Re: [PATCH net] ipv6: release fib6_null_entry on subtree failure

[Ido Schimmel]

On Mon, Jul 27, 2026 at 02:53:39PM -0400, Shuangpeng Bai wrote:
> When adding a source-specific route creates a new subtree, fib6_add()
> installs fib6_null_entry as the temporary leaf of the new subtree root
> and takes a fib6_info reference for that holder.
> 
> If adding the first source leaf fails, the code frees the just allocated
> subtree root but leaves that hold behind. fib6_null_entry is a per-netns
> sentinel and is freed directly at netns teardown, so this does not keep
> the object alive. However, it leaves its visible refcount permanently
> elevated and can eventually saturate the refcount on repeated failures.
> 
> Drop the null-entry reference before freeing the unlinked subtree root.
> 
> Fixes: 5ea715289af6 ("ipv6: broadly use fib6_info_hold() helper")

Should be:

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>