Re: [PATCH v1 net] ipv6: Prevent rt6_insert_exception() for dying fib6_info.

[Ido Schimmel <idosch@nvidia.com>]

On Fri, Sep 18, 2026 at 08:22:05AM +0000, Kuniyuki Iwashima wrote:
> Before the cited commit, fib6_nh_flush_exceptions() always set
> from->exception_bucket_flushed = 1 under rt6_exception_lock to
> prevent rt6_insert_exception() from inserting a new exception
> for a dying fib6_info.
> 
> The flag was replaced with the FIB6_EXCEPTION_BUCKET_FLUSHED
> bit stored in nh->rt6i_exception_bucket.
> 
> The problem is that now the bit is only set when the bucket
> is not NULL and fib6_nh_flush_exceptions() is called from
> fib6_nh_release() after fib6_ref has already reached zero.
> 
> If rt6_insert_exception() is called while the target fib6_info
> is being removed via fib6_purge_rt(), a new exception could be
> created successfully because rt6_flush_exceptions() no longer
> sets the bit.
> 
> This creates a reference cycle between the fib6_info and the
> exception route, leaking the fib6_info, its nexthop device,
> and all per-CPU routes in fib6_nh->rt6i_pcpu, which stalls netdev
> unregistration.
> 
> [   34.680602] unregister_netdevice: waiting for gre6 to become free. Usage count = 68
> [   44.920675] unregister_netdevice: waiting for gre6 to become free. Usage count = 68
> [   55.176582] unregister_netdevice: waiting for gre6 to become free. Usage count = 68
> 
> Let's call fib6_drop_pcpu_from() before rt6_flush_exceptions(),
> to set fib6_destroying before rt6_exception_lock, and check
> f6i->fib6_destroying in rt6_insert_exception().
> 
> Note that FIB6_EXCEPTION_BUCKET_FLUSHED logic is dead and
> we can clean it up in net-next.
> 
> Fixes: cc5c073a693f ("ipv6: Move exception bucket to fib6_nh")
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>

Looks OK, but if you need another version (or in net-next when you
remove FIB6_EXCEPTION_BUCKET_FLUSHED), then also update the comment in
fib6_drop_pcpu_from() to make it clear that 'fib6_destroying' also
prevents the addition of exception routes and not only per-CPU ones.

Reviewed-by: Ido Schimmel <idosch@nvidia.com>