Patrick McHardy wrote:
> which goes away by turning of CONFIG_STACKPROTECTOR. Now it seems
> to work, but the host crashes before the guests are fully up somewhere
> in the tun-device. I couldn't capture the oops yet, but I'll try
> to fix it myself.

This was caused by a local change of mine to attach to existing
tun-devices, combined with a bug in the tun driver, which looks
like it was introduced by this patch:

commit c70f182940f988448f3c12a209d18b1edc276e33
Author: Eric W. Biederman <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
Date:   Tue Jan 20 11:07:17 2009 +0000

     tun: Fix races between tun_net_close and free_netdev.

When creating the device using tunctl the sk->sk_sleep poiner is
set to the read_wait completion of the file opened by tunctl, but
it is not refreshed when attaching to lguest or released when
closing the file, causing a stale pointer dereference in
tun_sock_write_space().

Eric, please review. Thanks.

Signed-off-by: Patrick McHardy <kaber-dcUjhNyLwpNeoWH0uzbU5w@public.gmane.org>