The copy_net_ns() error path tears the net down via net_passive_dec(), which only exits notrefcnt_tracker. refcnt_tracker is exited in __put_net(), which this path never reaches, so it is left alive. Since ref_tracker_dir_init() started registering a debugfs file per dir, that file must be dropped by ref_tracker_dir_exit(). The missing exit leaves the file pointing at the freed net, so reading it walks net->refcnt_tracker.lock and hits a use-after-free. The missing exit has been there all along, but before the debugfs file refcnt_tracker was just an in-memory ledger and empty on this path, so skipping it leaked nothing and did no harm. Only the commit below, which gives every dir a debugfs file, turned it into a use-after-free, so Fixes points there. Exit refcnt_tracker on the failure path. Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir") Reported-by: syzbot+d3f912a2e30e2079a512@syzkaller.appspotmail.com Signed-off-by: Jiayuan Chen --- net/core/net_namespace.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index a91d2b58aadd..0c3f169d9afb 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -591,6 +591,10 @@ struct net *copy_net_ns(u64 flags, key_remove_domain(net->key_domain); #endif put_user_ns(user_ns); + /* setup_net() failure is not routed through __put_net(), so the + * refcnt_tracker (and its debugfs file) has to be released here. + */ + ref_tracker_dir_exit(&net->refcnt_tracker); net_passive_dec(net); dec_ucounts: dec_net_namespaces(ucounts); -- 2.43.0