1 files changed, 23 insertions, 11 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index d8f2a22c6ff7..ceca5285d9b4 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -287,16 +287,9 @@ static int ip_finish_output_gso(struct net *net, struct sock *sk,
         return ret;
 }
 
-static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+static int __ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
         unsigned int mtu;
-        int ret;
-
-        ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
-        if (ret) {
-                kfree_skb(skb);
-                return ret;
-        }
 
 #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
         /* Policy lookup after SNAT yielded a new policy */
@@ -315,18 +308,37 @@ static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *sk
         return ip_finish_output2(net, sk, skb);
 }
 
+static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+{
+        int ret;
+
+        ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
+        switch (ret) {
+        case NET_XMIT_SUCCESS:
+                return __ip_finish_output(net, sk, skb);
+        case NET_XMIT_CN:
+                return __ip_finish_output(net, sk, skb) ? : ret;
+        default:
+                kfree_skb(skb);
+                return ret;
+        }
+}
+
 static int ip_mc_finish_output(struct net *net, struct sock *sk,
                                struct sk_buff *skb)
 {
         int ret;
 
         ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
-        if (ret) {
+        switch (ret) {
+        case NET_XMIT_SUCCESS:
+                return dev_loopback_xmit(net, sk, skb);
+        case NET_XMIT_CN:
+                return dev_loopback_xmit(net, sk, skb) ? : ret;
+        default:
                 kfree_skb(skb);
                 return ret;
         }
-
-        return dev_loopback_xmit(net, sk, skb);
 }
 
 int ip_mc_output(struct net *net, struct sock *sk, struct sk_buff *skb)