Re: [PATCH] l2tp: fix tunnel refcount leak on register failure

[Guillaume Nault]

On Thu, May 28, 2026 at 04:34:18AM +0000, Wentao Liang wrote:
> pppol2tp_tunnel_get() creates a new tunnel via l2tp_tunnel_create()
> which initializes tunnel->ref_count to 1, then increments it to 2 via
> refcount_inc(). If l2tp_tunnel_register() subsequently fails, the
> error path calls kfree(tunnel) directly, bypassing the refcount
> mechanism entirely.

This is the expected behaviour. Since l2tp_tunnel_register() failed,
the tunnel hasn't been exposed to the rest of the system and we're
guaranteed that nothing depends on it.

> This leaves the tunnel's ref_count at 2 with no
> way to properly release it through l2tp_tunnel_put().

The tunnel is simply freed. The refcount doesn't matter here.

> Replace kfree(tunnel) with l2tp_tunnel_put(tunnel) to properly release
> the reference through the standard refcount cleanup path, which will
> call l2tp_tunnel_free() when the counter reaches zero.

This is buggy. At this point, the refcount is 2, and l2tp_tunnel_put()
will decrement it by only one. So this patch just leaks the the tunnel
forever.

> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 6b9f34239b00 ("l2tp: fix races in tunnel creation")
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  net/l2tp/l2tp_ppp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
> index 99d6582f41de..16672e9df748 100644
> --- a/net/l2tp/l2tp_ppp.c
> +++ b/net/l2tp/l2tp_ppp.c
> @@ -661,7 +661,7 @@ static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net,
>  			refcount_inc(&tunnel->ref_count);
>  			error = l2tp_tunnel_register(tunnel, net, &tcfg);
>  			if (error < 0) {
> -				kfree(tunnel);
> +				l2tp_tunnel_put(tunnel);
>  				return ERR_PTR(error);
>  			}
>  
> -- 
> 2.34.1
> 
>