Re: [PATCH net 4/9] netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

Florian Westphal [off-list ref] wrote:

From: Pablo Neira Ayuso <pablo@netfilter.org>

tc ingress and openvswitch do not guarantee routing information to be
available. These subsystems use the conntrack helper infrastructure, and
the SIP helper relies on the skb_dst() to be present if
sip_external_media is set to 1 (which is disabled by default as a module
parameter).

The sashiko drive-by appears real, I submitted a patch for it.
Its not a regression added by this patch but a unrelated issue.

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260701062922.9660-1-fw@strlen.de/