[PATCH net] net: dcb: flush rewrite table on device unregister

[PATCH net] net: dcb: flush rewrite table on device unregister

[Wenbo Sun]

In dcbnl_flush_dev(), which is called upon NETDEV_UNREGISTER for net
devices with dcbnl_ops, only entries in dcb_app_list matching
dev->ifindex are freed. The entries in dcb_rewr_list added via
dcb_setrewr() are not flushed.

This causes a memory leak of struct dcb_app_type nodes in dcb_rewr_list
when a DCB-capable net device is unregistered, and leaves stale entries
in the global rewrite table that could inappropriately match if another
net device later reuses the same ifindex.

Iterate over dcb_rewr_list in dcbnl_flush_dev() and remove and free all
entries matching dev->ifindex, mirroring the cleanup performed for
dcb_app_list.

This issue was found via LLM-assisted code review, confirmed by
reproducing the leaked rewrite table entry upon netdevice unregistration
in a User-Mode Linux (ARCH=um) environment, and verified in UML by
confirming that all rewrite table entries for the unregistered netdevice
are flushed.

Fixes: 622f1b2fae2e ("net: dcb: add new rewrite table")
Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
---
 net/dcb/dcbnl.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index ad0aebe0ad3d..95250658ecc1 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -2393,6 +2393,13 @@ static void dcbnl_flush_dev(struct net_device *dev)
 		}
 	}
 
+	list_for_each_entry_safe(itr, tmp, &dcb_rewr_list, list) {
+		if (itr->ifindex == dev->ifindex) {
+			list_del(&itr->list);
+			kfree(itr);
+		}
+	}
+
 	spin_unlock_bh(&dcb_lock);
 }
 
-- 
2.33.0

Re: [PATCH net] net: dcb: flush rewrite table on device unregister

[Daniel Machon]

On Wed, Nov 11, 2026 at 11:31:14AM +0800, Wenbo Sun wrote:
> In dcbnl_flush_dev(), which is called upon NETDEV_UNREGISTER for net
> devices with dcbnl_ops, only entries in dcb_app_list matching
> dev->ifindex are freed. The entries in dcb_rewr_list added via
> dcb_setrewr() are not flushed.
> 
> This causes a memory leak of struct dcb_app_type nodes in dcb_rewr_list
> when a DCB-capable net device is unregistered, and leaves stale entries
> in the global rewrite table that could inappropriately match if another
> net device later reuses the same ifindex.
> 
> Iterate over dcb_rewr_list in dcbnl_flush_dev() and remove and free all
> entries matching dev->ifindex, mirroring the cleanup performed for
> dcb_app_list.
> 
> This issue was found via LLM-assisted code review, confirmed by
> reproducing the leaked rewrite table entry upon netdevice unregistration
> in a User-Mode Linux (ARCH=um) environment, and verified in UML by
> confirming that all rewrite table entries for the unregistered netdevice
> are flushed.
> 
> Fixes: 622f1b2fae2e ("net: dcb: add new rewrite table")
> Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>

Thanks for the fix!

I reproduced it on lan969x. After a device is unregistered, another
DCB-capable device that gets the same ifindex reports the old
device's rewrite entries in "dcb rewr show". With this patch the
table is empty.

Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
Tested-by: Daniel Machon <daniel.machon@microchip.com>

Re: [PATCH net] net: dcb: flush rewrite table on device unregister

[Petr Machata]

Wenbo Sun <sunwenbo@cmss.chinamobile.com> writes:

> In dcbnl_flush_dev(), which is called upon NETDEV_UNREGISTER for net
> devices with dcbnl_ops, only entries in dcb_app_list matching
> dev->ifindex are freed. The entries in dcb_rewr_list added via
> dcb_setrewr() are not flushed.
>
> This causes a memory leak of struct dcb_app_type nodes in dcb_rewr_list
> when a DCB-capable net device is unregistered, and leaves stale entries
> in the global rewrite table that could inappropriately match if another
> net device later reuses the same ifindex.
>
> Iterate over dcb_rewr_list in dcbnl_flush_dev() and remove and free all
> entries matching dev->ifindex, mirroring the cleanup performed for
> dcb_app_list.
>
> This issue was found via LLM-assisted code review, confirmed by
> reproducing the leaked rewrite table entry upon netdevice unregistration
> in a User-Mode Linux (ARCH=um) environment, and verified in UML by
> confirming that all rewrite table entries for the unregistered netdevice
> are flushed.
>
> Fixes: 622f1b2fae2e ("net: dcb: add new rewrite table")
> Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>

Reviewed-by: Petr Machata <petrm@nvidia.com>

However, this has never worked, is therefore not a regression, and
should target net-next.