[PATCH nf-next 0/2] netfilter: do not assume skb->sk is inet sk

[Florian Westphal <fw@strlen.de>]

LLM reported that packet socket could be handed off to an ip tunnel,
where the now tunneled skb retains skb->sk as packet socket.

There are spots where we assume skb->sk is inet socket.  Add helpers
for this and use them where needed.  Not reproducible (no crash / out
of bound access, nft_socket just provides a 'random' result instead of
'no match').

There are more skb->sk users but I could not find bad-access scenarios
for those, they fetch valid sk fields or are restricted to input hooks.

Florian Westphal (2):
  netfilter: add nf_skb_sk helper and use it
  netfilter: add nf_sk_to_full_sk helper and use it

 include/net/netfilter/nf_socket.h | 35 +++++++++++++++++++++++++++++++
 net/ipv4/netfilter.c              |  3 ++-
 net/ipv6/netfilter.c              |  3 ++-
 net/netfilter/nft_socket.c        | 16 +++++++-------
 net/netfilter/xt_socket.c         | 26 ++++++++++++-----------
 5 files changed, 62 insertions(+), 21 deletions(-)

-- 
2.55.0