ip_queue_xmit2 inconsistency regarding skb->sk

[Rolf Fokkens <fokkensr@linux06.vertis.nl>]

Hi!

I posted a kernel oops related to netfilter/REDIRECT. It seems like 
ip_queue_xmit2 crashes on (skb->sk == NULL) in calling

    ip_dont_fragment(sk, &rt->u.dst) 

which can't handle the (sk == NULL) situation. Of course there is the matter of
why (sk == NULL) in the first place. Haven't figured that out yet, nf_hook_slow
may cause do this somehow.

The other matter however is wether or not ip_queue_xmit2 should be able to 
handle the (skb->sk == NULL) situation. The code is not consistent on that
subject.

It seems like the if statement:

    if (skb_headroom(skb) < dev->hard_header_len && dev->hard_header) {

handles the (sk == NULL) situation, given the line "if (sk)". Other parts of
ip_queue_xmit2 seem to assume (sk != NULL), like the ip_dont_fragment call
or lines like "skb->priority = sk->priority".

OK, this is not the answer on the why of the kernel oops. I hope however that
this question is related and helps in finding the answer

Rolf