* Re: [syzbot] [netfilter?] WARNING in nf_flow_table_extend_ct_timeout [not found] <CAO+rqLihzHZx5kUUdR7mcC=yApCUP_20OEh7KZOQhHY5_+KLYQ@mail.gmail.com> @ 2026-10-22 17:26 ` syzbot 0 siblings, 0 replies; 5+ messages in thread From: syzbot @ 2026-10-22 17:26 UTC (permalink / raw) To: linux-kernel, mike.michalo, syzkaller-bugs Hello, syzbot tried to test the proposed patch but the build/boot failed: failed to checkout kernel repo https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/main: failed to run ["git" "-c" "core.hooksPath=/dev/null" "fetch" "--force" "a5a65480fd08f84422d56537d217faf190618d6e" "main"]: exit status 128 Tested on: commit: [unknown git tree: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main kernel config: https://syzkaller.appspot.com/x/.config?x=c4b098695335c89f dashboard link: https://syzkaller.appspot.com/bug?extid=521f7e7e2b974abde99a compiler: patch: https://syzkaller.appspot.com/x/patch.diff?x=130b953e580000 ^ permalink raw reply [flat|nested] 5+ messages in thread
* [syzbot] [netfilter?] WARNING in nf_flow_table_extend_ct_timeout @ 2026-09-15 22:34 syzbot 2026-10-22 16:44 ` syzbot 0 siblings, 1 reply; 5+ messages in thread From: syzbot @ 2026-09-15 22:34 UTC (permalink / raw) To: coreteam, davem, edumazet, fw, horms, kuba, linux-kernel, netdev, netfilter-devel, pabeni, pablo, phil, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: 50d05c7c76c9 Merge tag 'landlock-7.3-rc3' of git://git.ker.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14ac428e580000 kernel config: https://syzkaller.appspot.com/x/.config?x=5e4e3a0e188a497e dashboard link: https://syzkaller.appspot.com/bug?extid=521f7e7e2b974abde99a compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 userspace arch: i386 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/daf497619736/disk-50d05c7c.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/748fbd82f647/vmlinux-50d05c7c.xz kernel image: https://storage.googleapis.com/syzbot-assets/e61c59099d07/bzImage-50d05c7c.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+521f7e7e2b974abde99a@syzkaller.appspotmail.com ------------[ cut here ]------------ 1 WARNING: net/netfilter/nf_flow_table_core.c:546 at nf_flow_table_extend_ct_timeout+0x1ee/0x2f0 net/netfilter/nf_flow_table_core.c:546, CPU#0: kworker/0:2/3335 Modules linked in: CPU: 0 UID: 0 PID: 3335 Comm: kworker/0:2 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 Workqueue: events_power_efficient nf_flow_offload_work_gc RIP: 0010:nf_flow_table_extend_ct_timeout+0x1ee/0x2f0 net/netfilter/nf_flow_table_core.c:546 Code: 00 00 00 41 83 ff 06 0f 84 9a 00 00 00 41 83 ff 05 0f 85 b0 00 00 00 e8 70 d1 ab f7 41 bf 30 75 00 00 eb 0f e8 63 d1 ab f7 90 <0f> 0b 90 41 bf 01 00 00 00 48 c7 c0 80 f2 a0 8e 48 c1 e8 03 42 80 RSP: 0000:ffffc900040ff938 EFLAGS: 00010293 RAX: ffffffff8a1bf92d RBX: ffff88807da5be00 RCX: ffff88803247ddc0 RDX: 0000000000000000 RSI: ffffffff902f6960 RDI: 000000000000002f RBP: 0000000000039e60 R08: ffff88803247ddc0 R09: 0000000000000002 R10: 0000000000000011 R11: 0000000000000000 R12: dffffc0000000000 R13: 1ffff1100fb4b7d8 R14: ffff88807da5be48 R15: 000000000000002f FS: 0000000000000000(0000) GS:ffff888124cd2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f7238c10 CR3: 000000007a894000 CR4: 00000000003526f0 DR0: ffffffffffffffff DR1: 00000000000001f7 DR2: 00000000ffffffff DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> nf_flow_offload_gc_step+0x545/0x7b0 net/netfilter/nf_flow_table_core.c:581 nf_flow_table_iterate+0x13c/0x1f0 net/netfilter/nf_flow_table_core.c:452 nf_flow_table_gc_run net/netfilter/nf_flow_table_core.c:604 [inline] nf_flow_offload_work_gc+0x22/0x70 net/netfilter/nf_flow_table_core.c:612 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [netfilter?] WARNING in nf_flow_table_extend_ct_timeout 2026-09-15 22:34 syzbot @ 2026-10-22 16:44 ` syzbot 2026-10-22 17:02 ` mixalhs 0 siblings, 1 reply; 5+ messages in thread From: syzbot @ 2026-10-22 16:44 UTC (permalink / raw) To: coreteam, davem, edumazet, edumazet, fw, horms, kuba, linux-kernel, mike.michalo, netdev, netfilter-devel, pabeni, pablo, phil, stable, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: abeacca61eea Merge branch 'net-mlx5-hws-fix-modify-header-.. git tree: net console+strace: https://syzkaller.appspot.com/x/log.txt?x=111f4d0d580000 kernel config: https://syzkaller.appspot.com/x/.config?x=c4b098695335c89f dashboard link: https://syzkaller.appspot.com/bug?extid=521f7e7e2b974abde99a compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1491e029580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=157d410d580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/22930d0e9391/disk-abeacca6.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/d2e18d51f288/vmlinux-abeacca6.xz kernel image: https://storage.googleapis.com/syzbot-assets/69879bb16225/bzImage-abeacca6.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+521f7e7e2b974abde99a@syzkaller.appspotmail.com ------------[ cut here ]------------ 1 WARNING: net/netfilter/nf_flow_table_core.c:553 at nf_flow_table_extend_ct_timeout+0x1ee/0x2f0 net/netfilter/nf_flow_table_core.c:553, CPU#1: kworker/1:2/123 Modules linked in: CPU: 1 UID: 0 PID: 123 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: events_power_efficient nf_flow_offload_work_gc RIP: 0010:nf_flow_table_extend_ct_timeout+0x1ee/0x2f0 net/netfilter/nf_flow_table_core.c:553 Code: 00 00 00 41 83 ff 06 0f 84 9a 00 00 00 41 83 ff 05 0f 85 b0 00 00 00 e8 e0 10 a9 f7 41 bf 30 75 00 00 eb 0f e8 d3 10 a9 f7 90 <0f> 0b 90 41 bf 01 00 00 00 48 c7 c0 80 f2 a0 8f 48 c1 e8 03 42 80 RSP: 0018:ffffc90002dcf930 EFLAGS: 00010293 RAX: ffffffff8a1effad RBX: ffff888027a52900 RCX: ffff88801ffa1f40 RDX: 0000000000000000 RSI: ffffffff912fa640 RDI: 000000000000002f RBP: 0000000000000737 R08: ffff88801ffa1f40 R09: 0000000000000002 R10: 0000000000000011 R11: 0000000000000000 R12: dffffc0000000000 R13: 1ffff11004f4a538 R14: ffff888027a52948 R15: 000000000000002f FS: 0000000000000000(0000) GS:ffff888123bbd000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f926bd5bd3c CR3: 000000000fb48000 CR4: 00000000003526f0 Call Trace: <TASK> nf_flow_offload_gc_step+0x5aa/0x840 net/netfilter/nf_flow_table_core.c:593 nf_flow_table_iterate+0x13c/0x1f0 net/netfilter/nf_flow_table_core.c:459 nf_flow_table_gc_run net/netfilter/nf_flow_table_core.c:616 [inline] nf_flow_offload_work_gc+0x22/0x70 net/netfilter/nf_flow_table_core.c:624 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [netfilter?] WARNING in nf_flow_table_extend_ct_timeout 2026-10-22 16:44 ` syzbot @ 2026-10-22 17:02 ` mixalhs 2026-10-22 17:20 ` syzbot 0 siblings, 1 reply; 5+ messages in thread From: mixalhs @ 2026-10-22 17:02 UTC (permalink / raw) To: syzbot Cc: coreteam, davem, edumazet, edumazet, fw, horms, kuba, linux-kernel, netdev, netfilter-devel, pabeni, pablo, phil, stable, syzkaller-bugs [-- Attachment #1: Type: text/plain, Size: 3531 bytes --] #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main On Thu, Oct 22, 2026 at 6:44 PM syzbot <syzbot+521f7e7e2b974abde99a@syzkaller.appspotmail.com> wrote: > > syzbot has found a reproducer for the following issue on: > > HEAD commit: abeacca61eea Merge branch 'net-mlx5-hws-fix-modify-header-.. > git tree: net > console+strace: https://syzkaller.appspot.com/x/log.txt?x=111f4d0d580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=c4b098695335c89f > dashboard link: https://syzkaller.appspot.com/bug?extid=521f7e7e2b974abde99a > compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1491e029580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=157d410d580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/22930d0e9391/disk-abeacca6.