Re: [PATCH nf] netfilter: nft_fib: bail out if input device is missing

[Xiang Mei]

On Mon, Jul 13, 2026 at 2:11 PM Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
>
> Hi,
>
> On Mon, Jul 13, 2026 at 06:36:14PM +0000, Xiang Mei (Microsoft) wrote:
> > nft_fib_can_skip() dereferences the input device (indev->ifindex, and
> > in->flags via nft_fib_is_loopback()) without a NULL check, assuming the
> > hook switch only admits PRE_ROUTING/INGRESS/LOCAL_IN. But NF_NETDEV_EGRESS
> > == NF_INET_LOCAL_IN == 1, so a netdev-family base chain on the egress hook
> > passes both the switch and nft_fib_validate() (which also keys only on the
> > hook number). Egress packets have no input device, so nft_fib_can_skip()
> > dereferences NULL.
>
> By reading your description, does your kernel include this patch?
>
Thanks for pointing this out. I just rechecked my verification script
and found a bug that failed to pull the latest version of nf.
(I wrongly assumed it succeeded and checked on a code-based one month older).

Sorry for the false alarm. Nvm about this email; I fixed the issue,
and it won't happen again.

Xiang

> commit d07955dd34ecae17d35d8c7d0a273a3fba653a8c
> Author: Theodor Arsenij Larionov-Trichkine <theodorlarionov@xxxxxxxxx>
> Date:   Mon Jun 29 12:53:11 2026 +0200
>
>     netfilter: nft_fib: reject fib expression on the netdev egress hook
>