[PATCH] netfilter: xt_realm: fix null-ptr-deref in realm_mt()

[PATCH] netfilter: xt_realm: fix null-ptr-deref in realm_mt()

[Kito Xu (veritas501)]

realm_mt() unconditionally dereferences skb_dst(skb) without a NULL
check. The xt_realm match registers with .family = NFPROTO_UNSPEC,
making it available to all netfilter protocol families. Through the
nftables compat layer (nft_compat), an unprivileged user inside a
user/net namespace can load this match into a bridge-family chain.

nft_match_validate() explicitly permits NFPROTO_BRIDGE, and the hook
bitmask check cannot distinguish bridge hooks from inet hooks because
NF_BR_FORWARD and NF_INET_FORWARD share the same numeric value (2).
The match also has no .checkentry callback to reject non-IP families.

When a pure L2 bridged packet traverses the chain, it has never gone
through IP routing, so skb_dst() returns NULL. realm_mt() then
dereferences this NULL pointer at dst->tclassid, causing a kernel oops.

Add a NULL check for the dst_entry pointer. When dst is NULL, return
false (no match), which is the correct semantic since a packet without
a routing realm cannot match any realm-based rule.

Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 1 UID: 0 PID: 169 Comm: poc Not tainted 7.0.0-rc7-next-20260410+ #15 PREEMPTLAZY
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:realm_mt+0xa0/0x180
Call Trace:
 <IRQ>
 nft_match_eval+0x1b7/0x310
 nft_do_chain+0x261/0x1740
 nft_do_chain_bridge+0x20c/0xe10
 nf_hook_slow+0xac/0x1e0
 __br_forward+0x33a/0x480
 br_handle_frame_finish+0xab8/0x1d10
 br_handle_frame+0x80f/0x12c0
 __netif_receive_skb_core.constprop.0+0xbd4/0x2c10
 __netif_receive_skb_one_core+0xae/0x1b0
 process_backlog+0x197/0x590
 __napi_poll+0xa1/0x540
 net_rx_action+0x401/0xd80
 handle_softirqs+0x19f/0x610
 do_softirq.part.0+0x3b/0x60
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x64/0x70
 __dev_queue_xmit+0x9f3/0x30e0
 packet_sendmsg+0x2126/0x5470
 __sys_sendto+0x34e/0x3a0
 __x64_sys_sendto+0xe0/0x1c0
 do_syscall_64+0x64/0x680
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
 </TASK>
Kernel panic - not syncing: Fatal exception in interrupt

Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
Signed-off-by: Kito Xu (veritas501) <hxzene@gmail.com>
---
 net/netfilter/xt_realm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/xt_realm.c b/net/netfilter/xt_realm.c
index 6df485f4403d..6d3a86647cae 100644
--- a/net/netfilter/xt_realm.c
+++ b/net/netfilter/xt_realm.c
@@ -24,6 +24,9 @@ realm_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	const struct xt_realm_info *info = par->matchinfo;
 	const struct dst_entry *dst = skb_dst(skb);
 
+	if (!dst)
+		return false;
+
 	return (info->id == (dst->tclassid & info->mask)) ^ info->invert;
 }
 
-- 
2.43.0

Re: [PATCH] netfilter: xt_realm: fix null-ptr-deref in realm_mt()

[Florian Westphal]

Kito Xu (veritas501) <hxzene@gmail.com> wrote:
> realm_mt() unconditionally dereferences skb_dst(skb) without a NULL
> check. The xt_realm match registers with .family = NFPROTO_UNSPEC,
> making it available to all netfilter protocol families. Through the
> nftables compat layer (nft_compat), an unprivileged user inside a
> user/net namespace can load this match into a bridge-family chain.

I do not think this bug is related to nft_compat.
You can also use ebtables setsockopt api to request xt_realm, no?

> Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")

Looks correct.  Alternatively we could revert the xt_realm.c change.
But I don't have a strong opinion here, patch looks correct.

Re: [PATCH] netfilter: xt_realm: fix null-ptr-deref in realm_mt()

[Pablo Neira Ayuso]

On Wed, Apr 15, 2026 at 11:02:15AM +0200, Florian Westphal wrote:
> Kito Xu (veritas501) <hxzene@gmail.com> wrote:
> > realm_mt() unconditionally dereferences skb_dst(skb) without a NULL
> > check. The xt_realm match registers with .family = NFPROTO_UNSPEC,
> > making it available to all netfilter protocol families. Through the
> > nftables compat layer (nft_compat), an unprivileged user inside a
> > user/net namespace can load this match into a bridge-family chain.
> 
> I do not think this bug is related to nft_compat.
> You can also use ebtables setsockopt api to request xt_realm, no?
> 
> > Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
> 
> Looks correct.  Alternatively we could revert the xt_realm.c change.
> But I don't have a strong opinion here, patch looks correct.

Maybe partial revert makes sense, since in ab4f21e6fb1c:

- xt_MARK: OK
- xt_NOTRACK: OK
- xt_comment: OK
- xt_mac: There is a better way to do this in bridge.
- xt_owner, no sockets in bridge.
- xt_physdev, which makes no sense in bridge, this is for br_netfilter
  only.
- xt_realm (as already mentioned).

