| Message ID | 20210323082644.GP62598@gauss3.secunet.de |
|---|---|
| State | New |
| Headers | show |
| Series | [ipsec] xfrm: Fix NULL pointer dereference on policy lookup | expand |
On Tue, Mar 23, 2021 at 09:26:44AM +0100, Steffen Klassert wrote: > When xfrm interfaces are used in combination with namespaces > and ESP offload, we get a dst_entry NULL pointer dereference. > This is because we don't have a dst_entry attached in the ESP > offloading case and we need to do a policy lookup before the > namespace transition. > > Fix this by expicit checking of skb_dst(skb) before accessing it. > > Fixes: f203b76d78092 ("xfrm: Add virtual xfrm interfaces") > Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Now applied.
diff --git a/include/net/xfrm.h b/include/net/xfrm.h index b2a06f10b62c..fdb7e40a61e9 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1097,7 +1097,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir, return __xfrm_policy_check(sk, ndir, skb, family); return (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) || - (skb_dst(skb)->flags & DST_NOPOLICY) || + (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) || __xfrm_policy_check(sk, ndir, skb, family); }
When xfrm interfaces are used in combination with namespaces and ESP offload, we get a dst_entry NULL pointer dereference. This is because we don't have a dst_entry attached in the ESP offloading case and we need to do a policy lookup before the namespace transition. Fix this by expicit checking of skb_dst(skb) before accessing it. Fixes: f203b76d78092 ("xfrm: Add virtual xfrm interfaces") Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> --- include/net/xfrm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)