From: Zhengyang Chen set_expected_rtp_rtcp() dereferences skb_dst(skb)->dev when sip_external_media is enabled. The SIP helper can run from tc ingress before routing has attached a dst to the skb, so skb_dst(skb) can be NULL and the helper crashes while parsing SDP media expectations. Handle a missing skb dst by skipping the same-interface external-media optimization. Still release the routed media dst when one was obtained, and keep the existing expectation setup path unchanged. Fixes: a3419ce3356c ("netfilter: nf_conntrack_sip: add sip_external_media logic") Cc: stable@vger.kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Assisted-by: Codex:gpt-5.4 Signed-off-by: Zhengyang Chen Signed-off-by: Ren Wei --- net/netfilter/nf_conntrack_sip.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index 5ec3a4a4bbd7..302dc60c5381 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -956,7 +956,8 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff, return NF_ACCEPT; saddr = &ct->tuplehash[!dir].tuple.src.u3; } else if (sip_external_media) { - struct net_device *dev = skb_dst(skb)->dev; + struct dst_entry *skbdst = skb_dst(skb); + struct net_device *dev = skbdst ? skbdst->dev : NULL; struct dst_entry *dst = NULL; struct flowi fl; @@ -977,12 +978,14 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff, /* Don't predict any conntracks when media endpoint is reachable * through the same interface as the signalling peer. */ - if (dst) { + if (dst && dev) { bool external_media = (dst->dev == dev); dst_release(dst); if (external_media) return NF_ACCEPT; + } else if (dst) { + dst_release(dst); } } -- 2.43.0