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/d2e18d51f288/vmlinux-abeacca6.xz > kernel image: https://storage.googleapis.com/syzbot-assets/69879bb16225/bzImage-abeacca6.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+521f7e7e2b974abde99a@syzkaller.appspotmail.com > > ------------[ cut here ]------------ > 1 > WARNING: net/netfilter/nf_flow_table_core.c:553 at nf_flow_table_extend_ct_timeout+0x1ee/0x2f0 net/netfilter/nf_flow_table_core.c:553, CPU#1: kworker/1:2/123 > Modules linked in: > CPU: 1 UID: 0 PID: 123 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full) > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 > Workqueue: events_power_efficient nf_flow_offload_work_gc > RIP: 0010:nf_flow_table_extend_ct_timeout+0x1ee/0x2f0 net/netfilter/nf_flow_table_core.c:553 > Code: 00 00 00 41 83 ff 06 0f 84 9a 00 00 00 41 83 ff 05 0f 85 b0 00 00 00 e8 e0 10 a9 f7 41 bf 30 75 00 00 eb 0f e8 d3 10 a9 f7 90 <0f> 0b 90 41 bf 01 00 00 00 48 c7 c0 80 f2 a0 8f 48 c1 e8 03 42 80 > RSP: 0018:ffffc90002dcf930 EFLAGS: 00010293 > RAX: ffffffff8a1effad RBX: ffff888027a52900 RCX: ffff88801ffa1f40 > RDX: 0000000000000000 RSI: ffffffff912fa640 RDI: 000000000000002f > RBP: 0000000000000737 R08: ffff88801ffa1f40 R09: 0000000000000002 > R10: 0000000000000011 R11: 0000000000000000 R12: dffffc0000000000 > R13: 1ffff11004f4a538 R14: ffff888027a52948 R15: 000000000000002f > FS: 0000000000000000(0000) GS:ffff888123bbd000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f926bd5bd3c CR3: 000000000fb48000 CR4: 00000000003526f0 > Call Trace: > <TASK> > nf_flow_offload_gc_step+0x5aa/0x840 net/netfilter/nf_flow_table_core.c:593 > nf_flow_table_iterate+0x13c/0x1f0 net/netfilter/nf_flow_table_core.c:459 > nf_flow_table_gc_run net/netfilter/nf_flow_table_core.c:616 [inline] > nf_flow_offload_work_gc+0x22/0x70 net/netfilter/nf_flow_table_core.c:624 > process_one_work kernel/workqueue.c:3396 [inline] > process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 > worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 > kthread+0x38b/0x480 kernel/kthread.c:436 > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 > </TASK> > > > --- > If you want syzbot to run the reproducer, reply with: > #syz test: git://repo/address.git branch-or-commit-hash > If you attach or paste a git patch, syzbot will apply it before testing. [-- Attachment #2: 0001-netfilter-flowtable-extend-ct-timeout-of-offloaded-G.patch --] [-- Type: application/octet-stream, Size: 3049 bytes --] From: Michail Andreas Michalopoulos <mike.michalo@gmail.com> Subject: [PATCH nf] netfilter: flowtable: extend ct timeout of offloaded GRE flows Since commit 03428ca5cee9 ("netfilter: conntrack: rework offload nf_conn timeout extension logic"), the flowtable gc worker extends the timeout of an offloaded conntrack entry from nf_flow_table_extend_ct_timeout() once it falls below 5 minutes. That function only knows about TCP and UDP and hits WARN_ON_ONCE() for any other layer 4 protocol. However, GRE flows can be offloaded too, both via nft_flow_offload and act_ct, since commit 4e8d9584d154 ("netfilter: flowtable: Support GRE"). The timeout of an offloaded