ip6_route_init() registers ip6_route_dev_notifier before registering the IPv6 route BPF iterator target. If bpf_iter_register() fails, the error path jumps to out_register_late_subsys and unwinds the RTNL handlers and late pernet subsystem, but leaves the netdevice notifier registered. Unregister the netdevice notifier in the bpf_iter_register() failure branch before continuing with the existing cleanup path. Fixes: 138d0be35b14 ("net: bpf: Add netlink and ipv6_route bpf_iter targets") Signed-off-by: Yuho Choi --- Chages since v1: - Unregister ip6_route_dev_notifier directlry in the bpf_iter_register() failure path. net/ipv6/route.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index cb521700cee7..de9a1d4c72d8 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -6924,8 +6924,10 @@ int __init ip6_route_init(void) #if IS_BUILTIN(CONFIG_IPV6) #if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS) ret = bpf_iter_register(); - if (ret) + if (ret) { + unregister_netdevice_notifier(&ip6_route_dev_notifier); goto out_register_late_subsys; + } #endif #endif -- 2.43.0