linux-kernel - Re: [syzbot] [netfilter?] WARNING in nf_conntrack_cleanup_net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iKDFe83G4_bmzPVkKwVwNcxTX1pyjBqoHwrt+rk3A9=dQ@mail.gmail.com>
Date: Sat, 13 Dec 2025 14:58:46 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Florian Westphal <fw@...len.de>
Cc: Jakub Kicinski <kuba@...nel.org>, 
	syzbot <syzbot+4393c47753b7808dac7d@...kaller.appspotmail.com>, 
	coreteam@...filter.org, davem@...emloft.net, horms@...nel.org, 
	kadlec@...filter.org, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, 
	netfilter-devel@...r.kernel.org, pabeni@...hat.com, pablo@...filter.org, 
	phil@....cc, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [netfilter?] WARNING in nf_conntrack_cleanup_net_list

On Sat, Dec 13, 2025 at 2:40 PM Florian Westphal <fw@...len.de> wrote:
>
> Eric Dumazet <edumazet@...gle.com> wrote:
> > > > I looked around last night but couldn't find an skb stuck anywhere.
> > > > The nf_conntrack_net->count was == 1
> > >
> > > Its caused skb skb fraglist skbs that still hold nf_conn references
> > > on the softnet data defer lists.
> > >
> > > setting net.core.skb_defer_max=0 makes the hang disappear for me.
> >
> > What kind of packets ? TCP ones ?
>
> UDP, but I can't say yet if thats an udp specific issue or not.
> (the packets are generated via ip_defrag.c).

skb_release_head_state() does not follow the fraglist. Oh well.

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a00808f7be6a1b86c595183f8b131996e3d0afcc..f597769d8c206dc063b53938a18edbe9620101d9
100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1497,7 +1497,9 @@ void napi_consume_skb(struct sk_buff *skb, int budget)

        DEBUG_NET_WARN_ON_ONCE(!in_softirq());

-       if (skb->alloc_cpu != smp_processor_id() && !skb_shared(skb)) {
+       if (skb->alloc_cpu != smp_processor_id() &&
+           !skb_shared(skb) &&
+           !skb_has_frag_list(skb)) {
                skb_release_head_state(skb);
                return skb_attempt_defer_free(skb);
        }