From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> mainline inclusion from mainline-v7.3-rc1 commit 0b1c2af8a22c35cb099c735c2f63ea3ba757557d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19412 CVE: CVE-2026-90135 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- sashiko is reporting that trying to read /sys/kernel/debug/ref_tracker/* causes use-afer-free crash when either alloc_percpu() or dev_addr_init() in alloc_netdev_mqs() failed, for commit 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure") added ref_tracker_dir_exit() to only free_netdev() path. Closes: https://sashiko.dev/#/patchset/56c707e7-1fb0-43ec-b8fb-cf6f451e513e%40I-love... Fixes: 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure") Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/b06ce35d-e7bc-47a5-8e0a-e82be7e4dd08@I-love.SAKURA.... Signed-off-by: Jakub Kicinski <kuba@kernel.org> Conflicts: net/core/dev.c [Conflicts are caused by the following patches not being merged: 13cabc47f8ae ("netdevice: define and allocate &net_device _properly_")] Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> --- net/core/dev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/core/dev.c b/net/core/dev.c index 662c22e15fc2d..42b30aaa61c10 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -11131,6 +11131,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, free_percpu(dev->pcpu_refcnt); free_dev: #endif + ref_tracker_dir_exit(&dev->refcnt_tracker); netdev_freemem(dev); return NULL; } -- 2.33.8