* [PATCH net] net: watchdog: fix refcount tracking races
@ 2026-06-08 12:39 Eric Dumazet
2026-06-08 16:01 ` Jakub Kicinski
2026-06-08 20:59 ` kernel test robot
0 siblings, 2 replies; 4+ messages in thread
From: Eric Dumazet @ 2026-06-08 12:39 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Kuniyuki Iwashima, netdev, eric.dumazet,
Eric Dumazet, syzbot+381d82bbf0253710b35d,
syzbot+3479efbc2821cb2a79f2
Blamed commit converted the untracked dev_hold()/dev_put() calls
in the watchdog code to use the tracked dev_hold_track()/dev_put_track()
(which were later renamed/interfaced to netdev_hold() and netdev_put()).
By introducing dev->watchdog_dev_tracker to store the
reference tracking information without adding synchronization
between netdev_watchdog_up() and dev_watchdog(), it enabled the
race condition where this pointer could be overwritten or freed
concurrently, leading to the list corruption crash syzbot reported:
list_del corruption, ffff888114a18c00->next is NULL
kernel BUG at lib/list_debug.c:52 !
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: events_unbound linkwatch_event
RIP: 0010:__list_del_entry_valid_or_report.cold+0x22/0x2a lib/list_debug.c:52
Call Trace:
<TASK>
__list_del_entry_valid include/linux/list.h:132 [inline]
__list_del_entry include/linux/list.h:246 [inline]
list_move_tail include/linux/list.h:341 [inline]
ref_tracker_free+0x1a7/0x6c0 lib/ref_tracker.c:329
netdev_tracker_free include/linux/netdevice.h:4491 [inline]
netdev_put include/linux/netdevice.h:4508 [inline]
netdev_put include/linux/netdevice.h:4504 [inline]
netdev_watchdog_down net/sched/sch_generic.c:600 [inline]
dev_deactivate_many+0x28c/0xfe0 net/sched/sch_generic.c:1363
dev_deactivate+0x109/0x1d0 net/sched/sch_generic.c:1397
linkwatch_do_dev net/core/link_watch.c:184 [inline]
linkwatch_do_dev+0xd3/0x120 net/core/link_watch.c:166
__linkwatch_run_queue+0x3a5/0x810 net/core/link_watch.c:240
linkwatch_event+0x8f/0xc0 net/core/link_watch.c:314
process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314
process_scheduled_works kernel/workqueue.c:3397 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
This patch has three coordinated parts:
1) Zero tracker on free:
Modify netdev_tracker_free() to poison the tracker pointer after freeing.
This helps detect and avoid double frees.
2) Remove netdev_watchdog_up() call from netif_carrier_on():
This ensures netdev_watchdog_up() is only called from process/BH context
(via linkwatch workqueue dev_activate()), allowing us to use
spin_lock_bh() for synchronization.
3) Synchronize watchdog up and watchdog timer:
Protect netdev_watchdog_up with tx_global_lock.
Only allocate a new tracker in netdev_watchdog_up() if one is
not already present.
In dev_watchdog(), keep the lock held while calling netdev_put()
to avoid races with concurrent netdev_watchdog_up().
In dev_watchdog(), ensure we don't release the tracker if the
timer was rescheduled either by dev_watchdog() itself or concurrently
by netdev_watchdog_up().
