On 6/3/19 12:09 PM, Wei Wang wrote:

quoted

@@ -667,6 +704,13 @@ static void __remove_nexthop_fib(struct net *net, struct nexthop *nh)
        }
        if (do_flush)
                fib_flush(net);
+
+       /* ip6_del_rt removes the entry from this list hence the _safe */
+       list_for_each_entry_safe(f6i, tmp, &nh->f6i_list, nh_list) {
+               /* __ip6_del_rt does a release, so do a hold here */
+               fib6_info_hold(f6i);

Do we need fib6_info_hold_safe() here?

I do not think so.

If it is on the f6i_list, then fib6_purge_rt has not been called.
fib6_purge_rt and this function are both called with rtnl held, so there
is no race with the removal from the list.