[PATCH] netfilter: xt_realm: fix null-ptr-deref in realm_mt()

[Kito Xu (veritas501)]

realm_mt() unconditionally dereferences skb_dst(skb) without a NULL
check. The xt_realm match registers with .family = NFPROTO_UNSPEC,
making it available to all netfilter protocol families. Through the
nftables compat layer (nft_compat), an unprivileged user inside a
user/net namespace can load this match into a bridge-family chain.

nft_match_validate() explicitly permits NFPROTO_BRIDGE, and the hook
bitmask check cannot distinguish bridge hooks from inet hooks because
NF_BR_FORWARD and NF_INET_FORWARD share the same numeric value (2).
The match also has no .checkentry callback to reject non-IP families.

When a pure L2 bridged packet traverses the chain, it has never gone
through IP routing, so skb_dst() returns NULL. realm_mt() then
dereferences this NULL pointer at dst->tclassid, causing a kernel oops.

Add a NULL check for the dst_entry pointer. When dst is NULL, return
false (no match), which is the correct semantic since a packet without
a routing realm cannot match any realm-based rule.

Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 1 UID: 0 PID: 169 Comm: poc Not tainted 7.0.0-rc7-next-20260410+ #15 PREEMPTLAZY
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:realm_mt+0xa0/0x180
Call Trace:
 <IRQ>
 nft_match_eval+0x1b7/0x310
 nft_do_chain+0x261/0x1740
 nft_do_chain_bridge+0x20c/0xe10
 nf_hook_slow+0xac/0x1e0
 __br_forward+0x33a/0x480
 br_handle_frame_finish+0xab8/0x1d10
 br_handle_frame+0x80f/0x12c0
 __netif_receive_skb_core.constprop.0+0xbd4/0x2c10
 __netif_receive_skb_one_core+0xae/0x1b0
 process_backlog+0x197/0x590
 __napi_poll+0xa1/0x540
 net_rx_action+0x401/0xd80
 handle_softirqs+0x19f/0x610
 do_softirq.part.0+0x3b/0x60
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x64/0x70
 __dev_queue_xmit+0x9f3/0x30e0
 packet_sendmsg+0x2126/0x5470
 __sys_sendto+0x34e/0x3a0
 __x64_sys_sendto+0xe0/0x1c0
 do_syscall_64+0x64/0x680
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
 </TASK>
Kernel panic - not syncing: Fatal exception in interrupt

Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
Signed-off-by: Kito Xu (veritas501) <hxzene@xxxxxxxxx>
---
 net/netfilter/xt_realm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/xt_realm.c b/net/netfilter/xt_realm.c
index 6df485f4403d..6d3a86647cae 100644
--- a/net/netfilter/xt_realm.c
+++ b/net/netfilter/xt_realm.c
@@ -24,6 +24,9 @@ realm_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	const struct xt_realm_info *info = par->matchinfo;
 	const struct dst_entry *dst = skb_dst(skb);
 
+	if (!dst)
+		return false;
+
 	return (info->id == (dst->tclassid & info->mask)) ^ info->invert;
 }
 
-- 
2.43.0