Commit 1341db32 authored by Yuho Choi's avatar Yuho Choi Committed by Jakub Kicinski
Browse files

ipv6: route: Unregister netdevice notifier on BPF init failure 



ip6_route_init() registers ip6_route_dev_notifier before registering the
IPv6 route BPF iterator target. If bpf_iter_register() fails after the
notifier has been registered, the error path currently jumps to
out_register_late_subsys and unwinds the RTNL handlers and pernet route
state without removing the notifier from the netdevice notifier chain.

This leaves ip6_route_dev_notify() callable after the IPv6 route state it
uses has been torn down. Add a separate unwind label for the BPF iterator
failure path and unregister the netdevice notifier before continuing with
the existing cleanup.

Fixes: 138d0be3 ("net: bpf: Add netlink and ipv6_route bpf_iter targets")
Signed-off-by: default avatarYuho Choi <dbgh9129@gmail.com>
Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260520030329.1061183-1-dbgh9129@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 92cc6708

net/ipv6/route.c

+5 −1
Original line number Diff line number Diff line
@@ -6933,7 +6933,7 @@ int __init ip6_route_init(void) 
#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)

	ret = bpf_iter_register();

	if (ret)

		goto out_register_late_subsys;

		goto out_register_notifier;

#endif



	for_each_possible_cpu(cpu) {
@@ -6946,6 +6946,10 @@ int __init ip6_route_init(void) 
out:

	return ret;



#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)

out_register_notifier:

	unregister_netdevice_notifier(&ip6_route_dev_notifier);

#endif

out_register_late_subsys:

	rtnl_unregister_all(PF_INET6);

	unregister_pernet_subsys(&ip6_route_net_late_ops);