linux-kernel - Re: [PATCH v1 3/3] liveupdate: suppress TCP RST during post-kexec restore window

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <19c217fcb23.839ade332430911.7160767633796349662@linux.beauty>
Date: Tue, 03 Feb 2026 11:15:49 +0800
From: Li Chen <me@...ux.beauty>
To: "Jakub Kicinski" <kuba@...nel.org>
Cc: "Jonathan Corbet" <corbet@....net>,
	"Pasha Tatashin" <pasha.tatashin@...een.com>,
	"Mike Rapoport" <rppt@...nel.org>,
	"Pratyush Yadav" <pratyush@...nel.org>,
	"Eric Dumazet" <edumazet@...gle.com>,
	"Neal Cardwell" <ncardwell@...gle.com>,
	"Kuniyuki Iwashima" <kuniyu@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	"David Ahern" <dsahern@...nel.org>,
	"Paolo Abeni" <pabeni@...hat.com>, "Simon Horman" <horms@...nel.org>,
	"Andrew Morton" <akpm@...ux-foundation.org>,
	"Borislav Petkov" <bp@...en8.de>,
	"Randy Dunlap" <rdunlap@...radead.org>,
	"Pawan Gupta" <pawan.kumar.gupta@...ux.intel.com>,
	"Petr Mladek" <pmladek@...e.com>,
	"Feng Tang" <feng.tang@...ux.alibaba.com>,
	"Kees Cook" <kees@...nel.org>, "Li RongQing" <lirongqing@...du.com>,
	"Arnd Bergmann" <arnd@...db.de>,
	"Askar Safin" <safinaskar@...il.com>,
	"Frank van der Linden" <fvdl@...gle.com>,
	"linux-doc" <linux-doc@...r.kernel.org>,
	"linux-kernel" <linux-kernel@...r.kernel.org>,
	"netdev" <netdev@...r.kernel.org>
Subject: Re: [PATCH v1 3/3] liveupdate: suppress TCP RST during post-kexec
 restore window

Hi Jakub,

 ---- On Tue, 03 Feb 2026 08:53:20 +0800  Jakub Kicinski <kuba@...nel.org> wrote --- 
 > On Sun, 01 Feb 2026 09:44:27 +0800 Li Chen wrote:
 > >  > On Fri, 30 Jan 2026 22:51:19 +0800 Li Chen wrote:  
 > >  > > During a kexec-based live update, userspace may restore established TCP
 > >  > > connections after the new kernel has booted (e.g. via CRIU). Any packet
 > >  > > arriving for a not-yet-restored socket will hit the no-socket path and
 > >  > > trigger a TCP RST, causing the peer to immediately drop the connection.  
 > >  > 
 > >  > Can you not add a filter to simply drop those packets until workload is
 > >  > running again? It'd actually be less racy than this hac^w patch ...
 > >  >   
 > > 
 > > Thanks for the suggestion.
 > > 
 > > When you say "add a filter", do you mean installing a temporary drop rule
 > > (nftables/iptables/tc) in the network domain which does not get rebooted by
 > > kexec (e.g. LB/ToR/host firewall), so packets never reach the new kernel
 > > until the workload is restored and ready?
 > > 
 > > If you meant a filter inside the kexec'ed kernel, I'm worried it won't cover
 > > the critical window: kexec resets the ruleset, so we'd have to install the
 > > drop rule extremely early (initramfs) before any packets hit the no-socket
 > > path, which still seems inherently racy.
 > 
 > I'm not sure what your flow is exactly, but I assume you drive 
 > the workload restore from user space already?
 > 

Yes, in our PoC setup the post-kexec restore flow is driven from initramfs / early userspace.

We pass an initramfs via kexec --initrd and install a temporary iptables INPUT DROP rule from a dracut pre-mount hook (keyed by a cmdline like luo_tcp_drop_port=...). In our
external-peer test this avoids the early TCP RST window; the peer just retransmits/timeouts until CRIU restore recreates the socket.

The downside is that it makes initramfs heavier (iptables userspace + required xtables extensions, and it relies on legacy iptables filter support being available early). Not sure
this is a great general solution, but it can work when initramfs is under our control.

Regards,
Li