* [PATCH net-next] net: fix double-free in bpf_lwt_xmit_reroute
@ 2019-02-24 2:25 Peter Oskolkov
2019-02-25 6:25 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Peter Oskolkov @ 2019-02-24 2:25 UTC (permalink / raw)
To: David Miller, netdev; +Cc: Peter Oskolkov, Peter Oskolkov
dst_output() frees skb when it fails (see, for example,
ip_finish_output2), so it must not be freed in this case.
Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
Signed-off-by: Peter Oskolkov <posk@google.com>
---
net/core/lwt_bpf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index a5c8c79d468a..cf2f8897ca19 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -260,7 +260,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb);
if (unlikely(err))
- goto err;
+ return err;
/* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */
return LWTUNNEL_XMIT_DONE;
--
2.21.0.rc0.258.g878e2cd30e-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next] net: fix double-free in bpf_lwt_xmit_reroute
2019-02-24 2:25 [PATCH net-next] net: fix double-free in bpf_lwt_xmit_reroute Peter Oskolkov
@ 2019-02-25 6:25 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-02-25 6:25 UTC (permalink / raw)
To: posk; +Cc: netdev, posk
From: Peter Oskolkov <posk@google.com>
Date: Sat, 23 Feb 2019 18:25:01 -0800
> dst_output() frees skb when it fails (see, for example,
> ip_finish_output2), so it must not be freed in this case.
>
> Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
> Signed-off-by: Peter Oskolkov <posk@google.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-02-25 6:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-02-24 2:25 [PATCH net-next] net: fix double-free in bpf_lwt_xmit_reroute Peter Oskolkov
2019-02-25 6:25 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).