netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2189550
Upstream Status: commit e1f543d

commit e1f543d
Author: Tijs Van Buggenhout <tijs.van.buggenhout@axsguard.com>
Date:   Thu May 25 12:25:26 2023 +0200

    netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper

    An nf_conntrack_helper from nf_conn_help may become NULL after DNAT.

    Observed when TCP port 1720 (Q931_PORT), associated with h323 conntrack
    helper, is DNAT'ed to another destination port (e.g. 1730), while
    nfqueue is being used for final acceptance (e.g. snort).

    This happenned after transition from kernel 4.14 to 5.10.161.

    Workarounds:
     * keep the same port (1720) in DNAT
     * disable nfqueue
     * disable/unload h323 NAT helper

    $ linux-5.10/scripts/decode_stacktrace.sh vmlinux < /tmp/kernel.log
    BUG: kernel NULL pointer dereference, address: 0000000000000084
    [..]
    RIP: 0010:nf_conntrack_update (net/netfilter/nf_conntrack_core.c:2080 net/netfilter/nf_conntrack_core.c:2134) nf_conntrack
    [..]
    nfqnl_reinject (net/netfilter/nfnetlink_queue.c:237) nfnetlink_queue
    nfqnl_recv_verdict (net/netfilter/nfnetlink_queue.c:1230) nfnetlink_queue
    nfnetlink_rcv_msg (net/netfilter/nfnetlink.c:241) nfnetlink
    [..]

    Fixes: ee04805 ("netfilter: conntrack: make conntrack userspace helpers work again")
    Signed-off-by: Tijs Van Buggenhout <tijs.van.buggenhout@axsguard.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Author: fw-strlen

net/netfilter/nf_conntrack_core.c

@@ -2282,6 +2282,9 @@ static int nf_confirm_cthelper(struct sk_buff *skb, struct nf_conn *ct,
 		return 0;
 
 	helper = rcu_dereference(help->helper);
+	if (!helper)
+		return 0;
+
 	if (!(helper->flags & NF_CT_HELPER_F_USERSPACE))
 		return 0;