[PATCH net v1] bpf: lwt: Fix dst reference leak on reroute failure

[PATCH net v1] bpf: lwt: Fix dst reference leak on reroute failure

[xuanqiang.luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

bpf_lwt_xmit_reroute() obtains a referenced dst from the route
lookup. When skb_cow_head() fails before that dst is installed on the
skb, the error path only frees the skb. The skb still owns its previous
dst, so the newly looked up dst reference is leaked.

Release the new dst reference before freeing the skb on this error
path.

Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
 net/core/lwt_bpf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index bf588f508b79e..652952d416f23 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -255,8 +255,10 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
 	 * if there is enough header space in skb.
 	 */
 	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
-	if (unlikely(err))
+	if (unlikely(err)) {
+		dst_release(dst);
 		goto err;
+	}
 
 	skb_dst_drop(skb);
 	skb_dst_set(skb, dst);
-- 
2.43.0

Re: [PATCH net v1] bpf: lwt: Fix dst reference leak on reroute failure

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Thu, 23 Jul 2026 14:04:45 +0800 you wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> 
> bpf_lwt_xmit_reroute() obtains a referenced dst from the route
> lookup. When skb_cow_head() fails before that dst is installed on the
> skb, the error path only frees the skb. The skb still owns its previous
> dst, so the newly looked up dst reference is leaked.
> 
> [...]

Here is the summary with links:
  - [net,v1] bpf: lwt: Fix dst reference leak on reroute failure
    https://git.kernel.org/netdev/net/c/88c17de85ddb

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html