linux-kernel - Re: [syzbot] [netfilter?] WARNING in nf_conntrack_cleanup_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89i+V0XfUMjo5azSAkcr6EKucQFs6fv6mpNeL3rN41SsTzg@mail.gmail.com>
Date: Sat, 13 Dec 2025 14:30:30 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Florian Westphal <fw@...len.de>
Cc: Jakub Kicinski <kuba@...nel.org>, 
	syzbot <syzbot+4393c47753b7808dac7d@...kaller.appspotmail.com>, 
	coreteam@...filter.org, davem@...emloft.net, horms@...nel.org, 
	kadlec@...filter.org, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, 
	netfilter-devel@...r.kernel.org, pabeni@...hat.com, pablo@...filter.org, 
	phil@....cc, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [netfilter?] WARNING in nf_conntrack_cleanup_net_list

On Sat, Dec 13, 2025 at 2:27 PM Florian Westphal <fw@...len.de> wrote:
>
> Jakub Kicinski <kuba@...nel.org> wrote:
> > On Thu, 11 Dec 2025 10:38:31 -0800 syzbot wrote:
> > > ------------[ cut here ]------------
> > > conntrack cleanup blocked for 60s
> > > WARNING: net/netfilter/nf_conntrack_core.c:2512 at
> >
> > Yes, I was about to comment on the patch which added the warning..
> >
> > There is still a leak somewhere. Running ip_defrag.sh and then load /
> > unload ipvlan repros this (modprobe ipvlan is a quick check if the
> > cleanup thread is wedged, if it is modprobe will hang, if it isn't
> > run ip_defrag.sh, again etc).
> >
> > I looked around last night but couldn't find an skb stuck anywhere.
> > The nf_conntrack_net->count was == 1
>
> Its caused skb skb fraglist skbs that still hold nf_conn references
> on the softnet data defer lists.
>
> setting net.core.skb_defer_max=0 makes the hang disappear for me.

What kind of packets ? TCP ones ?