On Sat, Mar 24, 2018 at 09:31:02AM -0600, David Ahern wrote:

On 3/24/18 8:31 AM, Ido Schimmel wrote:

quoted

On Sun, Mar 18, 2018 at 08:36:20PM -0700, David Ahern wrote:

quoted

@@ -405,18 +383,9 @@ static void ip6_dst_destroy(struct dst_entry *dst)
 		rt->rt6i_idev = NULL;
 		in6_dev_put(idev);
 	}
-	bucket = rcu_dereference_protected(rt->rt6i_exception_bucket, 1);
-	if (bucket) {
-		rt->rt6i_exception_bucket = NULL;
-		kfree(bucket);
-	}
-
-	m = rt->fib6_metrics;
-	if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))
-		kfree(m);

You remove this...

quoted

 
 	rt->from = NULL;
-	dst_release(&from->dst);
+	fib6_info_release(from);

Yet fib6_info_release() doesn't take care of it (unlike the IPv4
equivalent), which means you're leaking the metrics.

quoted

 }

ok, I'll take a look. I thought I verified both paths (fib6_info and
dst) were freeing the metrics.

I get this from kmemleak (applied your patchset on top of fe2d55d295cf):

unreferenced object 0xffff88004e2c16c8 (size 96):
comm "systemd-network", pid 1255, jiffies 4295166424 (age 957.858s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
backtrace:
ip6_route_info_create (/net/ipv6/route.c:2849) 
ip6_route_add (/net/ipv6/route.c:2975) 
inet6_rtm_newroute (/net/ipv6/route.c:4357) 
rtnetlink_rcv_msg (/net/core/rtnetlink.c:4643) 
netlink_rcv_skb (/net/netlink/af_netlink.c:2445) 
netlink_unicast (/net/netlink/af_netlink.c:1309 /net/netlink/af_netlink.c:1334) 
netlink_sendmsg (/net/netlink/af_netlink.c:1897) 
sock_sendmsg (/net/socket.c:630 /net/socket.c:639) 
SYSC_sendto (/net/socket.c:1748) 
do_syscall_64 (/arch/x86/entry/common.c:287) 
entry_SYSCALL_64_after_hwframe (/arch/x86/entry/entry_64.S:239) 
0xffffffffffffffff (/./include/asm-generic/sections.h:42)