5 files changed, 23 insertions, 11 deletions

diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
index 95e47c97585e..394a200f93c1 100644
--- a/net/ipv4/geneve.c
+++ b/net/ipv4/geneve.c
@@ -122,14 +122,18 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
         int err;
 
         skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
 
         min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
                         + GENEVE_BASE_HLEN + opt_len + sizeof(struct iphdr)
                         + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
 
         err = skb_cow_head(skb, min_headroom);
-        if (unlikely(err))
+        if (unlikely(err)) {
+                kfree_skb(skb);
                 return err;
+        }
 
         skb = vlan_hwaccel_push_inside(skb);
         if (unlikely(!skb))
diff --git a/net/openvswitch/vport-geneve.c b/net/openvswitch/vport-geneve.c
index 347fa2325b22..484864dd0e68 100644
--- a/net/openvswitch/vport-geneve.c
+++ b/net/openvswitch/vport-geneve.c
@@ -219,7 +219,10 @@ static int geneve_tnl_send(struct vport *vport, struct sk_buff *skb)
                               false);
         if (err < 0)
                 ip_rt_put(rt);
+        return err;
+
 error:
+        kfree_skb(skb);
         return err;
 }
 
diff --git a/net/openvswitch/vport-gre.c b/net/openvswitch/vport-gre.c
index 6b69df545b1d..28f54e9a6b80 100644
--- a/net/openvswitch/vport-gre.c
+++ b/net/openvswitch/vport-gre.c
@@ -73,7 +73,7 @@ static struct sk_buff *__build_header(struct sk_buff *skb,
 
         skb = gre_handle_offloads(skb, !!(tun_key->tun_flags & TUNNEL_CSUM));
         if (IS_ERR(skb))
-                return NULL;
+                return skb;
 
         tpi.flags = filter_tnl_flags(tun_key->tun_flags);
         tpi.proto = htons(ETH_P_TEB);
@@ -144,7 +144,7 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
 
         if (unlikely(!OVS_CB(skb)->egress_tun_info)) {
                 err = -EINVAL;
-                goto error;
+                goto err_free_skb;
         }
 
         tun_key = &OVS_CB(skb)->egress_tun_info->tunnel;
@@ -157,8 +157,10 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
         fl.flowi4_proto = IPPROTO_GRE;
 
         rt = ip_route_output_key(net, &fl);
-        if (IS_ERR(rt))
-                return PTR_ERR(rt);
+        if (IS_ERR(rt)) {
+                err = PTR_ERR(rt);
+                goto err_free_skb;
+        }
 
         tunnel_hlen = ip_gre_calc_hlen(tun_key->tun_flags);
 
@@ -183,8 +185,9 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
 
         /* Push Tunnel header. */
         skb = __build_header(skb, tunnel_hlen);
-        if (unlikely(!skb)) {
-                err = 0;
+        if (IS_ERR(skb)) {
+                err = PTR_ERR(rt);
+                skb = NULL;
                 goto err_free_rt;
         }
 
@@ -198,7 +201,8 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
                              tun_key->ipv4_tos, tun_key->ipv4_ttl, df, false);
 err_free_rt:
         ip_rt_put(rt);
-error:
+err_free_skb:
+        kfree_skb(skb);
         return err;
 }
 
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
index 38f95a52241b..d7c46b301024 100644
--- a/net/openvswitch/vport-vxlan.c
+++ b/net/openvswitch/vport-vxlan.c
@@ -187,7 +187,9 @@ static int vxlan_tnl_send(struct vport *vport, struct sk_buff *skb)
                              false);
         if (err < 0)
                 ip_rt_put(rt);
+        return err;
 error:
+        kfree_skb(skb);
         return err;
 }
 
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 9584526c0778..53f3ebbfceab 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -519,10 +519,9 @@ int ovs_vport_send(struct vport *vport, struct sk_buff *skb)
                 u64_stats_update_end(&stats->syncp);
         } else if (sent < 0) {
                 ovs_vport_record_error(vport, VPORT_E_TX_ERROR);
-                kfree_skb(skb);
-        } else
+        } else {
                 ovs_vport_record_error(vport, VPORT_E_TX_DROPPED);
-
+        }
         return sent;
 }