Patrick McHardy [off-list ref] wrote:

Great work tracking this down. But I fear the problem will come back
haunt us with this patch. The are more places where a packet can be
queued indefinitely, for example stopped qdiscs. IMO the best fix
is to drop the conntrack reference once the packet leaves IP, so we
don't have to make any assumptions about what will happen to the
packet - this would be in ip_finish_output2(). Could you send a patch
that does this? While you're at it, you could also remove this part
from ip_conntrack_standalone:

Agreed.

BTW, please use nf_reset() instead of open coding this.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt