netdev - Re: TPROXY + Attempt to release TCP socket in state 1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 9 Jul 2022 08:41:14 +0200
From:   Willy Tarreau <w@....eu>
To:     Michelle Bies <mimbies@...look.com>
Cc:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Eric Dumazet <edumazet@...gle.com>
Subject: Re: TPROXY + Attempt to release TCP socket in state 1

Hi,

On Sat, Jul 09, 2022 at 06:14:14AM +0000, Michelle Bies wrote:
> Hi Eric
> unfortunately, nobody response to my problem :(
> Did I report my problem to the right mailing list? 

You sent it only 4 days ago! As you might have noticed you're not the
only one to request help, code reviews or anything that requires time
from only a few people. What progress have you made on your side on
the analysis of this problem in during this time, that you could share
to save precious time to those who are going to help you, and to make
your issue more interesting to analyse than other ones ?

Also, I'm seeing that your kernel is tainted by an out-of-tree module:

> >   CPU: 5 PID: 0 Comm: swapper/5 Tainted: GO 5.4.181+ #9
                                             ^^

Most likely it's this "xt_geoip" module but it may also be anything
else I have not spotted in your dump. Have you rechecked without it ?
While unlikely to be related, any out-of-tree code must be handled
with extreme care, as their impact on the rest of the kernel remains
mostly unknown, so they're the first ones to disable during
troubleshooting.

> > My current kernel is 5.4 and these are my iptables config:

Please always mention the exact version in reports. I've seen "5.4.181+"
in your dump, which means 5.4.181 plus extra patches. Have you tried
again without them ?

Hoping this helps,
Willy