netdev - Re: [BUG nexthop] refcount leak in "struct nexthop" handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4a682f36-44a0-42c9-a82a-25fed5024cb2@kernel.org>
Date: Sat, 20 Dec 2025 10:54:27 -0700
From: David Ahern <dsahern@...nel.org>
To: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>,
 "David S. Miller" <davem@...emloft.net>,
 Kuniyuki Iwashima <kuniyu@...gle.com>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>,
 Network Development <netdev@...r.kernel.org>,
 Ido Schimmel <idosch@...sch.org>
Subject: Re: [BUG nexthop] refcount leak in "struct nexthop" handling

On 12/20/25 7:57 AM, Tetsuo Handa wrote:
> syzbot is reporting refcount leak in "struct nexthop" handling
> which manifests as a hung up with below message.
> 

...

> 
> Commit ab84be7e54fc ("net: Initial nexthop code") says
> 
>   Nexthop notifications are sent when a nexthop is added or deleted,
>   but NOT if the delete is due to a device event or network namespace
>   teardown (which also involves device events).
> 
> which I guess that it is an intended behavior that
> nexthop_notify(RTM_DELNEXTHOP) is not called from remove_nexthop() from
> flush_all_nexthops() from nexthop_net_exit_rtnl() from ops_undo_list()
>  from cleanup_net() because remove_nexthop() passes nlinfo == NULL.
> 
> However, like the attached reproducer demonstrates, it is inevitable that
> a userspace process terminates and network namespace teardown automatically
> happens without explicitly invoking RTM_DELNEXTHOP request. The kernel is
> not currently prepared for such scenario. How to fix this problem?
> 
> Link: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84

thanks for the report and a reproducer. I am about to go offline for a
week, so I will not have time to take a look until the last few days of
December. Adding Ido in case he has time between now and then.