linux-kernel - Re: [PATCH net-next v8] l2tp: fix double dst_release() on sk_dst

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251216083541.70fb3b54@kernel.org>
Date: Tue, 16 Dec 2025 08:35:41 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: Mikhail Lobanov <m.lobanov@...a.ru>
Cc: "David S. Miller" <davem@...emloft.net>, Eric Dumazet
 <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>, Simon Horman
 <horms@...nel.org>, David Bauer <mail@...id-bauer.net>, James Chapman
 <jchapman@...alix.com>, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org
Subject: Re: [PATCH net-next v8] l2tp: fix double dst_release() on
 sk_dst_cache race

On Mon, 15 Dec 2025 17:55:33 +0300 Mikhail Lobanov wrote:
> A reproducible rcuref - imbalanced put() warning is observed under
> IPv6 L2TP (pppol2tp) traffic with blackhole routes, indicating an
> imbalance in dst reference counting for routes cached in
> sk->sk_dst_cache and pointing to a subtle lifetime/synchronization
> issue between the helpers that validate and drop cached dst entries.

This seems to be causing a leak:

unreferenced object 0xffff888017774e40 (size 64):
  comm "ip", pid 3486, jiffies 4298584595
  hex dump (first 32 bytes):
    10 00 00 00 e9 01 00 00 01 00 00 00 00 00 00 00  ................
    ff ff ff ff 00 00 00 00 48 4e 77 17 80 88 ff ff  ........HNw.....
  backtrace (crc b523287):
    __kmalloc_node_noprof+0x579/0x8c0
    crypto_alloc_tfmmem.isra.0+0x2e/0xf0
    crypto_create_tfm_node+0x81/0x2e0
    crypto_spawn_tfm2+0x4e/0x80
    crypto_rfc4106_init_tfm+0x41/0x190
    crypto_create_tfm_node+0x108/0x2e0
    crypto_spawn_tfm2+0x4e/0x80
    aead_init_geniv+0x14c/0x2a0
    crypto_create_tfm_node+0x108/0x2e0
    crypto_alloc_tfm_node+0xe0/0x1d0
    esp_init_aead.constprop.0+0xe4/0x340
    esp_init_state+0x83/0x4c0
    __xfrm_init_state+0x6f2/0x13d0
    xfrm_state_construct+0x1455/0x2480 [xfrm_user]
    xfrm_add_sa+0x137/0x3c0 [xfrm_user]
    xfrm_user_rcv_msg+0x502/0x920 [xfrm_user]