Patch "ipv6: Fix mem leak in rt6i_pcpu" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

ipv6: Fix mem leak in rt6i_pcpu

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ipv6-fix-mem-leak-in-rt6i_pcpu.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Martin KaFai Lau <[email protected]>
Date: Tue, 5 Jul 2016 12:10:23 -0700
Subject: ipv6: Fix mem leak in rt6i_pcpu

From: Martin KaFai Lau <[email protected]>

[ Upstream commit 903ce4abdf374e3365d93bcb3df56c62008835ba ]

It was first reported and reproduced by Petr (thanks!) in
https://bugzilla.kernel.org/show_bug.cgi?id=119581

free_percpu(rt->rt6i_pcpu) used to always happen in ip6_dst_destroy().

However, after fixing a deadlock bug in
commit 9c7370a166b4 ("ipv6: Fix a potential deadlock when creating pcpu rt"), free_percpu() is not called before setting non_pcpu_rt->rt6i_pcpu to NULL.

It is worth to note that rt6i_pcpu is protected by table->tb6_lock.

kmemleak somehow did not report it. We nailed it down by observing the pcpu entries in /proc/vmallocinfo (first suggested by Hannes, thanks!).

---
 net/ipv6/ip6_fib.c |    1 +
 1 file changed, 1 insertion(+)

@@ -177,6 +177,7 @@ static void rt6_free_pcpu(struct rt6_inf
 		}
 	}
 
+	free_percpu(non_pcpu_rt->rt6i_pcpu);
 	non_pcpu_rt->rt6i_pcpu = NULL;
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/ipv6-fix-mem-leak-in-rt6i_pcpu.patch