CVE-2021-47555

======================================================================= refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 2 PID: 0 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0

and an endless loop of:

======================================================================= unregister_netdevice: waiting for dummy1 to become free. Usage count = -1073741824

That is because dev_put(real_dev) in vlan_dev_free() be called without dev_hold(real_dev) in register_vlan_dev(). It makes the refcnt of real_dev underflow.

Move the dev_hold(real_dev) to vlan_dev_init() which is the call-back of ndo_init(). That makes dev_hold() and dev_put() for vlan's real_dev symmetrical.

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47555.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "5.4.160"
            },
            {
                "fixed": "5.4.163"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.10.80"
            },
            {
                "fixed": "5.10.83"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.14.19"
            },
            {
                "fixed": "5.15"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.15.3"
            },
            {
                "fixed": "5.15.6"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "5.16-rc1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "5.16-rc2"
            }
        ]
    }
]