netdev - Re: [PATCH v1 3/3] liveupdate: suppress TCP RST during post-kexec restore window

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260202165320.7ddb25f8@kernel.org>
Date: Mon, 2 Feb 2026 16:53:20 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: Li Chen <me@...ux.beauty>
Cc: "Jonathan Corbet" <corbet@....net>, "Pasha Tatashin"
 <pasha.tatashin@...een.com>, "Mike Rapoport" <rppt@...nel.org>, "Pratyush
 Yadav" <pratyush@...nel.org>, "Eric Dumazet" <edumazet@...gle.com>, "Neal
 Cardwell" <ncardwell@...gle.com>, "Kuniyuki Iwashima" <kuniyu@...gle.com>,
 "David S. Miller" <davem@...emloft.net>, "David Ahern"
 <dsahern@...nel.org>, "Paolo Abeni" <pabeni@...hat.com>, "Simon Horman"
 <horms@...nel.org>, "Andrew Morton" <akpm@...ux-foundation.org>, "Borislav
 Petkov" <bp@...en8.de>, "Randy Dunlap" <rdunlap@...radead.org>, "Pawan
 Gupta" <pawan.kumar.gupta@...ux.intel.com>, "Petr Mladek"
 <pmladek@...e.com>, "Feng Tang" <feng.tang@...ux.alibaba.com>, "Kees Cook"
 <kees@...nel.org>, "Li RongQing" <lirongqing@...du.com>, "Arnd Bergmann"
 <arnd@...db.de>, "Askar Safin" <safinaskar@...il.com>, "Frank van der
 Linden" <fvdl@...gle.com>, "linux-doc" <linux-doc@...r.kernel.org>,
 "linux-kernel" <linux-kernel@...r.kernel.org>, "netdev"
 <netdev@...r.kernel.org>
Subject: Re: [PATCH v1 3/3] liveupdate: suppress TCP RST during post-kexec
 restore window

On Sun, 01 Feb 2026 09:44:27 +0800 Li Chen wrote:
>  > On Fri, 30 Jan 2026 22:51:19 +0800 Li Chen wrote:  
>  > > During a kexec-based live update, userspace may restore established TCP
>  > > connections after the new kernel has booted (e.g. via CRIU). Any packet
>  > > arriving for a not-yet-restored socket will hit the no-socket path and
>  > > trigger a TCP RST, causing the peer to immediately drop the connection.  
>  > 
>  > Can you not add a filter to simply drop those packets until workload is
>  > running again? It'd actually be less racy than this hac^w patch ...
>  >   
> 
> Thanks for the suggestion.
> 
> When you say "add a filter", do you mean installing a temporary drop rule
> (nftables/iptables/tc) in the network domain which does not get rebooted by
> kexec (e.g. LB/ToR/host firewall), so packets never reach the new kernel
> until the workload is restored and ready?
> 
> If you meant a filter inside the kexec'ed kernel, I'm worried it won't cover
> the critical window: kexec resets the ruleset, so we'd have to install the
> drop rule extremely early (initramfs) before any packets hit the no-socket
> path, which still seems inherently racy.

I'm not sure what your flow is exactly, but I assume you drive 
the workload restore from user space already?