ip6_route_init() registers ip6_route_dev_notifier before registering the
IPv6 route BPF iterator target. If bpf_iter_register() fails after the
notifier has been registered, the error path currently jumps to
out_register_late_subsys and unwinds the RTNL handlers and pernet route
state without removing the notifier from the netdevice notifier chain.

This leaves ip6_route_dev_notify() callable after the IPv6 route state it
uses has been torn down. Add a separate unwind label for the BPF iterator
failure path and unregister the netdevice notifier before continuing with
the existing cleanup.

Fixes: 138d0be35b14 ("net: bpf: Add netlink and ipv6_route bpf_iter targets")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
Chagnes since v2:
- Rebase on current net/ipv6/route.c.
- Keep the goto-based unwind path.
- Guard the notifier unwind label with the same BPF/procfs condition.
Chages since v1:
- Unregister ip6_route_dev_notifier directlry in the bpf_iter_register() failure path.
 net/ipv6/route.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e3d355d1fbd6..b106e5fef9cb 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -6933,7 +6933,7 @@ int __init ip6_route_init(void)
 #if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
 	ret = bpf_iter_register();
 	if (ret)
-		goto out_register_late_subsys;
+		goto out_register_notifier;
 #endif
 
 	for_each_possible_cpu(cpu) {
@@ -6946,6 +6946,10 @@ int __init ip6_route_init(void)
 out:
 	return ret;
 
+#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
+out_register_notifier:
+	unregister_netdevice_notifier(&ip6_route_dev_notifier);
+#endif
 out_register_late_subsys:
 	rtnl_unregister_all(PF_INET6);
 	unregister_pernet_subsys(&ip6_route_net_late_ops);
-- 
2.43.0

Subject prefix should be [PATCH net v3]. See:

https://docs.kernel.org/process/maintainer-netdev.html

On Tue, May 19, 2026 at 11:03:28PM -0400, Yuho Choi wrote:
> ip6_route_init() registers ip6_route_dev_notifier before registering the
> IPv6 route BPF iterator target. If bpf_iter_register() fails after the
> notifier has been registered, the error path currently jumps to
> out_register_late_subsys and unwinds the RTNL handlers and pernet route
> state without removing the notifier from the netdevice notifier chain.
> 
> This leaves ip6_route_dev_notify() callable after the IPv6 route state it
> uses has been torn down. Add a separate unwind label for the BPF iterator
> failure path and unregister the netdevice notifier before continuing with
> the existing cleanup.
> 
> Fixes: 138d0be35b14 ("net: bpf: Add netlink and ipv6_route bpf_iter targets")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>