That is, a partial revert of this patch for:

- xt_mac
- xt_owner
- xt_physdev
- xt_realm

Re: [PATCH] netfilter: xt_realm: fix null-ptr-deref in realm_mt()

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Apr 15, 2026 at 11:02:15AM +0200, Florian Westphal wrote:
> > Kito Xu (veritas501) <hxzene@gmail.com> wrote:
> > > realm_mt() unconditionally dereferences skb_dst(skb) without a NULL
> > > check. The xt_realm match registers with .family = NFPROTO_UNSPEC,
> > > making it available to all netfilter protocol families. Through the
> > > nftables compat layer (nft_compat), an unprivileged user inside a
> > > user/net namespace can load this match into a bridge-family chain.
> > 
> > I do not think this bug is related to nft_compat.
> > You can also use ebtables setsockopt api to request xt_realm, no?
> > 
> > > Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
> > 
> > Looks correct.  Alternatively we could revert the xt_realm.c change.
> > But I don't have a strong opinion here, patch looks correct.
> 
> Maybe partial revert makes sense, since in ab4f21e6fb1c:
> 
> - xt_MARK: OK
> - xt_NOTRACK: OK
> - xt_comment: OK

Agree.

> - xt_mac: There is a better way to do this in bridge.

Right.

> - xt_owner, no sockets in bridge.

Output/postrouting maybe?

> - xt_physdev, which makes no sense in bridge, this is for br_netfilter
>   only.

Agree.

> - xt_realm (as already mentioned).
> That is, a partial revert of this patch for:
> 
> - xt_mac
> - xt_owner
> - xt_physdev
> - xt_realm

I'm ok with that too.

Re: [PATCH] netfilter: xt_realm: fix null-ptr-deref in realm_mt()

[Pablo Neira Ayuso]

On Wed, Apr 15, 2026 at 11:27:43AM +0200, Pablo Neira Ayuso wrote:
> On Wed, Apr 15, 2026 at 11:02:15AM +0200, Florian Westphal wrote:
> > Kito Xu (veritas501) <hxzene@gmail.com> wrote:
> > > realm_mt() unconditionally dereferences skb_dst(skb) without a NULL
> > > check. The xt_realm match registers with .family = NFPROTO_UNSPEC,
> > > making it available to all netfilter protocol families. Through the
> > > nftables compat layer (nft_compat), an unprivileged user inside a
> > > user/net namespace can load this match into a bridge-family chain.
> > 
> > I do not think this bug is related to nft_compat.
> > You can also use ebtables setsockopt api to request xt_realm, no?
> > 
> > > Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
> > 
> > Looks correct.  Alternatively we could revert the xt_realm.c change.
> > But I don't have a strong opinion here, patch looks correct.
> 
> Maybe partial revert makes sense, since in ab4f21e6fb1c:
> 
> - xt_MARK: OK
> - xt_NOTRACK: OK
> - xt_comment: OK
> - xt_mac: There is a better way to do this in bridge.
> - xt_owner, no sockets in bridge.
> - xt_physdev, which makes no sense in bridge, this is for br_netfilter
>   only.
> - xt_realm (as already mentioned).
> 
> That is, a partial revert of this patch for:
> 
> - xt_mac
> - xt_owner
> - xt_physdev
> - xt_realm

"this patch" refers to ab4f21e6fb1c 

Re: [PATCH] netfilter: xt_realm: fix null-ptr-deref in realm_mt()

[Pablo Neira Ayuso]

On Wed, Apr 15, 2026 at 11:44:07AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Apr 15, 2026 at 11:02:15AM +0200, Florian Westphal wrote:
> > > Kito Xu (veritas501) <hxzene@gmail.com> wrote:
> > > > realm_mt() unconditionally dereferences skb_dst(skb) without a NULL
> > > > check. The xt_realm match registers with .family = NFPROTO_UNSPEC,
> > > > making it available to all netfilter protocol families. Through the
> > > > nftables compat layer (nft_compat), an unprivileged user inside a
> > > > user/net namespace can load this match into a bridge-family chain.
> > > 
> > > I do not think this bug is related to nft_compat.
> > > You can also use ebtables setsockopt api to request xt_realm, no?
> > > 
> > > > Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
> > > 
> > > Looks correct.  Alternatively we could revert the xt_realm.c change.
> > > But I don't have a strong opinion here, patch looks correct.
> > 
> > Maybe partial revert makes sense, since in ab4f21e6fb1c:
> > 
> > - xt_MARK: OK
> > - xt_NOTRACK: OK
> > - xt_comment: OK
> 
> Agree.
> 
> > - xt_mac: There is a better way to do this in bridge.
> 
> Right.
> 
> > - xt_owner, no sockets in bridge.
> 
> Output/postrouting maybe?
> 
> > - xt_physdev, which makes no sense in bridge, this is for br_netfilter
> >   only.
> 
> Agree.
> 
> > - xt_realm (as already mentioned).
> > That is, a partial revert of this patch for:
> > 
> > - xt_mac
> > - xt_owner
> > - xt_physdev
> > - xt_realm
> 
> I'm ok with that too.

For the record, this patch has been replaced by:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260415113334.61008-1-pablo@netfilter.org/