netdev - Re: [PATCH v1 3/3] liveupdate: suppress TCP RST during post-kexec restore window

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <19c16df6e07.5d6555571430461.7492468111934043630@linux.beauty>
Date: Sun, 01 Feb 2026 09:44:27 +0800
From: Li Chen <me@...ux.beauty>
To: "Jakub Kicinski" <kuba@...nel.org>
Cc: "Jonathan Corbet" <corbet@....net>,
	"Pasha Tatashin" <pasha.tatashin@...een.com>,
	"Mike Rapoport" <rppt@...nel.org>,
	"Pratyush Yadav" <pratyush@...nel.org>,
	"Eric Dumazet" <edumazet@...gle.com>,
	"Neal Cardwell" <ncardwell@...gle.com>,
	"Kuniyuki Iwashima" <kuniyu@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	"David Ahern" <dsahern@...nel.org>,
	"Paolo Abeni" <pabeni@...hat.com>, "Simon Horman" <horms@...nel.org>,
	"Andrew Morton" <akpm@...ux-foundation.org>,
	"Borislav Petkov" <bp@...en8.de>,
	"Randy Dunlap" <rdunlap@...radead.org>,
	"Pawan Gupta" <pawan.kumar.gupta@...ux.intel.com>,
	"Petr Mladek" <pmladek@...e.com>,
	"Feng Tang" <feng.tang@...ux.alibaba.com>,
	"Kees Cook" <kees@...nel.org>, "Li RongQing" <lirongqing@...du.com>,
	"Arnd Bergmann" <arnd@...db.de>,
	"Askar Safin" <safinaskar@...il.com>,
	"Frank van der Linden" <fvdl@...gle.com>,
	"linux-doc" <linux-doc@...r.kernel.org>,
	"linux-kernel" <linux-kernel@...r.kernel.org>,
	"netdev" <netdev@...r.kernel.org>
Subject: Re: [PATCH v1 3/3] liveupdate: suppress TCP RST during post-kexec
 restore window

Hi Jakub,

 > On Fri, 30 Jan 2026 22:51:19 +0800 Li Chen wrote:
 > > During a kexec-based live update, userspace may restore established TCP
 > > connections after the new kernel has booted (e.g. via CRIU). Any packet
 > > arriving for a not-yet-restored socket will hit the no-socket path and
 > > trigger a TCP RST, causing the peer to immediately drop the connection.
 > 
 > Can you not add a filter to simply drop those packets until workload is
 > running again? It'd actually be less racy than this hac^w patch ...
 > 

Thanks for the suggestion.

When you say "add a filter", do you mean installing a temporary drop rule
(nftables/iptables/tc) in the network domain which does not get rebooted by
kexec (e.g. LB/ToR/host firewall), so packets never reach the new kernel
until the workload is restored and ready?

If you meant a filter inside the kexec'ed kernel, I'm worried it won't cover
the critical window: kexec resets the ruleset, so we'd have to install the
drop rule extremely early (initramfs) before any packets hit the no-socket
path, which still seems inherently racy.

If the expectation is to drain/blackhole traffic externally and re-enable it
once the workload is running again, I can rework the series to keep only the
restore-window tracking plus a clear "restore done" control plane, and rely
on the external filter for the data plane.

Regards
Li