[lvc-project] [PATCH net-next v8] l2tp: fix double dst_release() on sk_dst_cache race

[Jakub Kicinski]

On Mon, 15 Dec 2025 17:55:33 +0300 Mikhail Lobanov wrote:
> A reproducible rcuref - imbalanced put() warning is observed under
> IPv6 L2TP (pppol2tp) traffic with blackhole routes, indicating an
> imbalance in dst reference counting for routes cached in
> sk->sk_dst_cache and pointing to a subtle lifetime/synchronization
> issue between the helpers that validate and drop cached dst entries.

This seems to be causing a leak:

unreferenced object 0xffff888017774e40 (size 64):
  comm "ip", pid 3486, jiffies 4298584595
  hex dump (first 32 bytes):
    10 00 00 00 e9 01 00 00 01 00 00 00 00 00 00 00  ................
    ff ff ff ff 00 00 00 00 48 4e 77 17 80 88 ff ff  ........HNw.....
  backtrace (crc b523287):
    __kmalloc_node_noprof+0x579/0x8c0
    crypto_alloc_tfmmem.isra.0+0x2e/0xf0
    crypto_create_tfm_node+0x81/0x2e0
    crypto_spawn_tfm2+0x4e/0x80
    crypto_rfc4106_init_tfm+0x41/0x190
    crypto_create_tfm_node+0x108/0x2e0
    crypto_spawn_tfm2+0x4e/0x80
    aead_init_geniv+0x14c/0x2a0
    crypto_create_tfm_node+0x108/0x2e0
    crypto_alloc_tfm_node+0xe0/0x1d0
    esp_init_aead.constprop.0+0xe4/0x340
    esp_init_state+0x83/0x4c0
    __xfrm_init_state+0x6f2/0x13d0
    xfrm_state_construct+0x1455/0x2480 [xfrm_user]
    xfrm_add_sa+0x137/0x3c0 [xfrm_user]
    xfrm_user_rcv_msg+0x502/0x920 [xfrm_user]