From: Mike Pattrick <mkp@redhat.com> mainline inclusion from mainline-v6.1-rc1 commit c21ab2afa2c64896a7f0e3cbc6845ec63dcfad2e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19120 CVE: CVE-2026-90049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Currently queue_userspace_packet will call kfree_skb for all frames, whether or not an error occurred. This can result in a single dropped frame being reported as multiple drops in dropwatch. This functions caller may also call kfree_skb in case of an error. This patch will consume the skbs instead and allow caller's to use kfree_skb. Signed-off-by: Mike Pattrick <mkp@redhat.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2109957 Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> --- net/openvswitch/datapath.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index 8eeb01936c10d..c69145fc73599 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -541,8 +541,9 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, out: if (err) skb_tx_error(skb); - kfree_skb(user_skb); - kfree_skb(nskb); + consume_skb(user_skb); + consume_skb(nskb); + return err; } -- 2.33.8