From nobody Fri Jul 24 23:30:38 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 404474279EE for ; Wed, 22 Jul 2026 07:29:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784705383; cv=none; b=o6OvWUml7ifx+cSymyWvRtxueGAsMFMkJmPVwAExNSe4wkrv6TcPJR3E7EDdjc4C0q2w3P7RZmGikF2smqP29+oVMUzUh8O58CzUfQ6uRyJBHGd0uvLfjUAB63avvTlPm441N8yj/tmhCqVrWQoyNejnTVWFwaYcHZWaGpSV+VM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784705383; c=relaxed/simple; bh=B/b6NZPXWjZ4ZUBjxDFyKQ2VsdKInaH6taZRJY5DHzM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Gm8I27Ev6Hrjw/YHo+NC6ZaLX+yuErVTnJfYuACss85Pw8gn31WB4GwOzBIYaWj88592YNXtT6HE4A2Ufhi+Ta42iR8xNLRSP2XnblqxveeG0fbs3ztMVesdib+dYDOsUDpD+Gw+AWRpnmyeopj2cuv5KbIB443x95Sx7Moc63U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nMtTyXBr; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nMtTyXBr" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-38a0c7e841fso10175653a91.2 for ; Wed, 22 Jul 2026 00:29:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784705375; x=1785310175; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=12eYBnmRPs6XDaKWNCAEegubsqjIFXOjPNFE7WXNNDU=; b=nMtTyXBrEKEHzzHtA5t+dD6kV9TQkaXLEXBREhl9NLfqPjAJoC2ZL8k0R3B9pfvyDX 6+IGyCJShFMwNDSVC0ykZLNSkUzF7/YY+r9UYexAI1k9L1xW8kDLdZ2Tgf6/7sivarc5 9u9178LUVbvwFsbovlx815N1DbBoBBnaqQyvjlY8zP8mrPm4v3HHPEIjkpiybrXwhTBB vJnocD+eiWUTiZkrHmrdBWJCWHaq7qLfYf6peJXbeBzh8SsCG+kNmxiLGbI77YmVk89/ /Wnd3yUPdm/2gQK36UleLouexHsSD9kO9cDX2+Nm1aJyIC2D7QcadI52siHTPW9aCTIE tcGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784705375; x=1785310175; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=12eYBnmRPs6XDaKWNCAEegubsqjIFXOjPNFE7WXNNDU=; b=MSGRHSBYlkLmzXgKK8/rl58LlFF+UaKsGdWAE3a5gAwKc/PGihGznI/fkz7jwZOG25 2iUTWKxCsJmXPWyq2FllO8MCZ3rr5nAGEdrEpLBZTMKoqvywvOt42e16hFikC7Ib6iJP ukj2GZ3p9gSn0R5agahH0mu8kCvBK1lYDmlUshWamSGeoPlyxUbo7spCH33nUNKOLn/l Cnbx/oOCOlEsRL8spqYPNwaaAE7DShsuc/Yc56TbrYyrdNFSO+zhfW1jT5tGzYAg0yCU cRf7Mj4Mj3GiPg/ZBw/VafkpLKaA/XeH3UWfJHsopoCKyRqV8WMih8qd5SQ6PCZh2ymz Vyzw== X-Forwarded-Encrypted: i=1; AHgh+Rp5pD22RrrlquGSUB/LCijGTtaGGmeLa5KsuBmr5CQ02ed+0k/Al4UEDHLqvAyG4UgiuUXIuYYGeL6tLKQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxDKMjr9stfHJ0+UdLm48cV/sOwYtHLaQHzwGRlNWxeM8AYYgw9 MbKt0tamVqRfygXq6WSYBBC8+7/2EdtcC/+xr7CbgQQn1FYKa02V29MU X-Gm-Gg: AR+sD13qmaS+L8gQiq5iXVc+fKIX3Wq6DLPeyv0azWY9kM8BGUnvcs11sJhtrmQsNOx 4nA8nsUJP9xH/3J0xtrV7Be5c8CcwI5U97ctAdNCDvwnZSk+O0a+pBTO0WDpupG7NIQU56BJcUc EOKkYg9HfsIGZiul6qgs8zefX5b+GgLZKUHNsKl2MhroGf36jX1BkdWMp/4V/obmE9edOH43D39 ytgV5DoMesyahF9dldnQljzgALNm5yqtnmqyu+BeDd3gTf7uwMq2wAiXWU8evNidRSMLkVrR3tt p5O40CzJb7KYbWiqMqRhxAT2si70IIxSzgGjJH4NXbqujjGVF/02LvPa1c4G9Ct7fMQIgAqfGm/ VQVUbDrB8O4usOhQGs4bL5FNYK/noAbncGBpVksuy8Mjc7y4fQP1YqPbEo2AmeOJeLcQ9hAZxlV IILHTLGXoZSGLpJbb+t8gtF8YumoEC/N0QO/keIQzzssJXRPzaFocfH6IVf3rlcy8mGA== X-Received: by 2002:a17:90b:3ccd:b0:38d:a8be:a597 with SMTP id 98e67ed59e1d1-38e4b5c98afmr23897459a91.37.1784705375435; Wed, 22 Jul 2026 00:29:35 -0700 (PDT) Received: from secrnd-cstp.tailb7f510.ts.net ([125.131.91.97]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38ea78e296fsm575673a91.8.2026.07.22.00.29.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 00:29:34 -0700 (PDT) From: Sanghyun Park To: Steffen Klassert , Herbert Xu Cc: Sanghyun Park , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Leon Romanovsky , Alexandre Cassen , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net] xfrm: Fix skb double-free in xfrm_dev_direct_output() Date: Wed, 22 Jul 2026 16:28:38 +0900 Message-ID: <20260722072837.2011916-2-sanghyun.park.cnu@gmail.com> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A return value other than 1 from local_out() means that the skb has been consumed or its ownership was transferred. xfrm_dev_direct_output() nevertheless frees the skb on this path, causing a double-free when netfilter drops the packet and invalidating any other owner. Return the local_out() result directly, matching the ownership handling in xfrm_output_resume(). Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload m= ode") Signed-off-by: Sanghyun Park Reviewed-by: Leon Romanovsky --- net/xfrm/xfrm_output.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index cc35c2fcbbe09..e305ba32e356b 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -636,10 +636,8 @@ static int xfrm_dev_direct_output(struct sock *sk, str= uct xfrm_state *x, nf_reset_ct(skb); =20 err =3D skb_dst(skb)->ops->local_out(net, sk, skb); - if (unlikely(err !=3D 1)) { - kfree_skb(skb); + if (unlikely(err !=3D 1)) return err; - } =20 /* In transport mode, network destination is * directly reachable, while in tunnel mode,