On Mon, Jun 5, 2017 at 3:26 PM, Nikolay Aleksandrov
[off-list ref] wrote:

We might call br_afspec() with p == NULL which is a valid use case if
the action is on the bridge device itself, but the bridge tunnel code
dereferences the p pointer without checking, so check if p is null
first.

Reported-by: Gustavo A. R. Silva <redacted>
Fixes: efa5356b0d97 ("bridge: per vlan dst_metadata netlink support")
Signed-off-by: Nikolay Aleksandrov <redacted>

Acked-by: Roopa Prabhu <redacted>

Thanks Nikolay.