Re: [BUG] WARNING: refcount bug in gsm_mux_net_start_xmit

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Fri, Aug 28, 2026 at 05:53:36AM +0000, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/199-warning-refcount-bug-in-gsm-mux-net-start-xmit/
> 
>   refcount_t: addition on 0; use-after-free.
>   WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110
> lib/refcount.c:25, CPU#0: kworker/u8:1/14
>   Workqueue: ipv6_addrconf addrconf_dad_work
>   Call Trace:
>    refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25
>    __refcount_inc include/linux/refcount.h:366 [inline]
>    refcount_inc include/linux/refcount.h:383 [inline]
>    kref_get include/linux/kref.h:45 [inline]
>    muxnet_get drivers/tty/n_gsm.c:3938 [inline]
>    gsm_mux_net_start_xmit+0x3af/0x440 drivers/tty/n_gsm.c:3951
>    __netdev_start_xmit include/linux/netdevice.h:5368 [inline]
>    dev_hard_start_xmit+0x23b/0x620 net/core/dev.c:3904
>    __dev_queue_xmit+0x160b/0x3250 net/core/dev.c:4831
>    ip6_finish_output2+0xfd4/0x19b0 net/ipv6/ip6_output.c:136
>    mld_sendpack+0x820/0xe00 net/ipv6/mcast.c:1855
>    ipv6_mc_dad_complete+0x85/0x470 net/ipv6/mcast.c:2279
> 
> Our reproducer.c is available upon request.

Please read the mailing list archives for why you shouldn't be worrying
about this file unless you have access to the real hardware.

Also, this required root to trigger, right?

thanks,

greg k-h