memory leak in udp_tunnel_nic_netdevice_event

Status: fixed on 2026/09/14 10:32
Subsystems: net
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+eca845fb8c18dd6b44c1@syzkaller.appspotmail.com
Fix commit: 080695e6f005 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
First crash: 110d, last: 52d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
c48e0368 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in udp_tunnel_nic_netdevice_event 2026/05/29 22:42 2026/05/29 22:42 2026/05/29 23:15 6b4a8443
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH net] net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() 3 (3) 2026/07/28 11:40
[syzbot] [net?] memory leak in udp_tunnel_nic_netdevice_event 0 (1) 2026/07/24 09:06
▶ ▼ Last patch testing requests (8)
Created Duration User Patch Repo Result
2026/07/24 08:10 30m edumazet@google.com upstream report log
2026/07/13 02:51 37m edumazet@google.com patch upstream OK log
2026/07/12 18:36 30m edumazet@google.com patch upstream OK log
2026/07/01 04:49 29m retest repro upstream report log
2026/07/01 04:49 1h24m retest repro upstream report log
2026/07/01 04:49 3h14m retest repro upstream report log
2026/06/10 08:24 39m retest repro upstream report log
2026/06/10 08:24 31m retest repro upstream report log

Sample crash report:
2026/07/12 04:07:42 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888127d5f840 (size 96):
  comm "syz-executor", pid 5806, jiffies 4294942188
  hex dump (first 32 bytes):
    00 00 00 01 00 00 00 00 48 f8 d5 27 81 88 ff ff  ........H..'....
    48 f8 d5 27 81 88 ff ff 10 7d da 84 ff ff ff ff  H..'.....}......
  backtrace (crc 99fdb6c8):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4625 [inline]
    slab_alloc_node mm/slub.c:4945 [inline]
    __do_kmalloc_node mm/slub.c:5361 [inline]
    __kmalloc_noprof+0x3bf/0x550 mm/slub.c:5387
    _kmalloc_noprof include/linux/slab.h:973 [inline]
    _kzalloc_noprof include/linux/slab.h:1290 [inline]
    udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]
    udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]
    udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931
    notifier_call_chain+0x59/0x160 kernel/notifier.c:85
    call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250
    call_netdevice_notifiers_extack net/core/dev.c:2288 [inline]
    call_netdevice_notifiers net/core/dev.c:2302 [inline]
    register_netdevice+0xc10/0xeb0 net/core/dev.c:11478
    nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
    nsim_create+0x424/0x5b0 drivers/net/netdevsim/netdev.c:1152
    __nsim_dev_port_add+0x266/0x450 drivers/net/netdevsim/dev.c:1509
    nsim_dev_port_add_all drivers/net/netdevsim/dev.c:1570 [inline]
    nsim_drv_probe+0x79c/0x930 drivers/net/netdevsim/dev.c:1731
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/12 04:08 upstream dd3210c47e8d d78ea535 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in udp_tunnel_nic_netdevice_event
2026/06/15 00:17 upstream e21ee273e6fa 1d2f3589 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in udp_tunnel_nic_netdevice_event
2026/06/14 23:32 upstream e21ee273e6fa 1d2f3589 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in udp_tunnel_nic_netdevice_event
2026/06/14 22:00 upstream e21ee273e6fa 1d2f3589 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in udp_tunnel_nic_netdevice_event
2026/05/27 07:59 upstream d60ec36cab33 2b01f00e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in udp_tunnel_nic_netdevice_event
2026/05/27 07:18 upstream d60ec36cab33 2b01f00e .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in udp_tunnel_nic_netdevice_event
* Struck through repros no longer work on HEAD.