tun: add a missing nf_reset() in tun_net_xmit()
Dave reported following crash :
general protection fault: 0000 [#1] SMP
CPU 2
Pid: 25407, comm: qemu-kvm Not tainted 3.7.9-205.fc18.x86_64 #1 Hewlett-Packard HP Z400 Workstation/0B4Ch
RIP: 0010:[<
ffffffffa0399bd5>] [<
ffffffffa0399bd5>] destroy_conntrack+0x35/0x120 [nf_conntrack]
RSP: 0018:
ffff880276913d78 EFLAGS:
00010206
RAX:
50626b6b7876376c RBX:
ffff88026e530d68 RCX:
ffff88028d158e00
RDX:
ffff88026d0d5470 RSI:
0000000000000011 RDI:
0000000000000002
RBP:
ffff880276913d88 R08:
0000000000000000 R09:
ffff880295002900
R10:
0000000000000000 R11:
0000000000000003 R12:
ffffffff81ca3b40
R13:
ffffffff8151a8e0 R14:
ffff880270875000 R15:
0000000000000002
FS:
00007ff3bce38a00(0000) GS:
ffff88029fc40000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
000000008005003b
CR2:
00007fd1430bd000 CR3:
000000027042b000 CR4:
00000000000027e0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
Process qemu-kvm (pid: 25407, threadinfo
ffff880276912000, task
ffff88028c369720)
Stack:
ffff880156f59100 ffff880156f59100 ffff880276913d98 ffffffff815534f7
ffff880276913db8 ffffffff8151a74b ffff880270875000 ffff880156f59100
ffff880276913dd8 ffffffff8151a5a6 ffff880276913dd8 ffff88026d0d5470
Call Trace:
[<
ffffffff815534f7>] nf_conntrack_destroy+0x17/0x20
[<
ffffffff8151a74b>] skb_release_head_state+0x7b/0x100
[<
ffffffff8151a5a6>] __kfree_skb+0x16/0xa0
[<
ffffffff8151a666>] kfree_skb+0x36/0xa0
[<
ffffffff8151a8e0>] skb_queue_purge+0x20/0x40
[<
ffffffffa02205f7>] __tun_detach+0x117/0x140 [tun]
[<
ffffffffa022184c>] tun_chr_close+0x3c/0xd0 [tun]
[<
ffffffff8119669c>] __fput+0xec/0x240
[<
ffffffff811967fe>] ____fput+0xe/0x10
[<
ffffffff8107eb27>] task_work_run+0xa7/0xe0
[<
ffffffff810149e1>] do_notify_resume+0x71/0xb0
[<
ffffffff81640152>] int_signal+0x12/0x17
Code: 00 00 04 48 89 e5 41 54 53 48 89 fb 4c 8b a7 e8 00 00 00 0f 85 de 00 00 00 0f b6 73 3e 0f b7 7b 2a e8 10 40 00 00 48 85 c0 74 0e <48> 8b 40 28 48 85 c0 74 05 48 89 df ff d0 48 c7 c7 08 6a 3a a0
RIP [<
ffffffffa0399bd5>] destroy_conntrack+0x35/0x120 [nf_conntrack]
RSP <
ffff880276913d78>
This is because tun_net_xmit() needs to call nf_reset()
before queuing skb into receive_queue
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>