1 files changed, 4 insertions, 2 deletions

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index c48adc565e92..667c1d4ca984 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1725,8 +1725,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
                 case CIPSO_V4_TAG_LOCAL:
                         /* This is a non-standard tag that we only allow for
                          * local connections, so if the incoming interface is
-                         * not the loopback device drop the packet. */
-                        if (!(skb->dev->flags & IFF_LOOPBACK)) {
+                         * not the loopback device drop the packet. Further,
+                         * there is no legitimate reason for setting this from
+                         * userspace so reject it if skb is NULL. */
+                        if (skb == NULL || !(skb->dev->flags & IFF_LOOPBACK)) {
                                 err_offset = opt_iter;
                                 goto validate_return_locked;
                         }