[PATCH] l2tp: fix tunnel refcount leak on register failure

[PATCH] l2tp: fix tunnel refcount leak on register failure

[Wentao Liang]

pppol2tp_tunnel_get() creates a new tunnel via l2tp_tunnel_create()
which initializes tunnel->ref_count to 1, then increments it to 2 via
refcount_inc(). If l2tp_tunnel_register() subsequently fails, the
error path calls kfree(tunnel) directly, bypassing the refcount
mechanism entirely. This leaves the tunnel's ref_count at 2 with no
way to properly release it through l2tp_tunnel_put().

Replace kfree(tunnel) with l2tp_tunnel_put(tunnel) to properly release
the reference through the standard refcount cleanup path, which will
call l2tp_tunnel_free() when the counter reaches zero.

Cc: stable@vger.kernel.org
Fixes: 6b9f34239b00 ("l2tp: fix races in tunnel creation")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 net/l2tp/l2tp_ppp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 99d6582f41de..16672e9df748 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -661,7 +661,7 @@ static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net,
 			refcount_inc(&tunnel->ref_count);
 			error = l2tp_tunnel_register(tunnel, net, &tcfg);
 			if (error < 0) {
-				kfree(tunnel);
+				l2tp_tunnel_put(tunnel);
 				return ERR_PTR(error);
 			}
 
-- 
2.34.1

Re: [PATCH] l2tp: fix tunnel refcount leak on register failure

[Guillaume Nault]

On Thu, May 28, 2026 at 04:34:18AM +0000, Wentao Liang wrote:
> pppol2tp_tunnel_get() creates a new tunnel via l2tp_tunnel_create()
> which initializes tunnel->ref_count to 1, then increments it to 2 via
> refcount_inc(). If l2tp_tunnel_register() subsequently fails, the
> error path calls kfree(tunnel) directly, bypassing the refcount
> mechanism entirely.

This is the expected behaviour. Since l2tp_tunnel_register() failed,
the tunnel hasn't been exposed to the rest of the system and we're
guaranteed that nothing depends on it.

> This leaves the tunnel's ref_count at 2 with no
> way to properly release it through l2tp_tunnel_put().

The tunnel is simply freed. The refcount doesn't matter here.

> Replace kfree(tunnel) with l2tp_tunnel_put(tunnel) to properly release
> the reference through the standard refcount cleanup path, which will
> call l2tp_tunnel_free() when the counter reaches zero.

This is buggy. At this point, the refcount is 2, and l2tp_tunnel_put()
will decrement it by only one. So this patch just leaks the the tunnel
forever.

> Cc: stable@vger.kernel.org
> Fixes: 6b9f34239b00 ("l2tp: fix races in tunnel creation")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  net/l2tp/l2tp_ppp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
> index 99d6582f41de..16672e9df748 100644
> --- a/net/l2tp/l2tp_ppp.c
> +++ b/net/l2tp/l2tp_ppp.c
> @@ -661,7 +661,7 @@ static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net,
>  			refcount_inc(&tunnel->ref_count);
>  			error = l2tp_tunnel_register(tunnel, net, &tcfg);
>  			if (error < 0) {
> -				kfree(tunnel);
> +				l2tp_tunnel_put(tunnel);
>  				return ERR_PTR(error);
>  			}
>  
> -- 
> 2.34.1
> 
>