In dcbnl_flush_dev(), which is called upon NETDEV_UNREGISTER for net devices with dcbnl_ops, only entries in dcb_app_list matching dev->ifindex are freed. The entries in dcb_rewr_list added via dcb_setrewr() are not flushed. This causes a memory leak of struct dcb_app_type nodes in dcb_rewr_list when a DCB-capable net device is unregistered, and leaves stale entries in the global rewrite table that could inappropriately match if another net device later reuses the same ifindex. Iterate over dcb_rewr_list in dcbnl_flush_dev() and remove and free all entries matching dev->ifindex, mirroring the cleanup performed for dcb_app_list. This issue was found via LLM-assisted code review, confirmed by reproducing the leaked rewrite table entry upon netdevice unregistration in a User-Mode Linux (ARCH=um) environment, and verified in UML by confirming that all rewrite table entries for the unregistered netdevice are flushed. Fixes: 622f1b2fae2e ("net: dcb: add new rewrite table") Reviewed-by: Daniel Machon Tested-by: Daniel Machon Reviewed-by: Petr Machata Signed-off-by: Wenbo Sun --- v2: - Target net-next instead of net, as this has never worked and is not a regression (Petr Machata). - Add Reviewed-by and Tested-by tags from Daniel Machon (verified on lan969x) and Reviewed-by tag from Petr Machata. v1: https://lore.kernel.org/netdev/20261111033114.133296-1-sunwenbo@cmss.chinamobile.com/ net/dcb/dcbnl.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c index ad0aebe0ad3d..95250658ecc1 100644 --- a/net/dcb/dcbnl.c +++ b/net/dcb/dcbnl.c @@ -2393,6 +2393,13 @@ static void dcbnl_flush_dev(struct net_device *dev) } } + list_for_each_entry_safe(itr, tmp, &dcb_rewr_list, list) { + if (itr->ifindex == dev->ifindex) { + list_del(&itr->list); + kfree(itr); + } + } + spin_unlock_bh(&dcb_lock); } -- 2.33.0