diff -pruN linux-2.6.orig/net/sched/cls_u32.c linux-2.6/net/sched/cls_u32.c
--- linux-2.6.orig/net/sched/cls_u32.c	2008-01-29 23:02:50.000000000 +0200
+++ linux-2.6/net/sched/cls_u32.c	2008-01-30 11:28:00.000000000 +0200
@@ -181,11 +181,13 @@ check_terminal:
 
 		ht = n->ht_down;
 		sel = 0;
-		if (ht->divisor)
-			sel = ht->divisor&u32_hash_fold(*(u32*)(ptr+n->sel.hoff), &n->sel,n->fshift);
 
-		if (!(n->sel.flags&(TC_U32_VAROFFSET|TC_U32_OFFSET|TC_U32_EAT)))
+		if (!(n->sel.flags&(TC_U32_VAROFFSET|TC_U32_OFFSET|TC_U32_EAT))) {
+			if (!ht->divisor)
+				goto next_ht;
+			sel = ht->divisor&u32_hash_fold(*(u32*)(ptr+n->sel.hoff), &n->sel,n->fshift);
 			goto next_ht;
+		}
 
 		if (n->sel.flags&(TC_U32_OFFSET|TC_U32_VAROFFSET)) {
 			off2 = n->sel.off + 3;
@@ -198,6 +200,9 @@ check_terminal:
 			off2 = 0;
 		}
 
+		if (ht->divisor && ptr+n->sel.hoff < skb_tail_pointer(skb))
+			sel = ht->divisor&u32_hash_fold(*(u32*)(ptr+n->sel.hoff), &n->sel,n->fshift);
+
 		if (ptr < skb_tail_pointer(skb))
 			goto next_ht;
 	}