[PATCH] netfilter: xt_policy: add NULL check for skb_dst() in output policy match

[PATCH] netfilter: xt_policy: add NULL check for skb_dst() in output policy match

[Fang Xieyan]

match_policy_out() accesses dst->xfrm without checking whether
skb_dst() returned NULL. If no dst entry is attached to the skb,
this dereference is invalid.

Check dst before accessing dst->xfrm and return -1 when no dst entry
is present. This follows the existing handling of a dst entry
without XFRM state and preserves the XT_POLICY_MATCH_NONE semantics
in policy_mt().

Code review identified the unchecked dereference. No reachable path
that passes an skb with a NULL dst to match_policy_out() has been
identified in current kernels.
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
 net/netfilter/xt_policy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c
index ff54e3a8581e..6bbaf92f0cfc 100644
--- a/net/netfilter/xt_policy.c
+++ b/net/netfilter/xt_policy.c
@@ -87,7 +87,7 @@ match_policy_out(const struct sk_buff *skb, const struct xt_policy_info *info,
 	int strict = info->flags & XT_POLICY_MATCH_STRICT;
 	int i, pos;
 
-	if (dst->xfrm == NULL)
+	if (!dst || dst->xfrm == NULL)
 		return -1;
 
 	for (i = 0; dst && dst->xfrm;
-- 
2.50.1

Re: [PATCH] netfilter: xt_policy: add NULL check for skb_dst() in output policy match

[Florian Westphal]

Fang Xieyan <fangxy@xiaopeng.com> wrote:
> match_policy_out() accesses dst->xfrm without checking whether
> skb_dst() returned NULL. If no dst entry is attached to the skb,
> this dereference is invalid.

If there is no dst we'd have crashed already:

        return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
                       net, sk, skb, NULL, skb_dst_dev(skb),
                       dst_output);

likewise, okter in ip stack:

        if (lwtunnel_xmit_redirect(dst->lwtstate)) {

there are several other places that don't do NULL checks here.
So either all of those need them or none at all.

Re: [PATCH] netfilter: xt_policy: add NULL check for skb_dst() in output policy match

[Fang Xieyan]

Hi Florian,

Thanks for the explanation. Agreed, I'll drop this patch.

Thanks,
Fang Xieyan