WARNING: refcount bug in igmp_start_timer

**【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）**

**一、缺陷信息**
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 12 at lib/refcount.c:25 refcount_warn_saturate+0x13c/0x270 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 12 Comm: ksoftirqd/0 Not tainted 5.10.0-08399-gd0573a5c447c-dirty #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x13c/0x270 lib/refcount.c:25
Code: 25 ff 83 e3 01 31 ff 89 de e8 c0 f5 25 ff 84 db 75 c3 e8 77 fe 25 ff 48 c7 c7 40 24 bc 83 c6 05 9a 13 b0 03 01 e8 ca a0 f2 00 <0f> 0b eb a7 e8 5b fe 25 ff 0f b6 1d 87 13 b0 03 bf 01 00 00 00 89
RSP: 0000:ffffc900000cf810 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888100b12380 RSI: ffffffff8134bc30 RDI: fffff52000019ef4
RBP: ffff88802b21b394 R08: ffffffff8133304a R09: ffffffff84f9ff83
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88802b21b394
R13: ffff88802b21b398 R14: ffff88802b21b348 R15: ffff8880278ba000
FS:  0000000000000000(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffda2993cd0 CR3: 00000001018bc002 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 __refcount_add include/linux/refcount.h:199 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 igmp_start_timer net/ipv4/igmp.c:222 [inline]
 igmp_start_timer+0x107/0x110 net/ipv4/igmp.c:216
 igmp_mod_timer+0xd9/0x140 net/ipv4/igmp.c:260
 igmp_heard_query+0x510/0xdf0 net/ipv4/igmp.c:1073
 igmp_rcv+0x2fa/0x650 net/ipv4/igmp.c:1108
 ip_protocol_deliver_rcu+0x3e7/0x470 net/ipv4/ip_input.c:211
 ip_local_deliver_finish+0xd2/0x110 net/ipv4/ip_input.c:238
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_local_deliver+0x10a/0x260 net/ipv4/ip_input.c:259
 dst_input include/net/dst.h:452 [inline]
 ip_rcv_finish+0x124/0x160 net/ipv4/ip_input.c:458
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_rcv+0xbf/0x1d0 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core+0x15f/0x190 net/core/dev.c:5381
 __netif_receive_skb+0x2e/0xe0 net/core/dev.c:5500
 process_backlog+0x131/0x2d0 net/core/dev.c:6410
 napi_poll+0x17b/0x4f0 net/core/dev.c:6861
 net_rx_action+0x183/0x3c0 net/core/dev.c:6931
 __do_softirq+0x104/0x42f kernel/softirq.c:319
 run_ksoftirqd kernel/softirq.c:675 [inline]
 run_ksoftirqd+0x1e/0x40 kernel/softirq.c:667
 smpboot_thread_fn+0x2b5/0x4a0 kernel/smpboot.c:164
 kthread+0x1f4/0x250 kernel/kthread.c:313
 ret_from_fork+0x1f/0x2d arch/x86/entry/entry_64.S:299
**内核信息：**
5.10
**缺陷归属组件：**

**缺陷归属的版本：**

**缺陷简述：**

**【环境信息】**
硬件信息
- 裸机场景请提供问题的硬件信息
- 虚拟机场景请提供虚拟机的XML文件或配置信息
软件信息
- OS版本及分支信息
- 内核信息
- 发现问题的组件版本信息
网络信息
- 如果有特殊组网，请提供网络拓扑信息

**【问题复现步骤】**，请描述具体的操作步骤
**【实际结果】**，请描述出问题的结果和影响
**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 12 at lib/refcount.c:25 refcount_warn_saturate+0x13c/0x270 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 12 Comm: ksoftirqd/0 Not tainted 5.10.0-08399-gd0573a5c447c-dirty #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x13c/0x270 lib/refcount.c:25
Code: 25 ff 83 e3 01 31 ff 89 de e8 c0 f5 25 ff 84 db 75 c3 e8 77 fe 25 ff 48 c7 c7 40 24 bc 83 c6 05 9a 13 b0 03 01 e8 ca a0 f2 00 <0f> 0b eb a7 e8 5b fe 25 ff 0f b6 1d 87 13 b0 03 bf 01 00 00 00 89
RSP: 0000:ffffc900000cf810 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888100b12380 RSI: ffffffff8134bc30 RDI: fffff52000019ef4
RBP: ffff88802b21b394 R08: ffffffff8133304a R09: ffffffff84f9ff83
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88802b21b394
R13: ffff88802b21b398 R14: ffff88802b21b348 R15: ffff8880278ba000
FS:  0000000000000000(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffda2993cd0 CR3: 00000001018bc002 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 __refcount_add include/linux/refcount.h:199 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 igmp_start_timer net/ipv4/igmp.c:222 [inline]
 igmp_start_timer+0x107/0x110 net/ipv4/igmp.c:216
 igmp_mod_timer+0xd9/0x140 net/ipv4/igmp.c:260
 igmp_heard_query+0x510/0xdf0 net/ipv4/igmp.c:1073
 igmp_rcv+0x2fa/0x650 net/ipv4/igmp.c:1108
 ip_protocol_deliver_rcu+0x3e7/0x470 net/ipv4/ip_input.c:211
 ip_local_deliver_finish+0xd2/0x110 net/ipv4/ip_input.c:238
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_local_deliver+0x10a/0x260 net/ipv4/ip_input.c:259
 dst_input include/net/dst.h:452 [inline]
 ip_rcv_finish+0x124/0x160 net/ipv4/ip_input.c:458
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_rcv+0xbf/0x1d0 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core+0x15f/0x190 net/core/dev.c:5381
 __netif_receive_skb+0x2e/0xe0 net/core/dev.c:5500
 process_backlog+0x131/0x2d0 net/core/dev.c:6410
 napi_poll+0x17b/0x4f0 net/core/dev.c:6861
 net_rx_action+0x183/0x3c0 net/core/dev.c:6931
 __do_softirq+0x104/0x42f kernel/softirq.c:319
 run_ksoftirqd kernel/softirq.c:675 [inline]
 run_ksoftirqd+0x1e/0x40 kernel/softirq.c:667
 smpboot_thread_fn+0x2b5/0x4a0 kernel/smpboot.c:164
 kthread+0x1f4/0x250 kernel/kthread.c:313
 ret_from_fork+0x1f/0x2d arch/x86/entry/entry_64.S:299
**缺陷详情参考链接：**

**缺陷分析指导链接：**
https：xxx

GVP openEuler/kernel
关闭

内容风险标识

评论 (1)

GVPopenEuler/kernel关闭

内容风险标识