When an LWT xmit program returns BPF_OK, bpf_xmit() makes sure that the skb still has room for the link layer header. If pskb_expand_head() fails there, bpf_xmit() returns -ENOMEM without freeing the skb. Its callers, lwtunnel_xmit() and then ip_finish_output2() or ip6_finish_output2(), take any return value other than LWTUNNEL_XMIT_CONTINUE to mean that the skb has been consumed, so nothing frees it. Each such failure leaks the skb, together with what it holds: its dst and its charge to the sending socket, so the socket is never freed either. The other error paths of bpf_xmit() (BPF_DROP, an illegal return code, a changed protocol, a failed reroute) all free the skb. Free it here too. The leak was found with kbound, a static analysis prototype for ownership mismatches at kernel interfaces, on v7.2.12; it is present in mainline. Build-tested with x86_64 and arm64 allmodconfig (W=1, sparse): no new warnings. Run-tested on QEMU (x86_64, KVM) with KASAN: a route through a dummy device with an LWT xmit program that pushes one byte with bpf_skb_change_head(), so the headroom check has to expand the head, and failslab limited to allocations under bpf_xmit(). Each of 10 pings then fails with ENOMEM. Without this patch each leaves a raw socket behind (RAW slab objects 6 -> 16); with it none does (6 -> 6), and nothing else is reported. Without injection both kernels go from 6 to 6. Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") Cc: stable@vger.kernel.org Signed-off-by: Yuqiang Sun --- Notes: The bug was found with kbound, a research static analysis prototype. The patch, the changelog and the test setup were written with the help of an AI coding assistant (Claude); I have reviewed and tested them as described above. The runs were on mainline d135ab453a74; the code this patch touches is the same there and in net, which it is based on. net/core/lwt_bpf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c index da49364ec63d..dfb2f9253e81 100644 --- a/net/core/lwt_bpf.c +++ b/net/core/lwt_bpf.c @@ -304,8 +304,10 @@ static int bpf_xmit(struct sk_buff *skb) * made before LWT xmit. */ ret = xmit_check_headroom(skb, hroom); - if (unlikely(ret)) + if (unlikely(ret)) { + kfree_skb(skb); return ret; + } return LWTUNNEL_XMIT_CONTINUE; case BPF_REDIRECT: base-commit: cb284914e749388eef402938bdb3115fe1f6d337 -- 2.53.0