Re: [PATCH net 1/1] net: ipv6: clear suppressed fib6 rule result

[Ido Schimmel <idosch@nvidia.com>]

On Fri, Jul 24, 2026 at 12:48:52AM +0800, Ren Wei wrote:
> From: Zhiling Zou <zhilinz@nebusec.ai>
> 
> fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
> but leaves res->rt6 pointing at the released rt6_info.
> 
> If no later rule supplies a replacement, fib6_rule_lookup() still sees
> res.rt6 and returns that stale dst to its caller. A suppressing rule can
> therefore leak a released route back to rt6_lookup(), and the next put
> hits rcuref_put_slowpath() from dst_release().
> 
> Clear res->rt6 when suppressing the route so suppressed lookups fall
> through to the null dst instead of reusing the released one.
> 
> Fixes: cdef485217d3 ("ipv6: fix memory leak in fib6_rule_suppress")

Doesn't matter in practice given this commit was backported, but it
seems that the bug was introduced by commit 7764a45a8f1f ("fib_rules:
add .suppress operation").

> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> Signed-off-by: Ren Wei <enjou1224z@gmail.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

> ---
>  net/ipv6/fib6_rules.c | 1 +
>  1 file changed, 1 insertion(+)

AFAICT, IPv4 doesn't suffer from this bug given that:

1. fib4_rule_suppress() only drops the reference from the FIB info when
FIB_LOOKUP_NOREF is not set and it is always set by fib_lookup().

2. Unlike fib6_rule_lookup(), __fib_lookup() doesn't ignore the return
value of fib_rules_lookup() and propagates it to the callers.