syzbot

 sign-in | mailing list | source | docs
🐞 Open [1453]
≡ Subsystems
🐞 Fixed [6871]
🐞 Invalid [17836]
⬇ Missing Backports [225]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

memory leak in l2tp_tunnel_create

Status: upstream: reported C repro on 2026/01/13 18:50
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+2c42ea4485b29beb0643@syzkaller.appspotmail.com
Fix commit: l2tp: Fix memleak in l2tp_udp_encap_recv().
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 71d, last: 2d14h
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH v1 net] l2tp: Fix memleak in l2tp_udp_encap_recv(). 3 (3) 2026/01/16 04:00
[syzbot] [net?] memory leak in l2tp_tunnel_create 0 (1) 2026/01/13 18:50
▶ ▼ Last patch testing requests (7)
Created Duration User Patch Repo Result
2026/01/13 17:43 39m kuniyu@google.com patch upstream error
2026/01/09 16:54 20m kuniyu@google.com upstream error
2026/01/06 11:00 14m retest repro upstream report log
2026/01/06 11:00 20m retest repro upstream report log
2025/11/28 00:48 25m retest repro upstream report log
2025/11/28 00:48 17m retest repro upstream report log
2025/11/28 00:48 42m retest repro upstream report log

Sample crash report:
2026/01/17 14:05:09 executed programs: 5
BUG: memory leak
unreferenced object 0xffff8881295d0a00 (size 256):
  comm "syz.0.17", pid 6085, jiffies 4294945025
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc bab578b4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    l2tp_tunnel_create+0x55/0x130 net/l2tp/l2tp_core.c:1573
    pppol2tp_tunnel_get+0x134/0x250 net/l2tp/l2tp_ppp.c:653
    pppol2tp_connect+0x234/0x920 net/l2tp/l2tp_ppp.c:710
    __sys_connect_file+0x7a/0xb0 net/socket.c:2089
    __sys_connect+0xde/0x110 net/socket.c:2108
    __do_sys_connect net/socket.c:2114 [inline]
    __se_sys_connect net/socket.c:2111 [inline]
    __x64_sys_connect+0x1c/0x30 net/socket.c:2111
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888112db3e00 (size 512):
  comm "syz.0.17", pid 6085, jiffies 4294945025
  hex dump (first 32 bytes):
    7d eb 04 0c 00 00 00 00 01 00 00 00 00 00 00 00  }...............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc e8addf39):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    l2tp_session_create+0x3a/0x3b0 net/l2tp/l2tp_core.c:1778
    pppol2tp_connect+0x48b/0x920 net/l2tp/l2tp_ppp.c:755
    __sys_connect_file+0x7a/0xb0 net/socket.c:2089
    __sys_connect+0xde/0x110 net/socket.c:2108
    __do_sys_connect net/socket.c:2114 [inline]
    __se_sys_connect net/socket.c:2111 [inline]
    __x64_sys_connect+0x1c/0x30 net/socket.c:2111
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810a32bf40 (size 1472):
  comm "syz.0.18", pid 6087, jiffies 4294945026
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 22 0e 6d 2d 00 00 00 00  ........".m-....
    0a 00 07 40 00 00 00 00 98 8b 32 0a 81 88 ff ff  ...@......2.....
  backtrace (crc f69aac):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270
    sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:2239
    sk_alloc+0x36/0x440 net/core/sock.c:2301
    inet6_create net/ipv6/af_inet6.c:193 [inline]
    inet6_create+0x163/0x550 net/ipv6/af_inet6.c:120
    __sock_create+0x1a9/0x310 net/socket.c:1605
    sock_create net/socket.c:1663 [inline]
    __sys_socket_create net/socket.c:1700 [inline]
    __sys_socket+0xb9/0x1a0 net/socket.c:1747
    __do_sys_socket net/socket.c:1761 [inline]
    __se_sys_socket net/socket.c:1759 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1759
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129638960 (size 32):
  comm "syz.0.18", pid 6087, jiffies 4294945026
  hex dump (first 32 bytes):
    f8 52 86 00 81 88 ff ff 00 00 00 00 00 00 00 00  .R..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc bad1c2bd):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    lsm_blob_alloc+0x4d/0x70 security/security.c:192
    lsm_sock_alloc security/security.c:4375 [inline]
    security_sk_alloc+0x2f/0x270 security/security.c:4391
    sk_prot_alloc+0x8f/0x1b0 net/core/sock.c:2248
    sk_alloc+0x36/0x440 net/core/sock.c:2301
    inet6_create net/ipv6/af_inet6.c:193 [inline]
    inet6_create+0x163/0x550 net/ipv6/af_inet6.c:120
    __sock_create+0x1a9/0x310 net/socket.c:1605
    sock_create net/socket.c:1663 [inline]
    __sys_socket_create net/socket.c:1700 [inline]
    __sys_socket+0xb9/0x1a0 net/socket.c:1747
    __do_sys_socket net/socket.c:1761 [inline]
    __se_sys_socket net/socket.c:1759 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1759
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812972b480 (size 128):
  comm "syz.0.18", pid 6087, jiffies 4294945026
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    udp_lib_init_sock include/net/udp.h:297 [inline]
    udpv6_init_sock+0x88/0x120 net/ipv6/udp.c:70
    inet6_create net/ipv6/af_inet6.c:259 [inline]
    inet6_create+0x383/0x550 net/ipv6/af_inet6.c:120
    __sock_create+0x1a9/0x310 net/socket.c:1605
    sock_create net/socket.c:1663 [inline]
    __sys_socket_create net/socket.c:1700 [inline]
    __sys_socket+0xb9/0x1a0 net/socket.c:1747
    __do_sys_socket net/socket.c:1761 [inline]
    __se_sys_socket net/socket.c:1759 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1759
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812abe5a00 (size 256):
  comm "syz.0.18", pid 6087, jiffies 4294945026
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 12796480):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    l2tp_tunnel_create+0x55/0x130 net/l2tp/l2tp_core.c:1573
    pppol2tp_tunnel_get+0x134/0x250 net/l2tp/l2tp_ppp.c:653
    pppol2tp_connect+0x234/0x920 net/l2tp/l2tp_ppp.c:710
    __sys_connect_file+0x7a/0xb0 net/socket.c:2089
    __sys_connect+0xde/0x110 net/socket.c:2108
    __do_sys_connect net/socket.c:2114 [inline]
    __se_sys_connect net/socket.c:2111 [inline]
    __x64_sys_connect+0x1c/0x30 net/socket.c:2111
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/17 14:05 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
2026/01/14 03:16 upstream b54345928fa1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
2026/01/14 02:33 upstream b54345928fa1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
2026/01/08 08:27 upstream f0b9d8eb98df d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
2025/12/23 10:46 upstream b927546677c8 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
2025/11/13 16:38 upstream e927c520e1ba 07e030de .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
2025/11/12 12:50 upstream 24172e0d7990 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
2025/11/09 10:12 upstream 7bb4d6512545 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
2025/12/15 18:25 upstream 8f0b4cce4481 d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in l2tp_tunnel_create
* Struck through repros no longer work on HEAD.