From: Jakub Kicinski <kuba@kernel.org>
To: Mikhail Lobanov <m.lobanov@rosa.ru>
Cc: "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Paolo Abeni <pabeni@redhat.com>, Simon Horman <horms@kernel.org>,
David Bauer <mail@david-bauer.net>,
James Chapman <jchapman@katalix.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
lvc-project@linuxtesting.org
Subject: Re: [PATCH net-next v8] l2tp: fix double dst_release() on sk_dst_cache race
Date: Tue, 16 Dec 2025 08:35:41 -0800 [thread overview]
Message-ID: <20251216083541.70fb3b54@kernel.org> (raw)
In-Reply-To: <20251215145537.5085-1-m.lobanov@rosa.ru>
On Mon, 15 Dec 2025 17:55:33 +0300 Mikhail Lobanov wrote:
> A reproducible rcuref - imbalanced put() warning is observed under
> IPv6 L2TP (pppol2tp) traffic with blackhole routes, indicating an
> imbalance in dst reference counting for routes cached in
> sk->sk_dst_cache and pointing to a subtle lifetime/synchronization
> issue between the helpers that validate and drop cached dst entries.
This seems to be causing a leak:
unreferenced object 0xffff888017774e40 (size 64):
comm "ip", pid 3486, jiffies 4298584595
hex dump (first 32 bytes):
10 00 00 00 e9 01 00 00 01 00 00 00 00 00 00 00 ................
ff ff ff ff 00 00 00 00 48 4e 77 17 80 88 ff ff ........HNw.....
backtrace (crc b523287):
__kmalloc_node_noprof+0x579/0x8c0
crypto_alloc_tfmmem.isra.0+0x2e/0xf0
crypto_create_tfm_node+0x81/0x2e0
crypto_spawn_tfm2+0x4e/0x80
crypto_rfc4106_init_tfm+0x41/0x190
crypto_create_tfm_node+0x108/0x2e0
crypto_spawn_tfm2+0x4e/0x80
aead_init_geniv+0x14c/0x2a0
crypto_create_tfm_node+0x108/0x2e0
crypto_alloc_tfm_node+0xe0/0x1d0
esp_init_aead.constprop.0+0xe4/0x340
esp_init_state+0x83/0x4c0
__xfrm_init_state+0x6f2/0x13d0
xfrm_state_construct+0x1455/0x2480 [xfrm_user]
xfrm_add_sa+0x137/0x3c0 [xfrm_user]
xfrm_user_rcv_msg+0x502/0x920 [xfrm_user]
next prev parent reply other threads:[~2025-12-16 16:35 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-15 14:55 [PATCH net-next v8] l2tp: fix double dst_release() on sk_dst_cache race Mikhail Lobanov
2025-12-16 16:35 ` Jakub Kicinski [this message]
2026-03-06 7:44 ` Li Xiasong
2026-06-01 21:23 ` Mikhail Lobanov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251216083541.70fb3b54@kernel.org \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jchapman@katalix.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=m.lobanov@rosa.ru \
--cc=mail@david-bauer.net \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.