast.c:2279

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] WARNING: refcount bug in gsm_mux_net_start_xmit

[Greg Kroah-Hartman]

On Fri, Aug 28, 2026 at 05:53:36AM +0000, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/199-warning-refcount-bug-in-gsm-mux-net-start-xmit/
> 
>   refcount_t: addition on 0; use-after-free.
>   WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110
> lib/refcount.c:25, CPU#0: kworker/u8:1/14
>   Workqueue: ipv6_addrconf addrconf_dad_work
>   Call Trace:
>    refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25
>    __refcount_inc include/linux/refcount.h:366 [inline]
>    refcount_inc include/linux/refcount.h:383 [inline]
>    kref_get include/linux/kref.h:45 [inline]
>    muxnet_get drivers/tty/n_gsm.c:3938 [inline]
>    gsm_mux_net_start_xmit+0x3af/0x440 drivers/tty/n_gsm.c:3951
>    __netdev_start_xmit include/linux/netdevice.h:5368 [inline]
>    dev_hard_start_xmit+0x23b/0x620 net/core/dev.c:3904
>    __dev_queue_xmit+0x160b/0x3250 net/core/dev.c:4831
>    ip6_finish_output2+0xfd4/0x19b0 net/ipv6/ip6_output.c:136
>    mld_sendpack+0x820/0xe00 net/ipv6/mcast.c:1855
>    ipv6_mc_dad_complete+0x85/0x470 net/ipv6/mcast.c:2279
> 
> Our reproducer.c is available upon request.
> 
> Happy to test a patch if that would help.

Again, please sned such patch.

Re: [BUG] WARNING: refcount bug in gsm_mux_net_start_xmit

[Greg Kroah-Hartman]

On Fri, Aug 28, 2026 at 05:53:36AM +0000, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/199-warning-refcount-bug-in-gsm-mux-net-start-xmit/
> 
>   refcount_t: addition on 0; use-after-free.
>   WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110
> lib/refcount.c:25, CPU#0: kworker/u8:1/14
>   Workqueue: ipv6_addrconf addrconf_dad_work
>   Call Trace:
>    refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25
>    __refcount_inc include/linux/refcount.h:366 [inline]
>    refcount_inc include/linux/refcount.h:383 [inline]
>    kref_get include/linux/kref.h:45 [inline]
>    muxnet_get drivers/tty/n_gsm.c:3938 [inline]
>    gsm_mux_net_start_xmit+0x3af/0x440 drivers/tty/n_gsm.c:3951
>    __netdev_start_xmit include/linux/netdevice.h:5368 [inline]
>    dev_hard_start_xmit+0x23b/0x620 net/core/dev.c:3904
>    __dev_queue_xmit+0x160b/0x3250 net/core/dev.c:4831
>    ip6_finish_output2+0xfd4/0x19b0 net/ipv6/ip6_output.c:136
>    mld_sendpack+0x820/0xe00 net/ipv6/mcast.c:1855
>    ipv6_mc_dad_complete+0x85/0x470 net/ipv6/mcast.c:2279
> 
> Our reproducer.c is available upon request.

Please read the mailing list archives for why you shouldn't be worrying
about this file unless you have access to the real hardware.

Also, this required root to trigger, right?

thanks,

greg k-h