So there’s an issue with Suricata (6.0.2 with Linux 5.4.99) when used with repeat mode and NFQUEUE that was discussed over a year ago where this warning in tcp_output.c gets triggered:
/* Keep one reference on sk_wmem_alloc. * Will be released by sk_free() from here or tcp_tasklet_func() */ WARN_ON(refcount_sub_and_test(skb->truesize - 1, &sk->sk_wmem_alloc));
A patch to Suricata was provided here:
The patch looks a bit experimental and wasn’t merged, so I’m wondering if this is the best known solution to the issue at the moment?