summaryrefslogtreecommitdiff
path: root/net/core/lwt_bpf.c
diff options
context:
space:
mode:
authorPeter Oskolkov <posk@google.com>2019-02-23 18:25:01 -0800
committerDavid S. Miller <davem@davemloft.net>2019-02-24 22:24:50 -0800
commitbd16693f359bbab8776541c06a6df32f3996638e (patch)
treef70560333763253c64f640ef1516f2bf6d6bb5e7 /net/core/lwt_bpf.c
parent186d93669fe0cba252d42a42ddcfdbe9f2ee101d (diff)
net: fix double-free in bpf_lwt_xmit_reroute
dst_output() frees skb when it fails (see, for example, ip_finish_output2), so it must not be freed in this case. Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c") Signed-off-by: Peter Oskolkov <posk@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/lwt_bpf.c')
-rw-r--r--net/core/lwt_bpf.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index a5c8c79d468a..cf2f8897ca19 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -260,7 +260,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb);
if (unlikely(err))
- goto err;
+ return err;
/* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */
return LWTUNNEL_XMIT_DONE;