match_policy_out() accesses dst->xfrm without checking whether skb_dst() returned NULL. If no dst entry is attached to the skb, this dereference is invalid. Check dst before accessing dst->xfrm and return -1 when no dst entry is present. This follows the existing handling of a dst entry without XFRM state and preserves the XT_POLICY_MATCH_NONE semantics in policy_mt(). Code review identified the unchecked dereference. No reachable path that passes an skb with a NULL dst to match_policy_out() has been identified in current kernels. Reviewed-by: Weibin Liu Signed-off-by: Fang Xieyan --- net/netfilter/xt_policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c index ff54e3a8581e..6bbaf92f0cfc 100644 --- a/net/netfilter/xt_policy.c +++ b/net/netfilter/xt_policy.c @@ -87,7 +87,7 @@ match_policy_out(const struct sk_buff *skb, const struct xt_policy_info *info, int strict = info->flags & XT_POLICY_MATCH_STRICT; int i, pos; - if (dst->xfrm == NULL) + if (!dst || dst->xfrm == NULL) return -1; for (i = 0; dst && dst->xfrm; -- 2.50.1