[PATCH net-next v2] net: dcb: flush rewrite table on device unregister

[Wenbo Sun]

In dcbnl_flush_dev(), which is called upon NETDEV_UNREGISTER for net
devices with dcbnl_ops, only entries in dcb_app_list matching
dev->ifindex are freed. The entries in dcb_rewr_list added via
dcb_setrewr() are not flushed.

This causes a memory leak of struct dcb_app_type nodes in dcb_rewr_list
when a DCB-capable net device is unregistered, and leaves stale entries
in the global rewrite table that could inappropriately match if another
net device later reuses the same ifindex.

Iterate over dcb_rewr_list in dcbnl_flush_dev() and remove and free all
entries matching dev->ifindex, mirroring the cleanup performed for
dcb_app_list.

This issue was found via LLM-assisted code review, confirmed by
reproducing the leaked rewrite table entry upon netdevice unregistration
in a User-Mode Linux (ARCH=um) environment, and verified in UML by
confirming that all rewrite table entries for the unregistered netdevice
are flushed.

Fixes: 622f1b2fae2e ("net: dcb: add new rewrite table")
Reviewed-by: Daniel Machon <daniel.machon@xxxxxxxxxxxxx>
Tested-by: Daniel Machon <daniel.machon@xxxxxxxxxxxxx>
Reviewed-by: Petr Machata <petrm@xxxxxxxxxx>
Signed-off-by: Wenbo Sun <sunwenbo@xxxxxxxxxxxxxxxxxxxx>
---
v2:
  - Target net-next instead of net, as this has never worked and is not
    a regression (Petr Machata).
  - Add Reviewed-by and Tested-by tags from Daniel Machon (verified on
    lan969x) and Reviewed-by tag from Petr Machata.
v1: https://lore.kernel.org/netdev/20261111033114.133296-1-sunwenbo@xxxxxxxxxxxxxxxxxxxx/

 net/dcb/dcbnl.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index ad0aebe0ad3d..95250658ecc1 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -2393,6 +2393,13 @@ static void dcbnl_flush_dev(struct net_device *dev)
 		}
 	}
 
+	list_for_each_entry_safe(itr, tmp, &dcb_rewr_list, list) {
+		if (itr->ifindex == dev->ifindex) {
+			list_del(&itr->list);
+			kfree(itr);
+		}
+	}
+
 	spin_unlock_bh(&dcb_lock);
 }
 
-- 
2.33.0