From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4AE40C43381 for ; Sun, 24 Feb 2019 02:25:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 021CA20855 for ; Sun, 24 Feb 2019 02:25:40 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="RdNxcLxs" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728016AbfBXCZK (ORCPT ); Sat, 23 Feb 2019 21:25:10 -0500 Received: from mail-qt1-f201.google.com ([209.85.160.201]:49858 "EHLO mail-qt1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726405AbfBXCZK (ORCPT ); Sat, 23 Feb 2019 21:25:10 -0500 Received: by mail-qt1-f201.google.com with SMTP id q11so5985423qtj.16 for ; Sat, 23 Feb 2019 18:25:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:message-id:mime-version:subject:from:to:cc; bh=NuiJuYr70IMj9FdUcipxMaPTVhtLdmeehZcrncMD+tc=; b=RdNxcLxsRq5/gDy5J6jgYxp3hX+LM3+Zp9WzNeL0CHmFNoiBvFTKjT4mpOeXtu9BI/ TUCXVPiaBOPXqZKsvooIu1/Z2yutqv1Q+zJmo8Qk5Vcj3WqQ/1K0yiH6fOqj/+1krXsc u5aq5eH8Aq1kEtzABVjgSNnTqvTJ3hx5PyKqBLYYtaHDyTaB5h+LraChTonVwST1HC6K pxz1BT3WsYyCz2Pskb7T1JWzFORyOgVMcUG8uXE5evH8ZSs0xGEJrp+uTdSXB3PUtgtL BvCPRpcBSR9HddCU6ASAxDzFB0KL3igroR5rG8dhLrCcEwS8ub+lQCy9PHzAbz2vxIkM 1dnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=NuiJuYr70IMj9FdUcipxMaPTVhtLdmeehZcrncMD+tc=; b=q3Ug096Il960iRdzVROWlTD9eAOXF9dcSJfggiI+d49XjC0MsnC8yrSq0XEyDQ5kk8 fccOjbjIZ4g+KYWRX76HUHiUPxS9qCGkUJSj4lI5cmDo3Q5CKl09RtBtjsAKnhHhA0bK q9T19HJbS+IxCs2SaFLkenK0AImvmr7y8mgF+xdRKzlrYDx9jp1DaP5m0o/K9GwpLEan DzVxxOBa6nC+be2cYFFhgoFVvJke7nHF2LE7tNwzdS7mttEJT9r6auhbU/BgdbmxmGYB GFYuUT2l7+3MiqfmCzj+8S5f6Fprw8TdHRejUXxp5CBjWw0k/OuUNSiZsND9RKO7q2M9 DXMQ== X-Gm-Message-State: AHQUAuYfX1fdHHJEB9503jO7SBzbD2YB8xfQ6oGeYuxzFw9PpKghYvC2 OV0hRNGCyyvUUwGqSXuDnKMltihh X-Google-Smtp-Source: AHgI3IZcck+g0XoCjeKUw3gtMMSx+TqJeLypI3b6AD8jJ34oKzSjbwtNTtqaKQQoqjrno98Z7EPMoiw3 X-Received: by 2002:a37:8683:: with SMTP id i125mr7080074qkd.11.1550975109249; Sat, 23 Feb 2019 18:25:09 -0800 (PST) Date: Sat, 23 Feb 2019 18:25:01 -0800 Message-Id: <20190224022501.71889-1-posk@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.21.0.rc0.258.g878e2cd30e-goog Subject: [PATCH net-next] net: fix double-free in bpf_lwt_xmit_reroute From: Peter Oskolkov To: David Miller , netdev@vger.kernel.org Cc: Peter Oskolkov , Peter Oskolkov Content-Type: text/plain; charset="UTF-8" Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org dst_output() frees skb when it fails (see, for example, ip_finish_output2), so it must not be freed in this case. Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c") Signed-off-by: Peter Oskolkov --- net/core/lwt_bpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c index a5c8c79d468a..cf2f8897ca19 100644 --- a/net/core/lwt_bpf.c +++ b/net/core/lwt_bpf.c @@ -260,7 +260,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb); if (unlikely(err)) - goto err; + return err; /* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */ return LWTUNNEL_XMIT_DONE; -- 2.21.0.rc0.258.g878e2cd30e-goog