patch 'fib6: fix memory leak on delete operation' has been queued to stable release 24.11.4

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 24.11.4

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/05/25. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/8b48ab770c01db3f2a75970c08ba7480c3e91e5c

Thanks.

Kevin

---
>From 8b48ab770c01db3f2a75970c08ba7480c3e91e5c Mon Sep 17 00:00:00 2001
From: Vladimir Medvedkin <vladimir.medvedkin at intel.com>
Date: Tue, 14 Oct 2025 18:17:54 +0000
Subject: [PATCH] fib6: fix memory leak on delete operation

[ upstream commit f4905fdcf6b43ee1499e431ca433fd7570c71224 ]

When deleting a prefix, the first attempt to get next prefix cannot
return NULL as we will at a minimum get the prefix we are trying to
delete, whereas we were rather interested in whether there are other
prefixes within the same subtree, not counting the prefix we are
deleting. To address this, we check if we have found the exact prefix we
started with, and perform another search to see if there are more
prefixes to be found.

In addition to that, doing the searches with _COVER rather than _ALL is
incorrect, because if we are doing search with _COVER rather than _ALL, we
do not dive into the tree to find more specific prefixes within the
prefix we are going to delete, and thus will not notice if our subtree
also has more specific prefixes. To fix it, perform first (and
subsequent) searches with _ALL rather than _COVER.

Finally, when we hit the "tmp == NULL" branch (meaning, when we are
deleting the only node that exists in our subtree), we know that the
rib6_lookup will always return us the node that we are trying to delete,
but this is incorrect because further code will consider this to be our
parent node. Address this by doing another search to find the parent of
the current node.

Fixes: c3e12e0f0354 ("fib: add dataplane algorithm for IPv6")

Signed-off-by: Vladimir Medvedkin <vladimir.medvedkin at intel.com>
Tested-by: Robin Jarry <rjarry at redhat.com>
---
 lib/fib/trie.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/lib/fib/trie.c b/lib/fib/trie.c
index 4893f6c636..e186d2ecfe 100644
--- a/lib/fib/trie.c
+++ b/lib/fib/trie.c
@@ -516,5 +516,5 @@ trie_modify(struct rte_fib6 *fib, const struct rte_ipv6_addr *ip,
 	struct rte_rib6_node *node;
 	struct rte_rib6_node *parent;
-	struct rte_ipv6_addr ip_masked;
+	struct rte_ipv6_addr ip_masked, tmp_ip;
 	int ret = 0;
 	uint64_t par_nh, node_nh;
@@ -535,7 +535,23 @@ trie_modify(struct rte_fib6 *fib, const struct rte_ipv6_addr *ip,
 		tmp = rte_rib6_get_nxt(rib, &ip_masked,
 			RTE_ALIGN_FLOOR(depth, 8), NULL,
-			RTE_RIB6_GET_NXT_COVER);
+			RTE_RIB6_GET_NXT_ALL);
+		if (tmp && op == RTE_FIB6_DEL) {
+			/* in case of delete operation, skip the prefix we are going to delete */
+			rte_rib6_get_ip(tmp, &tmp_ip);
+			rte_rib6_get_depth(tmp, &tmp_depth);
+			if (rte_ipv6_addr_eq(&ip_masked, &tmp_ip) && depth == tmp_depth)
+				tmp = rte_rib6_get_nxt(rib, &ip_masked,
+					RTE_ALIGN_FLOOR(depth, 8), tmp, RTE_RIB6_GET_NXT_ALL);
+		}
+
 		if (tmp == NULL) {
 			tmp = rte_rib6_lookup(rib, ip);
+			/**
+			 * in case of delete operation, lookup returns the prefix
+			 * we are going to delete. Find the parent.
+			 */
+			if (tmp && op == RTE_FIB6_DEL)
+				tmp = rte_rib6_lookup_parent(tmp);
+
 			if (tmp != NULL) {
 				rte_rib6_get_depth(tmp, &tmp_depth);
-- 
2.51.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2025-10-31 13:53:54.409231681 +0000
+++ 0071-fib6-fix-memory-leak-on-delete-operation.patch	2025-10-31 13:53:52.174617799 +0000
@@ -1 +1 @@
-From f4905fdcf6b43ee1499e431ca433fd7570c71224 Mon Sep 17 00:00:00 2001
+From 8b48ab770c01db3f2a75970c08ba7480c3e91e5c Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit f4905fdcf6b43ee1499e431ca433fd7570c71224 ]
+
@@ -29 +30,0 @@
-Cc: stable at dpdk.org
@@ -38 +39 @@
-index ff4c750952..5a9978b4ca 100644
+index 4893f6c636..e186d2ecfe 100644
@@ -41 +42 @@
-@@ -517,5 +517,5 @@ trie_modify(struct rte_fib6 *fib, const struct rte_ipv6_addr *ip,
+@@ -516,5 +516,5 @@ trie_modify(struct rte_fib6 *fib, const struct rte_ipv6_addr *ip,
@@ -48 +49 @@
-@@ -536,7 +536,23 @@ trie_modify(struct rte_fib6 *fib, const struct rte_ipv6_addr *ip,
+@@ -535,7 +535,23 @@ trie_modify(struct rte_fib6 *fib, const struct rte_ipv6_addr *ip,