Commit bd16693f authored Feb 23, 2019 by Peter Oskolkov Committed by David S. Miller Feb 24, 2019

net: fix double-free in bpf_lwt_xmit_reroute



dst_output() frees skb when it fails (see, for example,
ip_finish_output2), so it must not be freed in this case.

Fixes: 3bd0b152 ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
Signed-off-by: Peter Oskolkov <posk@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 186d9366

net/core/lwt_bpf.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -260,7 +260,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)

		err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb);
		if (unlikely(err))
		goto err;
		return err;

		/* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */
		return LWTUNNEL_XMIT_DONE;