Re: [PATCH net] xfrm: Fix skb double-free in xfrm_dev_direct_output()

[Leon Romanovsky]

On Wed, Jul 22, 2026 at 04:28:38PM +0900, Sanghyun Park wrote:
> A return value other than 1 from local_out() means that the skb has been
> consumed or its ownership was transferred. xfrm_dev_direct_output()
> nevertheless frees the skb on this path, causing a double-free when
> netfilter drops the packet and invalidating any other owner.
> 
> Return the local_out() result directly, matching the ownership handling
> in xfrm_output_resume().
> 
> Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
> Signed-off-by: Sanghyun Park <sanghyun.park.cnu@xxxxxxxxx>
> ---
>  net/xfrm/xfrm_output.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 

Thanks,
Reviewed-by: Leon Romanovsky <leonro@xxxxxxxxxx>