memory leak in inet_create (3)

Status: internal: reported C repro on 2026/08/09 00:01
Subsystems: net
Labels: prio:high
[Documentation on labels]
Fix commit: 9006c116dd11 l2tp: fix tunnel and session refcount leak on seq_file release
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-native-arm64-kvm ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-usb]
First crash: 5d07h, last: 5d07h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
73f7c70c assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in inet_create (3) 2026/08/08 23:13 2026/08/08 23:13 2026/08/08 23:55 5d63f80b
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in inet_create (2) net 3 syz, C 10 2089d 2299d 0/29 auto-obsoleted due to no activity on 2022/09/29 04:08
upstream memory leak in inet_create net 3 syz, C 2 2627d 2641d 12/29 fixed on 2019/06/18 17:49

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88810af05d80 (size 1408):
  comm "syz.2.19", pid 6057, jiffies 4294946349
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
  backtrace (crc 45b6ad84):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    kmem_cache_alloc_noprof+0x34f/0x440 mm/slub.c:4931
    sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:2245
    sk_alloc+0x36/0x3d0 net/core/sock.c:2307
    inet_create net/ipv4/af_inet.c:333 [inline]
    inet_create+0x168/0x4b0 net/ipv4/af_inet.c:259
    __sock_create+0x1a9/0x2d0 net/socket.c:1651
    sock_create net/socket.c:1709 [inline]
    __sys_socket_create net/socket.c:1746 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1793
    __do_sys_socket net/socket.c:1807 [inline]
    __se_sys_socket net/socket.c:1805 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1805
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812f3fc300 (size 32):
  comm "syz.2.19", pid 6057, jiffies 4294946349
  hex dump (first 32 bytes):
    f8 52 0a 00 81 88 ff ff 00 00 00 00 00 00 00 00  .R..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 42a7bc0e):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __do_kmalloc_node mm/slub.c:5333 [inline]
    __kmalloc_noprof+0x3bf/0x550 mm/slub.c:5359
    _kmalloc_noprof include/linux/slab.h:992 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    lsm_blob_alloc+0x4d/0x80 security/security.c:218
    lsm_sock_alloc security/security.c:4478 [inline]
    security_sk_alloc+0x2d/0x290 security/security.c:4494
    sk_prot_alloc+0x8f/0x1b0 net/core/sock.c:2254
    sk_alloc+0x36/0x3d0 net/core/sock.c:2307
    inet_create net/ipv4/af_inet.c:333 [inline]
    inet_create+0x168/0x4b0 net/ipv4/af_inet.c:259
    __sock_create+0x1a9/0x2d0 net/socket.c:1651
    sock_create net/socket.c:1709 [inline]
    __sys_socket_create net/socket.c:1746 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1793
    __do_sys_socket net/socket.c:1807 [inline]
    __se_sys_socket net/socket.c:1805 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1805
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812f351600 (size 128):
  comm "syz.2.19", pid 6057, jiffies 4294946349
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __do_kmalloc_node mm/slub.c:5333 [inline]
    __kmalloc_noprof+0x3bf/0x550 mm/slub.c:5359
    _kmalloc_noprof include/linux/slab.h:992 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    udp_lib_init_sock include/net/udp.h:295 [inline]
    udp_init_sock+0x88/0x120 net/ipv4/udp.c:1813
    inet_create net/ipv4/af_inet.c:391 [inline]
    inet_create+0x301/0x4b0 net/ipv4/af_inet.c:259
    __sock_create+0x1a9/0x2d0 net/socket.c:1651
    sock_create net/socket.c:1709 [inline]
    __sys_socket_create net/socket.c:1746 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1793
    __do_sys_socket net/socket.c:1807 [inline]
    __se_sys_socket net/socket.c:1805 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1805
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812f176500 (size 256):
  comm "syz.2.19", pid 6057, jiffies 4294946349
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc e0acc96f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    l2tp_tunnel_create+0x55/0x130 net/l2tp/l2tp_core.c:1581
    pppol2tp_tunnel_get+0x132/0x250 net/l2tp/l2tp_ppp.c:654
    pppol2tp_connect+0x1f4/0x8d0 net/l2tp/l2tp_ppp.c:711
    __sys_connect_file+0x7a/0xb0 net/socket.c:2135
    __sys_connect+0xe1/0x110 net/socket.c:2154
    __do_sys_connect net/socket.c:2160 [inline]
    __se_sys_connect net/socket.c:2157 [inline]
    __x64_sys_connect+0x1c/0x30 net/socket.c:2157
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812f176400 (size 256):
  comm "syz.2.24", pid 6060, jiffies 4294946352
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 572dbdc2):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    l2tp_tunnel_create+0x55/0x130 net/l2tp/l2tp_core.c:1581
    pppol2tp_tunnel_get+0x132/0x250 net/l2tp/l2tp_ppp.c:654
    pppol2tp_connect+0x1f4/0x8d0 net/l2tp/l2tp_ppp.c:711
    __sys_connect_file+0x7a/0xb0 net/socket.c:2135
    __sys_connect+0xe1/0x110 net/socket.c:2154
    __do_sys_connect net/socket.c:2160 [inline]
    __se_sys_connect net/socket.c:2157 [inline]
    __x64_sys_connect+0x1c/0x30 net/socket.c:2157
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812f160e00 (size 256):
  comm "syz.2.25", pid 6062, jiffies 4294946354
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc cb29e57b):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    l2tp_tunnel_create+0x55/0x130 net/l2tp/l2tp_core.c:1581
    pppol2tp_tunnel_get+0x132/0x250 net/l2tp/l2tp_ppp.c:654
    pppol2tp_connect+0x1f4/0x8d0 net/l2tp/l2tp_ppp.c:711
    __sys_connect_file+0x7a/0xb0 net/socket.c:2135
    __sys_connect+0xe1/0x110 net/socket.c:2154
    __do_sys_connect net/socket.c:2160 [inline]
    __se_sys_connect net/socket.c:2157 [inline]
    __x64_sys_connect+0x1c/0x30 net/socket.c:2157
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/08 22:25 upstream a59f57e2aa12 5d63f80b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in inet_create
* Struck through repros no longer work on HEAD.