Fixes: f12bf6f3f942 ("net: watchdog: add net device refcount tracker")
Reported-by: syzbot+381d82bbf0253710b35d@syzkaller•appspotmail.com
Closes: https://lore.kernel.org/netdev/6a26b751.c25708ab.1b19ef.0013.GAE@google.com/T/#u
Tested-by: syzbot+3479efbc2821cb2a79f2@syzkaller•appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google•com>
---
include/linux/netdevice.h | 7 ++++++-
net/sched/sch_generic.c | 26 +++++++++++++++-----------
2 files changed, 21 insertions(+), 12 deletions(-)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 0e1e581efc5ac264259b2f0fdfe41c50a6f47239..fb9f7cee1d29de5367ea902d352296f952525c57 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -4488,7 +4488,12 @@ static inline void netdev_tracker_free(struct net_device *dev,
netdevice_tracker *tracker)
{
#ifdef CONFIG_NET_DEV_REFCNT_TRACKER
- ref_tracker_free(&dev->refcnt_tracker, tracker);
+ if (!tracker) {
+ ref_tracker_free(&dev->refcnt_tracker, NULL);
+ } else if (!IS_ERR(*tracker)) {
+ ref_tracker_free(&dev->refcnt_tracker, tracker);
+ *tracker = ERR_PTR(-EEXIST);
+ }
#endif
}
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index a93321db8fd75d30c61e146c290bbc139c37c913..6ca7cec17b3164a481e72368376315d9b9d289cd 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -568,16 +568,18 @@ static void dev_watchdog(struct timer_list *t)
dev->netdev_ops->ndo_tx_timeout(dev, i);
netif_unfreeze_queues(dev);
}
- if (!mod_timer(&dev->watchdog_timer,
- round_jiffies(oldest_start +
- dev->watchdog_timeo)))
- release = false;
+ mod_timer(&dev->watchdog_timer,
+ round_jiffies(oldest_start +
+ dev->watchdog_timeo));
+ release = false;
}
}
- spin_unlock(&dev->tx_global_lock);
-
+ if (timer_pending(&dev->watchdog_timer))
+ release = false;
if (release)
netdev_put(dev, &dev->watchdog_dev_tracker);
+
+ spin_unlock(&dev->tx_global_lock);
}
void netdev_watchdog_up(struct net_device *dev)
@@ -586,10 +588,14 @@ void netdev_watchdog_up(struct net_device *dev)
return;
if (dev->watchdog_timeo <= 0)
dev->watchdog_timeo = 5*HZ;
+ spin_lock_bh(&dev->tx_global_lock);
if (!mod_timer(&dev->watchdog_timer,
- round_jiffies(jiffies + dev->watchdog_timeo)))
- netdev_hold(dev, &dev->watchdog_dev_tracker,
- GFP_ATOMIC);
+ round_jiffies(jiffies + dev->watchdog_timeo))) {
+ if (IS_ERR_OR_NULL(dev->watchdog_dev_tracker))
+ netdev_hold(dev, &dev->watchdog_dev_tracker,
+ GFP_ATOMIC);
+ }
+ spin_unlock_bh(&dev->tx_global_lock);
}
EXPORT_SYMBOL_GPL(netdev_watchdog_up);
@@ -614,8 +620,6 @@ void netif_carrier_on(struct net_device *dev)
return;
atomic_inc(&dev->carrier_up_count);
linkwatch_fire_event(dev);
- if (netif_running(dev))
- netdev_watchdog_up(dev);
}
}
EXPORT_SYMBOL(netif_carrier_on);
--
2.54.0.1032.g2f8565e1d1-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] net: watchdog: fix refcount tracking races
2026-06-08 12:39 [PATCH net] net: watchdog: fix refcount tracking races Eric Dumazet
@ 2026-06-08 16:01 ` Jakub Kicinski
2026-06-08 16:15 ` Eric Dumazet
2026-06-08 20:59 ` kernel test robot
1 sibling, 1 reply; 4+ messages in thread
From: Jakub Kicinski @ 2026-06-08 16:01 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Paolo Abeni, Simon Horman, Kuniyuki Iwashima,
netdev, eric.dumazet, syzbot+381d82bbf0253710b35d,
syzbot+3479efbc2821cb2a79f2
On Mon, 8 Jun 2026 12:39:35 +0000 Eric Dumazet wrote:
> Blamed commit converted the untracked dev_hold()/dev_put() calls
> in the watchdog code to use the tracked dev_hold_track()/dev_put_track()
> (which were later renamed/interfaced to netdev_hold() and netdev_put()).
selftest kernel build says:
net/sched/sch_generic.c: In function ‘netdev_watchdog_up’:
net/sched/sch_generic.c:594:39: error: incompatible type for argument 1 of ‘IS_ERR_OR_NULL’
594 | if (IS_ERR_OR_NULL(dev->watchdog_dev_tracker))
| ~~~^~~~~~~~~~~~~~~~~~~~~~
| |
| netdevice_tracker
config:
https://netdev-ctrl.bots.linux.dev/logs/vmksft/forwarding/results/682182/config
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] net: watchdog: fix refcount tracking races
2026-06-08 16:01 ` Jakub Kicinski
@ 2026-06-08 16:15 ` Eric Dumazet
0 siblings, 0 replies; 4+ messages in thread
From: Eric Dumazet @ 2026-06-08 16:15 UTC (permalink / raw)
To: Jakub Kicinski
Cc: David S . Miller, Paolo Abeni, Simon Horman, Kuniyuki Iwashima,
netdev, eric.dumazet, syzbot+381d82bbf0253710b35d,
syzbot+3479efbc2821cb2a79f2
On Mon, Jun 8, 2026 at 9:01 AM Jakub Kicinski <kuba@kernel•org> wrote:
>
> On Mon, 8 Jun 2026 12:39:35 +0000 Eric Dumazet wrote:
> > Blamed commit converted the untracked dev_hold()/dev_put() calls
> > in the watchdog code to use the tracked dev_hold_track()/dev_put_track()
> > (which were later renamed/interfaced to netdev_hold() and netdev_put()).
