[PATCH net] neighbour: neigh_xmit needs to release skb on -EAFNOSUPPORT

[PATCH net] neighbour: neigh_xmit needs to release skb on -EAFNOSUPPORT

[Pablo Neira Ayuso]

Sashiko reports:

"... if the target neighbor table is NULL (for example, for
NEIGH_ND_TABLE when IPv6 is disabled), the code takes the out_unlock
path and bypasses the out_kfree_skb cleanup"

Fix this skb memleak by releasing the skb in case of -EAFNOSUPPORT.

Fixes: f8f2eb9de69a ("neighbour: add RCU protection to neigh_tables[]")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/core/neighbour.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 9e12524b67fa..2191668b79e3 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -3210,8 +3210,10 @@ int neigh_xmit(int index, struct net_device *dev,
 
 		rcu_read_lock();
 		tbl = rcu_dereference(neigh_tables[index]);
-		if (!tbl)
-			goto out_unlock;
+		if (!tbl) {
+			rcu_read_unlock();
+			goto out_kfree_skb;
+		}
 		if (index == NEIGH_ARP_TABLE) {
 			u32 key = *((u32 *)addr);
 
@@ -3227,7 +3229,6 @@ int neigh_xmit(int index, struct net_device *dev,
 			goto out_kfree_skb;
 		}
 		err = READ_ONCE(neigh->output)(neigh, skb);
-out_unlock:
 		rcu_read_unlock();
 	}
 	else if (index == NEIGH_LINK_TABLE) {
-- 
2.47.3

Re: [PATCH net] neighbour: neigh_xmit needs to release skb on -EAFNOSUPPORT

[Pablo Neira Ayuso]

On Tue, Apr 28, 2026 at 12:20:52PM +0200, Pablo Neira Ayuso wrote:
> Sashiko reports:
> 
> "... if the target neighbor table is NULL (for example, for
> NEIGH_ND_TABLE when IPv6 is disabled), the code takes the out_unlock
> path and bypasses the out_kfree_skb cleanup"
> 
> Fix this skb memleak by releasing the skb in case of -EAFNOSUPPORT.

Please, withdraw.

Florian Westphal already posted a similar fix that is already in
net.git

Thanks.

> Fixes: f8f2eb9de69a ("neighbour: add RCU protection to neigh_tables[]")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>