[PATCH net-next] netfilter: flowtable: Fix accessing null dst entry

[PATCH net-next] netfilter: flowtable: Fix accessing null dst entry

[Paul Blakey]

Unlink nft flow table flows, flows from act_ct tables don't have route,
and so don't have a dst_entry. nf_flow_rule_match() tries to deref
this null dst_entry regardless.

Fix that by checking for dst entry exists, and if not, skip
tunnel match.

Fixes: cfab6dbd0ecf ("netfilter: flowtable: add tunnel match offload support")
Signed-off-by: Paul Blakey <paulb@mellanox.com>
---
 net/netfilter/nf_flow_table_offload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index ca40dfa..6518a91 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -92,7 +92,7 @@ static int nf_flow_rule_match(struct nf_flow_match *match,
 	NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_TCP, tcp);
 	NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_PORTS, tp);
 
-	if (other_dst->lwtstate) {
+	if (other_dst && other_dst->lwtstate) {
 		tun_info = lwt_tun_info(other_dst->lwtstate);
 		nf_flow_rule_lwt_match(match, tun_info);
 	}
-- 
1.8.3.1

Re: [PATCH net-next] netfilter: flowtable: Fix accessing null dst entry

[Pablo Neira Ayuso]

On Wed, Mar 25, 2020 at 12:53:28PM +0200, Paul Blakey wrote:
> Unlink nft flow table flows, flows from act_ct tables don't have route,
> and so don't have a dst_entry. nf_flow_rule_match() tries to deref
> this null dst_entry regardless.
> 
> Fix that by checking for dst entry exists, and if not, skip
> tunnel match.

This is fixed in nf-next:

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git/commit/

I'll get this merged into net-next asap.

Re: [PATCH net-next] netfilter: flowtable: Fix accessing null dst entry

[Paul Blakey]

pending patch seems fine.

________________________________________
From: Pablo Neira Ayuso <pablo@netfilter.org>
Sent: Wednesday, March 25, 2020 12:55 PM
To: Paul Blakey
Cc: Oz Shlomo; Majd Dibbiny; Roi Dayan; netdev@vger.kernel.org; Saeed Mahameed; netfilter-devel@vger.kernel.org
Subject: Re: [PATCH net-next] netfilter: flowtable: Fix accessing null dst entry

On Wed, Mar 25, 2020 at 12:53:28PM +0200, Paul Blakey wrote:
> Unlink nft flow table flows, flows from act_ct tables don't have route,
> and so don't have a dst_entry. nf_flow_rule_match() tries to deref
> this null dst_entry regardless.
>
> Fix that by checking for dst entry exists, and if not, skip
> tunnel match.

This is fixed in nf-next:

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git/commit/

I'll get this merged into net-next asap.