>
> selftest kernel build says:
>
> net/sched/sch_generic.c: In function ‘netdev_watchdog_up’:
> net/sched/sch_generic.c:594:39: error: incompatible type for argument 1 of ‘IS_ERR_OR_NULL’
> 594 | if (IS_ERR_OR_NULL(dev->watchdog_dev_tracker))
> | ~~~^~~~~~~~~~~~~~~~~~~~~~
> | |
> | netdevice_tracker
>
> config:
> https://netdev-ctrl.bots.linux.dev/logs/vmksft/forwarding/results/682182/config
Oh right, I should have guarded this
#ifdef CONFIG_NET_DEV_REFCNT_TRACKER
if (IS_ERR_OR_NULL(dev->watchdog_dev_tracker))
#endif
netdev_hold(dev, &dev->watchdog_dev_tracker,
GFP_ATOMIC);
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] net: watchdog: fix refcount tracking races
2026-06-08 12:39 [PATCH net] net: watchdog: fix refcount tracking races Eric Dumazet
2026-06-08 16:01 ` Jakub Kicinski
@ 2026-06-08 20:59 ` kernel test robot
1 sibling, 0 replies; 4+ messages in thread
From: kernel test robot @ 2026-06-08 20:59 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: oe-kbuild-all, Simon Horman, Kuniyuki Iwashima, netdev,
eric.dumazet, Eric Dumazet, syzbot+381d82bbf0253710b35d,
syzbot+3479efbc2821cb2a79f2
Hi Eric,
kernel test robot noticed the following build errors:
[auto build test ERROR on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/Eric-Dumazet/net-watchdog-fix-refcount-tracking-races/20260608-205327
base: net/main
patch link: https://lore.kernel.org/r/20260608123935.524879-1-edumazet%40google.com
patch subject: [PATCH net] net: watchdog: fix refcount tracking races
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20260608/202606082235.DIth7s08-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260608/202606082235.DIth7s08-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel•com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606082235.DIth7s08-lkp@intel.com/
All errors (new ones prefixed by >>):
net/sched/sch_generic.c: In function 'netdev_watchdog_up':
>> net/sched/sch_generic.c:594:39: error: incompatible type for argument 1 of 'IS_ERR_OR_NULL'
594 | if (IS_ERR_OR_NULL(dev->watchdog_dev_tracker))
| ~~~^~~~~~~~~~~~~~~~~~~~~~
| |
| netdevice_tracker
In file included from include/linux/cleanup.h:6,
from include/linux/jump_label.h:78,
from include/linux/dynamic_debug.h:6,
from include/linux/printk.h:620,
from include/asm-generic/bug.h:31,
from arch/x86/include/asm/bug.h:193,
from arch/x86/include/asm/alternative.h:9,
from arch/x86/include/asm/barrier.h:5,
from include/asm-generic/bitops/generic-non-atomic.h:7,
from include/linux/bitops.h:28,
from net/sched/sch_generic.c:10:
include/linux/err.h:90:68: note: expected 'const void *' but argument is of type 'netdevice_tracker'
90 | static inline bool __must_check IS_ERR_OR_NULL(__force const void *ptr)
| ~~~~~~~~~~~~^~~
vim +/IS_ERR_OR_NULL +594 net/sched/sch_generic.c
584
585 void netdev_watchdog_up(struct net_device *dev)
586 {
587 if (!dev->netdev_ops->ndo_tx_timeout)
588 return;
589 if (dev->watchdog_timeo <= 0)
590 dev->watchdog_timeo = 5*HZ;
591 spin_lock_bh(&dev->tx_global_lock);
592 if (!mod_timer(&dev->watchdog_timer,
593 round_jiffies(jiffies + dev->watchdog_timeo))) {
> 594 if (IS_ERR_OR_NULL(dev->watchdog_dev_tracker))
595 netdev_hold(dev, &dev->watchdog_dev_tracker,
596 GFP_ATOMIC);
597 }
598 spin_unlock_bh(&dev->tx_global_lock);
599 }
600 EXPORT_SYMBOL_GPL(netdev_watchdog_up);
601
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-06-08 21:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-08 12:39 [PATCH net] net: watchdog: fix refcount tracking races Eric Dumazet
2026-06-08 16:01 ` Jakub Kicinski
2026-06-08 16:15 ` Eric Dumazet
2026-06-08 20:59 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox