diff options
| author | Sanghyun Park <sanghyun.park.cnu@gmail.com> | 2026-07-22 16:28:38 +0900 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2026-07-23 10:07:21 +0200 |
| commit | 2aed51fc58d9ce450e2c116efb956160fd06fa02 (patch) | |
| tree | 206bc78a832dbd4f9dcc4530770712a816c04b54 /drivers/gpu/tests | |
| parent | 763fe700b7c58ad64fe5202c5638848244dd4127 (diff) | |
| download | linux-next-2aed51fc58d9ce450e2c116efb956160fd06fa02.tar.gz linux-next-2aed51fc58d9ce450e2c116efb956160fd06fa02.zip | |
xfrm: Fix skb double-free in xfrm_dev_direct_output()
A return value other than 1 from local_out() means that the skb has been
consumed or its ownership was transferred. xfrm_dev_direct_output()
nevertheless frees the skb on this path, causing a double-free when
netfilter drops the packet and invalidating any other owner.
Return the local_out() result directly, matching the ownership handling
in xfrm_output_resume().
Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'drivers/gpu/tests')
0 files changed, 0 insertions, 0 deletions