* [PATCH net] xfrm: Fix skb double-free in xfrm_dev_direct_output()
@ 2026-07-22 7:28 Sanghyun Park
2026-07-22 8:51 ` Leon Romanovsky
2026-07-27 7:30 ` Steffen Klassert
0 siblings, 2 replies; 3+ messages in thread
From: Sanghyun Park @ 2026-07-22 7:28 UTC (permalink / raw)
To: Steffen Klassert, Herbert Xu
Cc: Sanghyun Park, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Leon Romanovsky, Alexandre Cassen,
netdev, linux-kernel
A return value other than 1 from local_out() means that the skb has been
consumed or its ownership was transferred. xfrm_dev_direct_output()
nevertheless frees the skb on this path, causing a double-free when
netfilter drops the packet and invalidating any other owner.
Return the local_out() result directly, matching the ownership handling
in xfrm_output_resume().
Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
---
net/xfrm/xfrm_output.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index cc35c2fcbbe09..e305ba32e356b 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -636,10 +636,8 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
nf_reset_ct(skb);
err = skb_dst(skb)->ops->local_out(net, sk, skb);
- if (unlikely(err != 1)) {
- kfree_skb(skb);
+ if (unlikely(err != 1))
return err;
- }
/* In transport mode, network destination is
* directly reachable, while in tunnel mode,
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net] xfrm: Fix skb double-free in xfrm_dev_direct_output()
2026-07-22 7:28 [PATCH net] xfrm: Fix skb double-free in xfrm_dev_direct_output() Sanghyun Park
@ 2026-07-22 8:51 ` Leon Romanovsky
2026-07-27 7:30 ` Steffen Klassert
1 sibling, 0 replies; 3+ messages in thread
From: Leon Romanovsky @ 2026-07-22 8:51 UTC (permalink / raw)
To: Sanghyun Park
Cc: Steffen Klassert, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Alexandre Cassen,
netdev, linux-kernel
On Wed, Jul 22, 2026 at 04:28:38PM +0900, Sanghyun Park wrote:
> A return value other than 1 from local_out() means that the skb has been
> consumed or its ownership was transferred. xfrm_dev_direct_output()
> nevertheless frees the skb on this path, causing a double-free when
> netfilter drops the packet and invalidating any other owner.
>
> Return the local_out() result directly, matching the ownership handling
> in xfrm_output_resume().
>
> Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
> Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
> ---
> net/xfrm/xfrm_output.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
Thanks,
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] xfrm: Fix skb double-free in xfrm_dev_direct_output()
2026-07-22 7:28 [PATCH net] xfrm: Fix skb double-free in xfrm_dev_direct_output() Sanghyun Park
2026-07-22 8:51 ` Leon Romanovsky
@ 2026-07-27 7:30 ` Steffen Klassert
1 sibling, 0 replies; 3+ messages in thread
From: Steffen Klassert @ 2026-07-27 7:30 UTC (permalink / raw)
To: Sanghyun Park
Cc: Herbert Xu, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Leon Romanovsky, Alexandre Cassen,
netdev, linux-kernel
On Wed, Jul 22, 2026 at 04:28:38PM +0900, Sanghyun Park wrote:
> A return value other than 1 from local_out() means that the skb has been
> consumed or its ownership was transferred. xfrm_dev_direct_output()
> nevertheless frees the skb on this path, causing a double-free when
> netfilter drops the packet and invalidating any other owner.
>
> Return the local_out() result directly, matching the ownership handling
> in xfrm_output_resume().
>
> Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
> Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
Applied, thanks a lot!
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-27 7:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-22 7:28 [PATCH net] xfrm: Fix skb double-free in xfrm_dev_direct_output() Sanghyun Park
2026-07-22 8:51 ` Leon Romanovsky
2026-07-27 7:30 ` Steffen Klassert
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.