[PATCH net] xfrm: free the whole skb list on the packet offload drop

[Wang Zhan]

validate_xmit_skb() hands the segmentation result of one GSO packet down
to validate_xmit_xfrm() as a list.  The drop for a packet whose packet
offload state no longer matches the device frees the first skb only, so
the rest of the list and its payload are leaked.

Fixes: f8a70afafc175 ("xfrm: add TX datapath support for IPsec packet offload mode")
Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Closes: https://sashiko.dev/#/patchset/20260918084651.3022878-1-wang.zhan%40smartx.com?part=3
Assisted-by: LLM
Signed-off-by: Wang Zhan <wang.zhan@xxxxxxxxxx>
---
 net/xfrm/xfrm_device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index f153bf695b9dd..0fdd10d29fd1a 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -140,7 +140,7 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur
 	 * XFRM stack.
 	 */
 	if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET && x->xso.dev != dev) {
-		kfree_skb(skb);
+		kfree_skb_list(skb);
 		dev_core_stats_tx_dropped_inc(dev);
 		return NULL;
 	}
-- 
2.47.3