[PATCH] netfilter: xt_policy: add NULL check for skb_dst() in output policy match

[Fang Xieyan <fangxy@xiaopeng.com>]

match_policy_out() accesses dst->xfrm without checking whether
skb_dst() returned NULL. If no dst entry is attached to the skb,
this dereference is invalid.

Check dst before accessing dst->xfrm and return -1 when no dst entry
is present. This follows the existing handling of a dst entry
without XFRM state and preserves the XT_POLICY_MATCH_NONE semantics
in policy_mt().

Code review identified the unchecked dereference. No reachable path
that passes an skb with a NULL dst to match_policy_out() has been
identified in current kernels.
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
 net/netfilter/xt_policy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c
index ff54e3a8581e..6bbaf92f0cfc 100644
--- a/net/netfilter/xt_policy.c
+++ b/net/netfilter/xt_policy.c
@@ -87,7 +87,7 @@ match_policy_out(const struct sk_buff *skb, const struct xt_policy_info *info,
 	int strict = info->flags & XT_POLICY_MATCH_STRICT;
 	int i, pos;
 
-	if (dst->xfrm == NULL)
+	if (!dst || dst->xfrm == NULL)
 		return -1;
 
 	for (i = 0; dst && dst->xfrm;
-- 
2.50.1