On 1/5/21 5:22 PM, Sean Tranchetti wrote:
> From: Sean Tranchetti <stran...@codeaurora.org>
>
> Route removal is handled by two code paths. The main removal path is via
> fib6_del_route() which will handle purging any PMTU exceptions from the
> cache, removing all per-cpu copies of the DST entry used by the route, and
> releasing the fib6_info struct.
>
> The second removal location is during fib6_add_rt2node() during a route
> replacement operation. This path also calls fib6_purge_rt() to handle
> cleaning up the per-cpu copies of the DST entries and releasing the
> fib6_info associated with the older route, but it does not flush any PMTU
> exceptions that the older route had. Since the older route is removed from
> the tree during the replacement, we lose any way of accessing it again.
>
> As these lingering DSTs and the fib6_info struct are holding references to
> the underlying netdevice struct as well, unregistering that device from the
> kernel can never complete.
>
I think the right fixes tag is:
Fixes: 2b760fcf5cfb3 ("ipv6: hook up exception table to store dst cache")
cc'ed author of that patch.
> Signed-off-by: Sean Tranchetti <stran...@codeaurora.org>
> ---
> net/ipv6/ip6_fib.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
> index 605cdd3..f43e275 100644
> --- a/net/ipv6/ip6_fib.c
> +++ b/net/ipv6/ip6_fib.c
> @@ -1025,6 +1025,8 @@ static void fib6_purge_rt(struct fib6_info *rt, struct
> fib6_node *fn,
> {
> struct fib6_table *table = rt->fib6_table;
>
> + /* Flush all cached dst in exception table */
> + rt6_flush_exceptions(rt);
> fib6_drop_pcpu_from(rt, table);
>
> if (rt->nh && !list_empty(&rt->nh_list))
> @@ -1927,9 +1929,6 @@ static void fib6_del_route(struct fib6_table *table,
> struct fib6_node *fn,
> net->ipv6.rt6_stats->fib_rt_entries--;
> net->ipv6.rt6_stats->fib_discarded_routes++;
>
> - /* Flush all cached dst in exception table */
> - rt6_flush_exceptions(rt);
> -
> /* Reset round-robin state, if necessary */
> if (rcu_access_pointer(fn->rr_ptr) == rt)
> fn->rr_ptr = NULL;
>
Reviewed-by: David Ahern <dsah...@kernel.org>
