From: Steffen Klassert <steffen.klassert@secunet.com>
To: David Miller <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
Steffen Klassert <steffen.klassert@secunet.com>,
<netdev@vger.kernel.org>
Subject: [PATCH 09/11] xfrm: Fix NULL pointer dereference on policy lookup
Date: Wed, 31 Mar 2021 10:18:45 +0200 [thread overview]
Message-ID: <20210331081847.3547641-10-steffen.klassert@secunet.com> (raw)
In-Reply-To: <20210331081847.3547641-1-steffen.klassert@secunet.com>
When xfrm interfaces are used in combination with namespaces
and ESP offload, we get a dst_entry NULL pointer dereference.
This is because we don't have a dst_entry attached in the ESP
offloading case and we need to do a policy lookup before the
namespace transition.
Fix this by expicit checking of skb_dst(skb) before accessing it.
Fixes: f203b76d78092 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
include/net/xfrm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index bfbc7810df94..c58a6d4eb610 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1097,7 +1097,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir,
return __xfrm_policy_check(sk, ndir, skb, family);
return (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) ||
- (skb_dst(skb)->flags & DST_NOPOLICY) ||
+ (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) ||
__xfrm_policy_check(sk, ndir, skb, family);
}
--
2.25.1
next prev parent reply other threads:[~2021-03-31 8:19 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-31 8:18 pull request (net): ipsec 2021-03-31 Steffen Klassert
2021-03-31 8:18 ` [PATCH 01/11] xfrm: interface: fix ipv4 pmtu check to honor ip header df Steffen Klassert
2021-03-31 22:00 ` patchwork-bot+netdevbpf
2021-03-31 8:18 ` [PATCH 02/11] vti: " Steffen Klassert
2021-03-31 8:18 ` [PATCH 03/11] vti6: " Steffen Klassert
2021-03-31 8:18 ` [PATCH 04/11] xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume Steffen Klassert
2021-03-31 8:18 ` [PATCH 05/11] net: xfrm: Localize sequence counter per network namespace Steffen Klassert
2021-03-31 8:18 ` [PATCH 06/11] net: xfrm: Use sequence counter with associated spinlock Steffen Klassert
2021-03-31 8:18 ` [PATCH 07/11] esp: delete NETIF_F_SCTP_CRC bit from features for esp offload Steffen Klassert
2021-03-31 8:18 ` [PATCH 08/11] xfrm: BEET mode doesn't support fragments for inner packets Steffen Klassert
2021-03-31 8:18 ` Steffen Klassert [this message]
2021-03-31 8:18 ` [PATCH 10/11] xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets Steffen Klassert
2021-03-31 8:18 ` [PATCH 11/11] xfrm/compat: Cleanup WARN()s that can be user-triggered Steffen Klassert
2021-03-31 22:00 ` pull request (net): ipsec 2021-03-31 patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210331081847.3547641-10-steffen.klassert@secunet.com \
--to=steffen.klassert@secunet.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.