netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

Browse source

tc ingress and openvswitch do not guarantee routing information to be
available. These subsystems use the conntrack helper infrastructure, and
the SIP helper relies on the skb_dst() to be present if
sip_external_media is set to 1 (which is disabled by default as a module
parameter).

This effectively disables the sip_external_media toggle for these
subsystems without resulting in a crash.

Fixes: cae3a26275 ("openvswitch: Allow attaching helpers to ct action")
Fixes: b57dc7c13e ("net/sched: Introduce action ct")
Cc: stable@vger.kernel.org
Reported-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>

...

This commit is contained in:

Pablo Neira Ayuso 2026-06-26 13:24:49 +02:00 • committed by Florian Westphal

parent 7cd9103283

commit e5e24a365a

1 changed files with 5 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

net/netfilter/nf_conntrack_sip.c

View file