From 279b4d763cc5c3dbbac20e1716248ccd22aec331 Mon Sep 17 00:00:00 2001 From: Gennaro Cimmino Date: Mon, 28 Sep 2026 20:05:02 +0200 Subject: [PATCH] realtek: l3: take out a route a nexthop object replaces The previous commit leaves a route through a nexthop object out of the offload. "ip route replace nhid N" reaches the notifier as a FIB_EVENT_ENTRY_REPLACE for the new route alone, with no delete for the route it replaces (fib_table_insert() in net/ipv4/fib_trie.c). If was offloaded, its hardware entry stayed programmed with the old gateway, and nothing took it out afterwards. Let add, replace and append events for such a route through to otto_l3_fib_add_v4(). There, before the first nexthop read, which moves out of the variable initialisers, take out an entry offloaded for the same table and destination with the otto_l3_route_find() and otto_l3_route_teardown() pair its replace path already uses, then return. The teardown cannot sit in the notifier itself: the FIB notifier chain is atomic, and the teardown takes the table mutex. A delete for such a route still stops in the notifier: the route was never offloaded, and otto_l3_fib_del_v4() reads the nexthop array. Tested on an RTL9303 (Hasivo S1100W-8XGT-SE) with the L3 offload on, this series on main at 248601f492. A /24 and a /32 through a gateway each get a hardware entry; replacing either with "nhid 17" takes the entry out while the kernel keeps the route, replacing it back through the other gateway programs an entry again, and deleting it afterwards leaves none. A replace between two gateways without a nexthop object still leaves exactly one entry. No warning or oops in the log. The stale entry this commit removes was read from the code, not reproduced. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Gennaro Cimmino Link: https://github.com/openwrt/openwrt/pull/25310 Signed-off-by: Markus Stockhausen --- .../files-6.18/drivers/net/dsa/rtl83xx/l3.c | 30 ++++++++++++++----- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/target/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/l3.c b/target/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/l3.c index 2cd0c37a130..6e64f983389 100644 --- a/target/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/l3.c +++ b/target/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/l3.c @@ -1405,12 +1405,27 @@ static int otto_l3_fib_check_v4(struct otto_l3_ctrl *ctrl, static int otto_l3_fib_add_v4(struct otto_l3_ctrl *ctrl, struct fib_entry_notifier_info *info) { - struct net_device *ndev = fib_info_nh(info->fi, 0)->fib_nh_dev; - int vlan = is_vlan_dev(ndev) ? vlan_dev_vlan_id(ndev) : 0; struct rtl838x_switch_priv *priv = ctrl->priv; - struct fib_nh *nh = fib_info_nh(info->fi, 0); struct otto_l3_route *route; - int port; + struct net_device *ndev; + struct fib_nh *nh; + int port, vlan; + + /* A route through a nexthop object is not offloaded and has no + * nexthop array to read, but it can replace a route that is. + */ + if (info->fi->nh) { + dev_dbg(ctrl->dev, "route through a nexthop object, not offloaded\n"); + route = otto_l3_route_find(ctrl, info->tb_id, ROUTE_TYPE_IP4UC, info->dst, + NULL, info->dst_len); + if (route) + otto_l3_route_teardown(ctrl, route); + return 0; + } + + nh = fib_info_nh(info->fi, 0); + ndev = nh->fib_nh_dev; + vlan = is_vlan_dev(ndev) ? vlan_dev_vlan_id(ndev) : 0; if (otto_l3_fib_check_v4(ctrl, info, FIB_EVENT_ENTRY_ADD)) return 0; @@ -1626,11 +1641,10 @@ static int otto_l3_fib_notifier(struct notifier_block *this, unsigned long event if (info->family == AF_INET) { struct fib_entry_notifier_info *fen_info = ptr; - /* A route through a nexthop object keeps no nexthop - * array of its own, and everything below reads one. + /* A route through a nexthop object is never offloaded, + * and the delete path reads a nexthop array it lacks. */ - if (fen_info->fi->nh) { - dev_dbg(ctrl->dev, "route through a nexthop object, not offloaded\n"); + if (fen_info->fi->nh && event == FIB_EVENT_ENTRY_DEL) { kfree(fib_work); return NOTIFY_DONE; }