On Mon, Jun 24, 2013 at 05:52:08PM +0800, Gao feng wrote:
> On 06/24/2013 05:41 PM, George Spelvin wrote:
> >> Please try the patch below,
> >> I think this bug is introduced by me :(
> >>
> >> Thanks!
> > 
> > Well, you changed it, but it still crashes.
> > 
> > It's now at del_timer+0x9/0x58, with the code being:
> 
> This one should work.
> 
> Thanks for your quickly reply.

I managed to crash it using a group != 1 (default) and enabling
batching:

iptables -I INPUT -j ULOG --ulog-nlgroup 2 --ulog-qthresh 50

It seems ulog->nlgroup[i] is always left unset.

I have mangled your patch, find it attached.