memory leak in l2tp_tunnel_create (2)

Status: upstream: reported C repro on 2026/08/07 17:00
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+d6fa74e3f19d6ee01e3a@syzkaller.appspotmail.com
First crash: 1d23h, last: 1d23h
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH net] l2tp: fix tunnel and session refcount leak on seq_file release 1 (1) 2026/08/07 17:10
[syzbot] [net?] memory leak in l2tp_tunnel_create (2) 0 (1) 2026/08/07 17:00
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in l2tp_tunnel_create net 3 syz, C 9 202d 206d 29/29 fixed on 2026/05/06 16:40

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88812fbbb200 (size 256):
  comm "syz.0.17", pid 6072, jiffies 4294946752
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc ff56d525):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    l2tp_tunnel_create+0x55/0x130 net/l2tp/l2tp_core.c:1581
    pppol2tp_tunnel_get+0x132/0x250 net/l2tp/l2tp_ppp.c:654
    pppol2tp_connect+0x1f4/0x8d0 net/l2tp/l2tp_ppp.c:711
    __sys_connect_file+0x7a/0xb0 net/socket.c:2135
    __sys_connect+0xe1/0x110 net/socket.c:2154
    __do_sys_connect net/socket.c:2160 [inline]
    __se_sys_connect net/socket.c:2157 [inline]
    __x64_sys_connect+0x1c/0x30 net/socket.c:2157
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888101d20b00 (size 1408):
  comm "syz.1.18", pid 6073, jiffies 4294946753
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
  backtrace (crc 66f8ac40):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    kmem_cache_alloc_noprof+0x34f/0x440 mm/slub.c:4931
    sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:2246
    sk_alloc+0x36/0x3d0 net/core/sock.c:2308
    inet_create net/ipv4/af_inet.c:333 [inline]
    inet_create+0x168/0x4b0 net/ipv4/af_inet.c:259
    __sock_create+0x1a9/0x2d0 net/socket.c:1651
    sock_create net/socket.c:1709 [inline]
    __sys_socket_create net/socket.c:1746 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1793
    __do_sys_socket net/socket.c:1807 [inline]
    __se_sys_socket net/socket.c:1805 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1805
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812d56d7e0 (size 32):
  comm "syz.1.18", pid 6073, jiffies 4294946753
  hex dump (first 32 bytes):
    f8 52 0a 00 81 88 ff ff 00 00 00 00 00 00 00 00  .R..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 42a7bc0e):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __do_kmalloc_node mm/slub.c:5333 [inline]
    __kmalloc_noprof+0x3bf/0x550 mm/slub.c:5359
    _kmalloc_noprof include/linux/slab.h:992 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    lsm_blob_alloc+0x4d/0x80 security/security.c:218
    lsm_sock_alloc security/security.c:4478 [inline]
    security_sk_alloc+0x2d/0x290 security/security.c:4494
    sk_prot_alloc+0x8f/0x1b0 net/core/sock.c:2255
    sk_alloc+0x36/0x3d0 net/core/sock.c:2308
    inet_create net/ipv4/af_inet.c:333 [inline]
    inet_create+0x168/0x4b0 net/ipv4/af_inet.c:259
    __sock_create+0x1a9/0x2d0 net/socket.c:1651
    sock_create net/socket.c:1709 [inline]
    __sys_socket_create net/socket.c:1746 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1793
    __do_sys_socket net/socket.c:1807 [inline]
    __se_sys_socket net/socket.c:1805 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1805
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812d473880 (size 128):
  comm "syz.1.18", pid 6073, jiffies 4294946753
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __do_kmalloc_node mm/slub.c:5333 [inline]
    __kmalloc_noprof+0x3bf/0x550 mm/slub.c:5359
    _kmalloc_noprof include/linux/slab.h:992 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    udp_lib_init_sock include/net/udp.h:295 [inline]
    udp_init_sock+0x88/0x120 net/ipv4/udp.c:1813
    inet_create net/ipv4/af_inet.c:391 [inline]
    inet_create+0x301/0x4b0 net/ipv4/af_inet.c:259
    __sock_create+0x1a9/0x2d0 net/socket.c:1651
    sock_create net/socket.c:1709 [inline]
    __sys_socket_create net/socket.c:1746 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1793
    __do_sys_socket net/socket.c:1807 [inline]
    __se_sys_socket net/socket.c:1805 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1805
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812fbbf800 (size 256):
  comm "syz.1.18", pid 6073, jiffies 4294946753
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 2ce433f4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    l2tp_tunnel_create+0x55/0x130 net/l2tp/l2tp_core.c:1581
    pppol2tp_tunnel_get+0x132/0x250 net/l2tp/l2tp_ppp.c:654
    pppol2tp_connect+0x1f4/0x8d0 net/l2tp/l2tp_ppp.c:711
    __sys_connect_file+0x7a/0xb0 net/socket.c:2135
    __sys_connect+0xe1/0x110 net/socket.c:2154
    __do_sys_connect net/socket.c:2160 [inline]
    __se_sys_connect net/socket.c:2157 [inline]
    __x64_sys_connect+0x1c/0x30 net/socket.c:2157
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812d747c00 (size 256):
  comm "syz.0.24", pid 6076, jiffies 4294946754
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 8e7bd6):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    l2tp_tunnel_create+0x55/0x130 net/l2tp/l2tp_core.c:1581
    pppol2tp_tunnel_get+0x132/0x250 net/l2tp/l2tp_ppp.c:654
    pppol2tp_connect+0x1f4/0x8d0 net/l2tp/l2tp_ppp.c:711
    __sys_connect_file+0x7a/0xb0 net/socket.c:2135
    __sys_connect+0xe1/0x110 net/socket.c:2154
    __do_sys_connect net/socket.c:2160 [inline]
    __se_sys_connect net/socket.c:2157 [inline]
    __x64_sys_connect+0x1c/0x30 net/socket.c:2157
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/06 07:39 upstream 0d8395707651 cd5b1963 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
* Struck through repros no longer work on HEAD.