net: fix double-free in bpf_lwt_xmit_reroute

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

dst_output() frees skb when it fails (see, for example,
ip_finish_output2), so it must not be freed in this case.

Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
Signed-off-by: Peter Oskolkov <posk@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Peter Oskolkov and committed by

David S. Miller 7 years ago bd16693f 186d9366

+1 -1

1 changed file

expand all

net

core

lwt_bpf.c

+1 -1

net/core/lwt_bpf.c

··· 260 260 261 261 err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb); 262 262 if (unlikely(err)) 263 - goto err; 263 + return err; 264 264 265 265 /* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */ 266 266 return LWTUNNEL_XMIT_DONE;