[BUG] WARNING in ipmr_rules_exit

[BUG] WARNING in ipmr_rules_exit

[Guoyu Yin]

Hi,

I discovered a kernel crash using the Syzkaller framework, described
as "WARNING in ipmr_rules_exit." This issue occurs in the
ipmr_free_table function at net/ipv4/ipmr.c:440, specifically when
ipmr_rules_exit calls ipmr_free_table, triggering the
WARN_ON_ONCE(!ipmr_can_free_table(net)); warning.

From the call stack, this warning is triggered during the exit of a
network namespace, specifically in ipmr_net_exit_batch when calling
ipmr_rules_exit. The warning indicates that ipmr_can_free_table
returned false, suggesting that the mrt table may still have active
data structures when attempting to free it.

Possible causes include:

1. Incomplete cleanup: The mroute_clean_tables function may not have
fully cleaned up all data structures in the mrt table.

2. Race conditions: Concurrent access or modification of the mrt table
by other threads or processes during cleanup.

3. Reference count errors: Some data structures in the mrt table may
not have their reference counts properly decremented to zero.

Suggested fixes:

1. Add proper reference counting for mr_table to prevent premature freeing

2. Enhance ipmr_can_free_table() checks to verify complete entry cleanup

3. Implement synchronization between multicast route deletion and
namespace teardown

This can be reproduced on:

HEAD commit:

38fec10eb60d687e30c8c6b5420d86e8149f7557

report: https://pastebin.com/raw/seSjBgav

console output : https://pastebin.com/eD6Kbw39

kernel config : https://pastebin.com/raw/u0Efyj5P

C reproducer : https://pastebin.com/raw/EanQb7cs

Re: [BUG] WARNING in ipmr_rules_exit

[Paolo Abeni]

On 5/15/25 1:37 PM, Guoyu Yin wrote:
> I discovered a kernel crash using the Syzkaller framework, described
> as "WARNING in ipmr_rules_exit." This issue occurs in the
> ipmr_free_table function at net/ipv4/ipmr.c:440, specifically when
> ipmr_rules_exit calls ipmr_free_table, triggering the
> WARN_ON_ONCE(!ipmr_can_free_table(net)); warning.
> 
> From the call stack, this warning is triggered during the exit of a
> network namespace, specifically in ipmr_net_exit_batch when calling
> ipmr_rules_exit. The warning indicates that ipmr_can_free_table
> returned false, suggesting that the mrt table may still have active
> data structures when attempting to free it.

Thanks for the report, I could actually reproduce the splat. I'm testing
a patch I hope to share it soon.

For the record, the above analysis is incorrect: the warning is
triggered by a netns creation failure, not at netns exit time; the
problem is that the running kernel has:

# CONFIG_IP_MROUTE_MULTIPLE_TABLES is not set

and the ipmr_can_free_table() implementation in such case is
incomplete/wrong.

Cheers,

Paolo