Re: [PATCH net] xfrm: Fix skb double-free in xfrm_dev_direct_output()

On Wed, Jul 22, 2026 at 04:28:38PM +0900, Sanghyun Park wrote:

A return value other than 1 from local_out() means that the skb has been
consumed or its ownership was transferred. xfrm_dev_direct_output()
nevertheless frees the skb on this path, causing a double-free when
netfilter drops the packet and invalidating any other owner.

Return the local_out() result directly, matching the ownership handling
in xfrm_output_resume().

Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
Signed-off-by: Sanghyun Park <redacted>
---
 net/xfrm/xfrm_output.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

Thanks,
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>