From: Florian Westphal <fw@strlen.de>
To: Razvan Cojocaru <rzvncj@gmail.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: __nf_ct_delete_from_lists crash, with bisected guilty commit found
Date: Wed, 16 Jul 2025 20:03:11 +0200 [thread overview]
Message-ID: <aHfpX9vdb-jMGPQZ@strlen.de> (raw)
In-Reply-To: <4239da15-83ff-4ca4-939d-faef283471bb@gmail.com>
Razvan Cojocaru <rzvncj@gmail.com> wrote:
> It should crash immediately.
>
> Maybe this is what you're trying to fix in "[PATCH nf 0/4] netfilter:
> conntrack: fix obscure confirmed race"?
Yes, looks like it. Reaping the entries hits the clash resolution
logic, i.e. for the iperf tcp stream, it will do mid-stream pickup on
multiple packets (e.g. outgoing data and incoming ack), then hits clash
resolution logic.
Thats not supported for TCP, so one packet gets tossed while the
'losing' conntrack entry isn't added to the hash table but has its
confirmed bit set on anyway, which the module treats as 'I can delete it'
signal.
prev parent reply other threads:[~2025-07-16 18:03 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-16 16:36 __nf_ct_delete_from_lists crash, with bisected guilty commit found Razvan Cojocaru
2025-07-16 16:39 ` Razvan Cojocaru
2025-07-16 18:03 ` Florian Westphal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aHfpX9vdb-jMGPQZ@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=rzvncj@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.