Re: [PATCH net] seg6: fix NULL deref in input_action_end_dx{4,6}_finish() after nf hook
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-07-23 17:10:24
Also in:
lkml
On Mon, 20 Jul 2026 20:44:29 +0000 Xiang Mei (Microsoft) wrote:
When nf_hooks_lwtunnel is enabled, the End.DX4/End.DX6 actions dispatch
the decapsulated inner packet through the NF_INET_PRE_ROUTING hook chain
with input_action_end_dx{4,6}_finish() as the okfn. Both functions read
the lwtunnel state via orig_dst = skb_dst(skb) and dereference
orig_dst->lwtstate.Per Sashiko's feedback - we need to validate not only that the dst is there but also that it is of the expected type, no? -- pw-bot: cr