Re: [PATCH nf] netfilter: nft_fib: bail out if input device is missing

Pablo Neira Ayuso <[email protected]> Mon, 13 Jul 2026 23:11:45 +0200

Newsgroups	gmane.comp.security.firewalls.netfilter.devel,gmane.linux.network,gmane.linux.kernel
Message-ID	<alVUka8INN918W0K@chamomile>

Hi,

On Mon, Jul 13, 2026 at 06:36:14PM +0000, Xiang Mei (Microsoft) wrote:
> nft_fib_can_skip() dereferences the input device (indev->ifindex, and
> in->flags via nft_fib_is_loopback()) without a NULL check, assuming the
> hook switch only admits PRE_ROUTING/INGRESS/LOCAL_IN. But NF_NETDEV_EGRESS
> == NF_INET_LOCAL_IN == 1, so a netdev-family base chain on the egress hook
> passes both the switch and nft_fib_validate() (which also keys only on the
> hook number). Egress packets have no input device, so nft_fib_can_skip()
> dereferences NULL.

By reading your description, does your kernel include this patch?

commit d07955dd34ecae17d35d8c7d0a273a3fba653a8c
Author: Theodor Arsenij Larionov-Trichkine <[email protected]>
Date:   Mon Jun 29 12:53:11 2026 +0200
 
    netfilter: nft_fib: reject fib expression on the netdev egress hook