[PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release

[PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release

[Eric Dumazet]

In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state
(pd->tunnel and pd->session) is kept in seq_file private data to allow
iteration across multiple read() system calls.

However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels
before reading to end-of-file (EOF), any tunnel or session reference stored in
pd->tunnel / pd->session is left un-dropped when seq_file private data is freed.

Fix this by dropping any remaining pd->tunnel and pd->session references in
pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.

Fixes: 0e0c3fee3a59 ("l2tp: hold reference on tunnels printed in pppol2tp proc file")
Fixes: f726214d9b23 ("l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file")
Reported-by: syzbot+d6fa74e3f19d6ee01e3a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a760f32.01d0871a.3a0d52.004f.GAE@google.com/T/#u
Assisted-by: Jetski:Gemini-3.1-Pro
Cc: James Chapman <jchapman@katalix.com>
Cc: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/l2tp/l2tp_debugfs.c |  4 ++++
 net/l2tp/l2tp_ppp.c     | 51 +++++++++++++++++++++++++++++++++++++++--
 2 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index b26986fda9d6cf096519d56032fe3deb5034c7c8..c12d5e1ee550ccc2608b6128cb653ca373280373 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -306,6 +306,10 @@ static int l2tp_dfs_seq_release(struct inode *inode, struct file *file)
 
 	seq = file->private_data;
 	pd = seq->private;
+	if (pd->session)
+		l2tp_session_put(pd->session);
+	if (pd->tunnel)
+		l2tp_tunnel_put(pd->tunnel);
 	if (pd->net)
 		put_net_track(pd->net, &pd->ns_tracker);
 	kfree(pd);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index f8881699e1cad88e6f312e6ca47ae0af94c6137c..1bcf447f2f8b08235fdec747d33fd188e869a382 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1597,6 +1597,53 @@ static const struct seq_operations pppol2tp_seq_ops = {
 	.stop		= pppol2tp_seq_stop,
 	.show		= pppol2tp_seq_show,
 };
+
+static int pppol2tp_proc_open(struct inode *inode, struct file *file)
+{
+	struct net *net = pde_data(inode);
+	struct pppol2tp_seq_data *pd;
+
+	net = maybe_get_net(net);
+	if (!net)
+		return -ENXIO;
+
+	pd = __seq_open_private(file, &pppol2tp_seq_ops, sizeof(*pd));
+	if (!pd) {
+		put_net(net);
+		return -ENOMEM;
+	}
+
+#ifdef CONFIG_NET_NS
+	pd->p.net = net;
+	netns_tracker_alloc(net, &pd->p.ns_tracker, GFP_KERNEL);
+#endif
+	return 0;
+}
+
+static int pppol2tp_proc_release(struct inode *inode, struct file *file)
+{
+	struct seq_file *seq = file->private_data;
+	struct pppol2tp_seq_data *pd = seq->private;
+
+	if (pd->session)
+		l2tp_session_put(pd->session);
+	if (pd->tunnel)
+		l2tp_tunnel_put(pd->tunnel);
+
+#ifdef CONFIG_NET_NS
+	put_net_track(pd->p.net, &pd->p.ns_tracker);
+#else
+	put_net(&init_net);
+#endif
+	return seq_release_private(inode, file);
+}
+
+static const struct proc_ops pppol2tp_proc_ops = {
+	.proc_open	= pppol2tp_proc_open,
+	.proc_read	= seq_read,
+	.proc_lseek	= seq_lseek,
+	.proc_release	= pppol2tp_proc_release,
+};
 #endif /* CONFIG_PROC_FS */
 
 /*****************************************************************************
@@ -1608,8 +1655,8 @@ static __net_init int pppol2tp_init_net(struct net *net)
 	struct proc_dir_entry *pde;
 	int err = 0;
 
-	pde = proc_create_net("pppol2tp", 0444, net->proc_net,
-			      &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data));
+	pde = proc_create_data("pppol2tp", 0444, net->proc_net,
+			       &pppol2tp_proc_ops, net);
 	if (!pde) {
 		err = -ENOMEM;
 		goto out;
-- 
2.55.0.654.g21b8a5bc05-goog

