Re: [PATCH net 1/1] net: ipv6: clear suppressed fib6 rule result

On Fri, Jul 24, 2026 at 12:48:52AM +0800, Ren Wei wrote:

From: Zhiling Zou <redacted>

fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
but leaves res->rt6 pointing at the released rt6_info.

If no later rule supplies a replacement, fib6_rule_lookup() still sees
res.rt6 and returns that stale dst to its caller. A suppressing rule can
therefore leak a released route back to rt6_lookup(), and the next put
hits rcuref_put_slowpath() from dst_release().

Clear res->rt6 when suppressing the route so suppressed lookups fall
through to the null dst instead of reusing the released one.

Fixes: cdef485217d3 ("ipv6: fix memory leak in fib6_rule_suppress")

Doesn't matter in practice given this commit was backported, but it
seems that the bug was introduced by commit 7764a45a8f1f ("fib_rules:
add .suppress operation").

Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zhiling Zou <redacted>
Signed-off-by: Ren Wei <redacted>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

---
 net/ipv6/fib6_rules.c | 1 +
 1 file changed, 1 insertion(+)

AFAICT, IPv4 doesn't suffer from this bug given that:

1. fib4_rule_suppress() only drops the reference from the FIB info when
FIB_LOOKUP_NOREF is not set and it is always set by fib_lookup().

2. Unlike fib6_rule_lookup(), __fib_lookup() doesn't ignore the return
value of fib_rules_lookup() and propagates it to the callers.