[PATCH net] ipv6: release fib6_null_entry on subtree failure

[PATCH net] ipv6: release fib6_null_entry on subtree failure

[Shuangpeng Bai]

When adding a source-specific route creates a new subtree, fib6_add()
installs fib6_null_entry as the temporary leaf of the new subtree root
and takes a fib6_info reference for that holder.

If adding the first source leaf fails, the code frees the just allocated
subtree root but leaves that hold behind. fib6_null_entry is a per-netns
sentinel and is freed directly at netns teardown, so this does not keep
the object alive. However, it leaves its visible refcount permanently
elevated and can eventually saturate the refcount on repeated failures.

Drop the null-entry reference before freeing the unlinked subtree root.

Fixes: 5ea715289af6 ("ipv6: broadly use fib6_info_hold() helper")
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 net/ipv6/ip6_fib.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index a130cdfaebfb..e9fc692d4f3b 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1494,6 +1494,7 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt,
 				   root, and then (in failure) stale node
 				   in main tree.
 				 */
+				fib6_info_release(info->nl_net->ipv6.fib6_null_entry);
 				node_free_immediate(info->nl_net, sfn);
 				err = PTR_ERR(sn);
 				goto failure;
-- 
2.43.0

Re: [PATCH net] ipv6: release fib6_null_entry on subtree failure

[Ido Schimmel]

On Mon, Jul 27, 2026 at 02:53:39PM -0400, Shuangpeng Bai wrote:
> When adding a source-specific route creates a new subtree, fib6_add()
> installs fib6_null_entry as the temporary leaf of the new subtree root
> and takes a fib6_info reference for that holder.
> 
> If adding the first source leaf fails, the code frees the just allocated
> subtree root but leaves that hold behind. fib6_null_entry is a per-netns
> sentinel and is freed directly at netns teardown, so this does not keep
> the object alive. However, it leaves its visible refcount permanently
> elevated and can eventually saturate the refcount on repeated failures.
> 
> Drop the null-entry reference before freeing the unlinked subtree root.
> 
> Fixes: 5ea715289af6 ("ipv6: broadly use fib6_info_hold() helper")

Should be:

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>