diff options
| author | Xuanqiang Luo <luoxuanqiang@kylinos.cn> | 2026-07-23 14:04:45 +0800 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-07-28 13:22:11 +0200 |
| commit | 88c17de85ddb459c3fe1e3c65d61fa366b1cf0a8 (patch) | |
| tree | 840e93e105f12980f925670351883ade7fa68250 /net/core | |
| parent | f621d6ebeebb6374342571e4ddf45fdbc420f6cd (diff) | |
bpf: lwt: Fix dst reference leak on reroute failure
bpf_lwt_xmit_reroute() obtains a referenced dst from the route
lookup. When skb_cow_head() fails before that dst is installed on the
skb, the error path only frees the skb. The skb still owns its previous
dst, so the newly looked up dst reference is leaked.
Release the new dst reference before freeing the skb on this error
path.
Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260723060445.21926-1-xuanqiang.luo@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/lwt_bpf.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c index bf588f508b79..652952d416f2 100644 --- a/net/core/lwt_bpf.c +++ b/net/core/lwt_bpf.c @@ -255,8 +255,10 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb) * if there is enough header space in skb. */ err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); - if (unlikely(err)) + if (unlikely(err)) { + dst_release(dst); goto err; + } skb_dst_drop(skb); skb_dst_set(skb, dst); |