git: e5a9ad7cbf24 - stable/15 - route/fib_algo: Free leaked radix_masks in radix_lockless

The branch stable/15 has been updated by pouria:

URL: https://cgit.FreeBSD.org/src/commit/?id=e5a9ad7cbf24230bbde0882f3ed618719e2fc106

commit e5a9ad7cbf24230bbde0882f3ed618719e2fc106
Author:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
AuthorDate: 2026-08-22 20:37:58 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-09-03 23:00:54 +0000

    route/fib_algo: Free leaked radix_masks in radix_lockless
    
    radix_lockless algorithm creates its own radix tree and
    allocates its own radix_masks by directly calling rnh_addaddr().
    However, during destruction, it only frees the radix_tree without
    freeing its allocated radix_masks.
    Fix the leak by calling rn_delete() during radix_destroy().
    
    PR:             297339
    Reviewed by:    melifaro
    MFC after:      2 weeks
    Differential Revision: https://reviews.freebsd.org/D59112
    
    (cherry picked from commit 790817f5a7a640c9ceb5c2ad99135f1a69aeb77d)
---
 sys/netinet/in_fib_algo.c   | 13 ++++++++++++-
 sys/netinet6/in6_fib_algo.c | 15 +++++++++++++--
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/sys/netinet/in_fib_algo.c b/sys/netinet/in_fib_algo.c
index 95621c300064..310a99966554 100644
--- a/sys/netinet/in_fib_algo.c
+++ b/sys/netinet/in_fib_algo.c
@@ -583,13 +583,24 @@ lradix4_init(uint32_t fibnum, struct fib_data *fd, void *_old_data, void **_data
 	return (FLM_SUCCESS);
 }
 
+static int
+lradix4_free_route(struct radix_node *rn, void *arg)
+{
+	struct radix_head *head = arg;
+
+	rn_delete(rn->rn_key, rn->rn_mask, head);
+	return (0);
+}
+
 static void
 lradix4_destroy(void *_data)
 {
 	struct lradix4_data *lr = (struct lradix4_data *)_data;
 
-	if (lr->rnh != NULL)
+	if (lr->rnh != NULL) {
+		rn_walktree(&lr->rnh->rh, lradix4_free_route, &lr->rnh->rh);
 		rn_detachhead((void **)&lr->rnh);
+	}
 	if (lr->mem != NULL)
 		free(lr->mem, M_RTABLE);
 	free(lr, M_RTABLE);
diff --git a/sys/netinet6/in6_fib_algo.c b/sys/netinet6/in6_fib_algo.c
index ef5cfc6d5ef6..8551fe138d6e 100644
--- a/sys/netinet6/in6_fib_algo.c
+++ b/sys/netinet6/in6_fib_algo.c
@@ -130,7 +130,7 @@ lradix6_init(uint32_t fibnum, struct fib_data *fd, void *_old_data, void **_data
 	struct rib_rtable_info rinfo;
 	uint32_t count;
 	void *mem;
- 
+
 	lr = malloc(sizeof(struct lradix6_data), M_RTABLE, M_NOWAIT | M_ZERO);
 	if (lr == NULL || !rn_inithead((void **)&lr->rnh, OFF_LEN_INET6))
 		return (FLM_REBUILD);
@@ -151,13 +151,24 @@ lradix6_init(uint32_t fibnum, struct fib_data *fd, void *_old_data, void **_data
 	return (FLM_SUCCESS);
 }
 
+static int
+lradix6_free_route(struct radix_node *rn, void *arg)
+{
+	struct radix_head *head = arg;
+
+	rn_delete(rn->rn_key, rn->rn_mask, head);
+	return (0);
+}
+
 static void
 lradix6_destroy(void *_data)
 {
 	struct lradix6_data *lr = (struct lradix6_data *)_data;
 
-	if (lr->rnh != NULL)
+	if (lr->rnh != NULL) {
+		rn_walktree(&lr->rnh->rh, lradix6_free_route, &lr->rnh->rh);
 		rn_detachhead((void **)&lr->rnh);
+	}
 	if (lr->mem != NULL)
 		free(lr->mem, M_RTABLE);
 	free(lr, M_RTABLE);