I have observed this using kernel 2.6.18 - I'm not sure if the patches for other kernels have the same problem. In linux/net/ipv4/netfilter/ipt_layer7.c, at line 471, the original source looks like: static struct ipt_match layer7_match = { .name = "layer7", .match = &match, .checkentry = &checkentry, .... }; The members match and checkentry in ipt_match (really struct xt_match in include/linux/netfilter/x_tables.h) are pointers to functions. In ipt_layer7.c match and checkentry are the names of two functions that are placed into this structure. They're inserted as a pointer to a function pointer, which I'm pretty sure is not good. This can be fixed by changing two of layer7_match's members from: .match = &match, .checkentry = &checkentry, to .match = match, .checkentry = checkentry,
*** This bug has been marked as a duplicate of 155874 ***
Dupe.
