Re: [PATCH] netfilter: xt_policy: add NULL check for skb_dst() in output policy match

Fang Xieyan [off-list ref] wrote:

match_policy_out() accesses dst->xfrm without checking whether
skb_dst() returned NULL. If no dst entry is attached to the skb,
this dereference is invalid.

If there is no dst we'd have crashed already:

        return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
                       net, sk, skb, NULL, skb_dst_dev(skb),
                       dst_output);

likewise, okter in ip stack:

        if (lwtunnel_xmit_redirect(dst->lwtstate)) {

there are several other places that don't do NULL checks here.
So either all of those need them or none at all.