Re: [PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release

[Paolo Abeni]

On 8/10/26 4:11 PM, Eric Dumazet wrote:
> @@ -1608,8 +1655,8 @@ static __net_init int pppol2tp_init_net(struct net *net)
>  	struct proc_dir_entry *pde;
>  	int err = 0;
>  
> -	pde = proc_create_net("pppol2tp", 0444, net->proc_net,
> -			      &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data));
> +	pde = proc_create_data("pppol2tp", 0444, net->proc_net,
> +			       &pppol2tp_proc_ops, net);

It looks like the above does not build with CONFIG_PROC_FS=n:

net/l2tp/l2tp_ppp.c: In function ‘pppol2tp_init_net’:
net/l2tp/l2tp_ppp.c:1659:33: error: ‘pppol2tp_proc_ops’ undeclared (first use in this function); did you mean ‘pppol2tp_chan_ops’?
 1659 |                                &pppol2tp_proc_ops, net);
      |                                 ^~~~~~~~~~~~~~~~~
      |                                 pppol2tp_chan_ops

/P

Re: [PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release

[Eric Dumazet]

On Tue, Aug 11, 2026 at 12:20 PM Paolo Abeni <pabeni@redhat.com> wrote:
>
> On 8/10/26 4:11 PM, Eric Dumazet wrote:
> > @@ -1608,8 +1655,8 @@ static __net_init int pppol2tp_init_net(struct net *net)
> >       struct proc_dir_entry *pde;
> >       int err = 0;
> >
> > -     pde = proc_create_net("pppol2tp", 0444, net->proc_net,
> > -                           &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data));
> > +     pde = proc_create_data("pppol2tp", 0444, net->proc_net,
> > +                            &pppol2tp_proc_ops, net);
>
> It looks like the above does not build with CONFIG_PROC_FS=n:
>
> net/l2tp/l2tp_ppp.c: In function ‘pppol2tp_init_net’:
> net/l2tp/l2tp_ppp.c:1659:33: error: ‘pppol2tp_proc_ops’ undeclared (first use in this function); did you mean ‘pppol2tp_chan_ops’?
>  1659 |                                &pppol2tp_proc_ops, net);
>       |                                 ^~~~~~~~~~~~~~~~~
>       |                                 pppol2tp_chan_ops
>

For some reason, proc_create_net() is a NOP for CONFIG_PROC_FS=n, but
proc_create_data() is not.

Oh well.

Re: [PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release

[kernel test robot]

Hi Eric,

kernel test robot noticed the following build errors:

[auto build test ERROR on horms-ipvs/master]
[cannot apply to net/main net-next/main linus/master v7.2 next-20260819]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Eric-Dumazet/l2tp-fix-tunnel-and-session-refcount-leak-on-seq_file-release/20260810-141125
base:   https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git master
patch link:    https://lore.kernel.org/r/20260810141125.1176545-1-edumazet%40google.com
patch subject: [PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release
config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20260820/202608201604.4Zj72hcA-lkp@intel.com/config)
compiler: powerpc64-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260820/202608201604.4Zj72hcA-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608201604.4Zj72hcA-lkp@intel.com/

All errors (new ones prefixed by >>):

   net/l2tp/l2tp_ppp.c: In function 'pppol2tp_proc_release':
>> net/l2tp/l2tp_ppp.c:1641:17: error: implicit declaration of function 'l2tp_session_put'; did you mean 'l2tp_session_get'? [-Wimplicit-function-declaration]
    1641 |                 l2tp_session_put(pd->session);
         |                 ^~~~~~~~~~~~~~~~
         |                 l2tp_session_get
>> net/l2tp/l2tp_ppp.c:1643:17: error: implicit declaration of function 'l2tp_tunnel_put'; did you mean 'l2tp_tunnel_get'? [-Wimplicit-function-declaration]
    1643 |                 l2tp_tunnel_put(pd->tunnel);
         |                 ^~~~~~~~~~~~~~~
         |                 l2tp_tunnel_get
--
   net/l2tp/l2tp_debugfs.c: In function 'l2tp_dfs_seq_release':
>> net/l2tp/l2tp_debugfs.c:311:17: error: implicit declaration of function 'l2tp_session_put'; did you mean 'l2tp_session_get'? [-Wimplicit-function-declaration]
     311 |                 l2tp_session_put(pd->session);
         |                 ^~~~~~~~~~~~~~~~
         |                 l2tp_session_get
>> net/l2tp/l2tp_debugfs.c:313:17: error: implicit declaration of function 'l2tp_tunnel_put'; did you mean 'l2tp_tunnel_get'? [-Wimplicit-function-declaration]
     313 |                 l2tp_tunnel_put(pd->tunnel);
         |                 ^~~~~~~~~~~~~~~
         |                 l2tp_tunnel_get


