netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

tc ingress and openvswitch do not guarantee routing information to be
available. These subsystems use the conntrack helper infrastructure, and
the SIP helper relies on the skb_dst() to be present if
sip_external_media is set to 1 (which is disabled by default as a module
parameter).

This effectively disables the sip_external_media toggle for these
subsystems without resulting in a crash.

Fixes: cae3a2627520 ("openvswitch: Allow attaching helpers to ct action")
Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")
Cc: stable@vger.kernel.org
Reported-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 5ec3a4a4bbd707f402319be06e202fdad58ea12b..f3f90a866338940b29b141e21624b2a16334836f 100644 (file)
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -956,7 +956,6 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
                        return NF_ACCEPT;
                saddr = &ct->tuplehash[!dir].tuple.src.u3;
        } else if (sip_external_media) {
-               struct net_device *dev = skb_dst(skb)->dev;
                struct dst_entry *dst = NULL;
                struct flowi fl;
 
@@ -978,7 +977,11 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
                 * through the same interface as the signalling peer.
                 */
                if (dst) {
-                       bool external_media = (dst->dev == dev);
+                       const struct dst_entry *this_dst = skb_dst(skb);
+                       bool external_media = false;
+
+                       if (this_dst && dst->dev == this_dst->dev)
+                               external_media = true;
 
                        dst_release(dst);
                        if (external_media)