GRE entry drops below that threshold as soon as a packet of the flow still goes through conntrack. With ip6gre tunnels using the default encapsulation limit this is ordinary traffic: the flowtable does not parse the Destination Options header in front of GRE, so every packet of the flow takes the classic forwarding path. It also happens for a packet with ttl <= 1, which the flowtable fast path passes up to the classic forwarding path. nf_conntrack_gre_packet() then refreshes ct->timeout to the GRE stream timeout (180 seconds by default), and the next gc run triggers, as reported by syzbot: WARNING: net/netfilter/nf_flow_table_core.c:553 at nf_flow_table_extend_ct_timeout+0x1ee/0x2f0 Workqueue: events_power_efficient nf_flow_offload_work_gc Call Trace: nf_flow_offload_gc_step+0x545/0x7b0 nf_flow_table_iterate+0x13c/0x1f0 nf_flow_offload_work_gc+0x22/0x70 process_scheduled_works+0xc3d/0x1630 worker_thread+0xa47/0xfb0 kthread+0x38b/0x480 Besides the splat, which panics the machine with panic_on_warn, the default branch sets the new timeout to 1 jiffy, so the conntrack entry expires right away and the offloaded flow is torn down. Handle GRE like UDP and extend the timeout to NF_CT_DAY. GRE conntrack has no protocol state to take into account, and NF_CT_DAY is also what flow_offload_add() already sets for every offloaded entry, GRE included. This also restores the behaviour from before commit 03428ca5cee9, when the conntrack gc worker extended offloaded entries of any protocol to NF_CT_DAY. Fixes: 03428ca5cee9 ("netfilter: conntrack: rework offload nf_conn timeout extension logic") Reported-by: syzbot+521f7e7e2b974abde99a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=521f7e7e2b974abde99a Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com> --- net/netfilter/nf_flow_table_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c index 36bbc7be2f..94502c97ba 100644 --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -544,6 +544,7 @@ static void nf_flow_table_extend_ct_timeout(struct nf_conn *ct) switch (l4proto) { case IPPROTO_UDP: + case IPPROTO_GRE: new_timeout = NF_CT_DAY; break; case IPPROTO_TCP: -- 2.43.0 ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [netfilter?] WARNING in nf_flow_table_extend_ct_timeout 2026-10-22 17:02 ` mixalhs @ 2026-10-22 17:20 ` syzbot 0 siblings, 0 replies; 5+ messages in thread From: syzbot @ 2026-10-22 17:20 UTC (permalink / raw) To: coreteam, davem, edumazet, edumazet, fw, horms, kuba, linux-kernel, mike.michalo, netdev, netfilter-devel, pabeni, pablo, phil, stable, syzkaller-bugs Hello, syzbot tried to test the proposed patch but the build/boot failed: failed to checkout kernel repo git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/main: failed to run ["git" "-c" "core.hooksPath=/dev/null" "fetch" "--force" "675adff2843877c2da27b36b2517f827bc9915ea" "main"]: exit status 128 Tested on: commit: [unknown git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main kernel config: https://syzkaller.appspot.com/x/.config?x=c4b098695335c89f dashboard link: https://syzkaller.appspot.com/bug?extid=521f7e7e2b974abde99a compiler: patch: https://syzkaller.appspot.com/x/patch.diff?x=115f4d0d580000 ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-22 17:26 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CAO+rqLihzHZx5kUUdR7mcC=yApCUP_20OEh7KZOQhHY5_+KLYQ@mail.gmail.com>
2026-10-22 17:26 ` [syzbot] [netfilter?] WARNING in nf_flow_table_extend_ct_timeout syzbot
2026-09-15 22:34 syzbot
2026-10-22 16:44 ` syzbot
2026-10-22 17:02 ` mixalhs
2026-10-22 17:20 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®