[NETFILTER]: Fix crash with bridge-netfilter in xfrm_lookup Bridge-netfilter attaches a fake dst entry without dst->ops to bridged packets, which makes xfrm_lookup crash. Skip the lookup since IPsec isn't supposed to work on a pure bridge anyway. Signed-off-by: Patrick McHardy --- commit 98a533612cd7cc51482972b84ac9845a46e81bc9 tree 4b509dae626aaff8cd2e6521425d81ca0bcda1d4 parent d64d19d938ca48d1a4470010f8d48ceac28f4317 author Patrick McHardy Mon, 20 Feb 2006 19:34:57 +0100 committer Patrick McHardy Mon, 20 Feb 2006 19:34:57 +0100 net/ipv4/netfilter.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c index ed42cdc..ae1e75d 100644 --- a/net/ipv4/netfilter.c +++ b/net/ipv4/netfilter.c @@ -87,6 +87,13 @@ int ip_xfrm_me_harder(struct sk_buff **p if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) return 0; +#ifdef CONFIG_BRIDGE_NETFILTER + /* bridge netfilter attaches a fake dst entry without dst->ops to bridged + * packets, which makes xfrm_lookup crash. Skip the lookup since IPsec + * isn't supposed to work on a pure bridge anyway. */ + if ((*pskb)->dst->ops == NULL) + return 0; +#endif if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0) return -1;