vim +1641 net/l2tp/l2tp_ppp.c

  1634	
  1635	static int pppol2tp_proc_release(struct inode *inode, struct file *file)
  1636	{
  1637		struct seq_file *seq = file->private_data;
  1638		struct pppol2tp_seq_data *pd = seq->private;
  1639	
  1640		if (pd->session)
> 1641			l2tp_session_put(pd->session);
  1642		if (pd->tunnel)
> 1643			l2tp_tunnel_put(pd->tunnel);
  1644	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release

[Eric Dumazet]

On Thu, Aug 20, 2026 at 10:13 AM kernel test robot <lkp@intel.com> wrote:
>
> Hi Eric,
>
> kernel test robot noticed the following build errors:
>
> [auto build test ERROR on horms-ipvs/master]
> [cannot apply to net/main net-next/main linus/master v7.2 next-20260819]
> [If your patch is applied to the wrong git tree, kindly drop us a note.
> And when submitting patch, we suggest to use '--base' as documented in
> https://git-scm.com/docs/git-format-patch#_base_tree_information]
>
> url:    https://github.com/intel-lab-lkp/linux/commits/Eric-Dumazet/l2tp-fix-tunnel-and-session-refcount-leak-on-seq_file-release/20260810-141125
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git master
> patch link:    https://lore.kernel.org/r/20260810141125.1176545-1-edumazet%40google.com
> patch subject: [PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release
> config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20260820/202608201604.4Zj72hcA-lkp@intel.com/config)
> compiler: powerpc64-linux-gcc (GCC) 16.1.0
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260820/202608201604.4Zj72hcA-lkp@intel.com/reproduce)

10 days to test a patch is unacceptable.

Please ensure reports are not sent 10 days late to avoid spamming litsts?

Thank you.

Re: [PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release

[Philip Li]

On Thu, Aug 20, 2026 at 11:19:46AM +0200, Eric Dumazet wrote:
> On Thu, Aug 20, 2026 at 10:13 AM kernel test robot <lkp@intel.com> wrote:
> >
> > Hi Eric,
> >
> > kernel test robot noticed the following build errors:
> >
> > [auto build test ERROR on horms-ipvs/master]
> > [cannot apply to net/main net-next/main linus/master v7.2 next-20260819]
> > [If your patch is applied to the wrong git tree, kindly drop us a note.
> > And when submitting patch, we suggest to use '--base' as documented in
> > https://git-scm.com/docs/git-format-patch#_base_tree_information]
> >
> > url:    https://github.com/intel-lab-lkp/linux/commits/Eric-Dumazet/l2tp-fix-tunnel-and-session-refcount-leak-on-seq_file-release/20260810-141125
> > base:   https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git master
> > patch link:    https://lore.kernel.org/r/20260810141125.1176545-1-edumazet%40google.com
> > patch subject: [PATCH v2 net] l2tp: fix tunnel and session refcount leak on seq_file release
> > config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20260820/202608201604.4Zj72hcA-lkp@intel.com/config)
> > compiler: powerpc64-linux-gcc (GCC) 16.1.0
> > reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260820/202608201604.4Zj72hcA-lkp@intel.com/reproduce)
> 
> 10 days to test a patch is unacceptable.
> 
> Please ensure reports are not sent 10 days late to avoid spamming litsts?

Sorry about this, the bot account had failed to receive patches for a while.
It is just recovered and starts to test the old patches.

I will configure the bot to avoid sending results for old patch to avoid spam.

> 
> Thank you.
>