memory leak in udp_tunnel_nic_netdevice

memory leak in udp_tunnel_nic_netdevice_event

Status: upstream: reported C repro on 2026/07/24 09:06
Subsystems: net
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+eca845fb8c18dd6b44c1@syzkaller.appspotmail.com
Fix commit: net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
Patched on: [ci-upstream-net-this-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 63d, last: 5d06h

▶ ▼ ✨ AI Jobs (1)

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
c48e0368	assessment-security	DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	memory leak in udp_tunnel_nic_netdevice_event	2026/05/29 22:42	2026/05/29 22:42	2026/05/29 23:15	6b4a8443

▶ ▼ Discussions (2)

Title	Replies (including bot)	Last reply
[PATCH net] net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()	3 (3)	2026/07/28 11:40
[syzbot] [net?] memory leak in udp_tunnel_nic_netdevice_event	0 (1)	2026/07/24 09:06

▶ ▼ Last patch testing requests (8)


Created	Duration	User	Patch	Repo	Result
2026/07/24 08:10	30m	edumazet@google.com		upstream	report log
2026/07/13 02:51	37m	edumazet@google.com	patch	upstream	OK log
2026/07/12 18:36	30m	edumazet@google.com	patch	upstream	OK log
2026/07/01 04:49	29m	retest repro		upstream	report log
2026/07/01 04:49	1h24m	retest repro		upstream	report log
2026/07/01 04:49	3h14m	retest repro		upstream	report log
2026/06/10 08:24	39m	retest repro		upstream	report log
2026/06/10 08:24	31m	retest repro		upstream	report log

Sample crash report:

2026/07/12 04:07:42 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888127d5f840 (size 96):
  comm "syz-executor", pid 5806, jiffies 4294942188
  hex dump (first 32 bytes):
    00 00 00 01 00 00 00 00 48 f8 d5 27 81 88 ff ff  ........H..'....
    48 f8 d5 27 81 88 ff ff 10 7d da 84 ff ff ff ff  H..'.....}......
  backtrace (crc 99fdb6c8):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4625 [inline]
    slab_alloc_node mm/slub.c:4945 [inline]
    __do_kmalloc_node mm/slub.c:5361 [inline]
    __kmalloc_noprof+0x3bf/0x550 mm/slub.c:5387
    _kmalloc_noprof include/linux/slab.h:973 [inline]
    _kzalloc_noprof include/linux/slab.h:1290 [inline]
    udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]
    udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]
    udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931
    notifier_call_chain+0x59/0x160 kernel/notifier.c:85
    call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250
    call_netdevice_notifiers_extack net/core/dev.c:2288 [inline]
    call_netdevice_notifiers net/core/dev.c:2302 [inline]
    register_netdevice+0xc10/0xeb0 net/core/dev.c:11478
    nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
    nsim_create+0x424/0x5b0 drivers/net/netdevsim/netdev.c:1152
    __nsim_dev_port_add+0x266/0x450 drivers/net/netdevsim/dev.c:1509
    nsim_dev_port_add_all drivers/net/netdevsim/dev.c:1570 [inline]
    nsim_drv_probe+0x79c/0x930 drivers/net/netdevsim/dev.c:1731
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (6):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Assets (help?)	Manager	Title
2026/07/12 04:08	upstream	dd3210c47e8d	d78ea535	.config	console log	report	syz / log	C	[disk image] [vmlinux] [kernel image]	ci-upstream-gce-leak	memory leak in udp_tunnel_nic_netdevice_event
2026/06/15 00:17	upstream	e21ee273e6fa	1d2f3589	.config	console log	report	syz / log		[disk image] [vmlinux] [kernel image]	ci-upstream-gce-leak	memory leak in udp_tunnel_nic_netdevice_event
2026/06/14 23:32	upstream	e21ee273e6fa	1d2f3589	.config	console log	report	syz / log		[disk image] [vmlinux] [kernel image]	ci-upstream-gce-leak	memory leak in udp_tunnel_nic_netdevice_event
2026/06/14 22:00	upstream	e21ee273e6fa	1d2f3589	.config	console log	report	syz / log		[disk image] [vmlinux] [kernel image]	ci-upstream-gce-leak	memory leak in udp_tunnel_nic_netdevice_event
2026/05/27 07:59	upstream	d60ec36cab33	2b01f00e	.config	console log	report	syz / log		[disk image] [vmlinux] [kernel image]	ci-upstream-gce-leak	memory leak in udp_tunnel_nic_netdevice_event
2026/05/27 07:18	upstream	d60ec36cab33	2b01f00e	.config	console log	report	syz / log		[disk image] [vmlinux] [kernel image]	ci-upstream-gce-leak	memory leak in udp_tunnel_nic_netdevice_event

* ~~Struck through~~ repros no longer work on HEAD.