[PATCH net-next] net: fix double-free in bpf_lwt_xmit_reroute

[Peter Oskolkov]

dst_output() frees skb when it fails (see, for example,
ip_finish_output2), so it must not be freed in this case.

Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
Signed-off-by: Peter Oskolkov <p...@google.com>
---
 net/core/lwt_bpf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index a5c8c79d468a..cf2f8897ca19 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -260,7 +260,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
 
        err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb);
        if (unlikely(err))
-               goto err;
+               return err;
 
        /* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */
        return LWTUNNEL_XMIT_DONE;
-- 
2.21.0.rc0.258.g878e2cd30e-goog