From 424544a06043599d7d017b479be34eff564aa968 Mon Sep 17 00:00:00 2001 From: Peter Oskolkov Date: Sat, 23 Feb 2019 18:25:01 -0800 Subject: [PATCH] net: fix double-free in bpf_lwt_xmit_reroute dst_output() frees skb when it fails (see, for example, ip_finish_output2), so it must not be freed in this case. Fixes: 1d9b24d7468a ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c") Signed-off-by: Peter Oskolkov Signed-off-by: David S. Miller --- net/core/lwt_bpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c index a5c8c79d468a3..cf2f8897ca194 100644 --- a/net/core/lwt_bpf.c +++ b/net/core/lwt_bpf.c @@ -260,7 +260,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb); if (unlikely(err)) - goto err; + return err; /* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */ return LWTUNNEL_XMIT_DONE; -- 2.39.5