From: Florian Westphal <fw@strlen.de>
To: syzbot ci <syzbot+ci135094d4d47126eb@syzkaller.appspotmail.com>
Cc: netfilter-devel@vger.kernel.org, syzbot@lists.linux.dev,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot ci] Re: netfilter: nf_tables: avoid chain re-validation if possible
Date: Sat, 13 Dec 2025 23:37:28 +0100 [thread overview]
Message-ID: <aT3qqBIme8LO6VqB@strlen.de> (raw)
In-Reply-To: <693b5756.050a0220.1ff09b.0012.GAE@google.com>
syzbot ci <syzbot+ci135094d4d47126eb@syzkaller.appspotmail.com> wrote:
------------[ cut here ]------------
> WARNING: net/netfilter/nf_tables_api.c:4112 at nft_chain_vstate_update net/netfilter/nf_tables_api.c:4112 [inline], CPU#1: syz.0.17/5982
> WARNING: net/netfilter/nf_tables_api.c:4112 at nft_chain_validate+0x6b0/0x8c0 net/netfilter/nf_tables_api.c:4176, CPU#1: syz.0.17/5982
> Modules linked in:
> CPU: 1 UID: 0 PID: 5982 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> RIP: 0010:nft_chain_vstate_update net/netfilter/nf_tables_api.c:4112 [inline]
> RIP: 0010:nft_chain_validate+0x6b0/0x8c0 net/netfilter/nf_tables_api.c:4176
> Code: 31 db 89 d8 48 83 c4 50 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 2d 32 42 f8 bb fc ff ff ff eb de e8 21 32 42 f8 90 <0f> 0b 90 49 83 c5 78 ba 04 00 00 00 4c 89 ef 31 f6 e8 ea 18 a8 f8
> RSP: 0018:ffffc90003df6fe0 EFLAGS: 00010293
> RAX: ffffffff897f183f RBX: 0000000000000000 RCX: ffff888102f93a80
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: 0000000000000040 R08: ffff888102f93a80 R09: 0000000000000002
> R10: 0000000000000010 R11: 0000000000000000 R12: ffff88816a79c510
> R13: ffff88816a79c500 R14: ffff88816a79c500 R15: dffffc0000000000
> FS: 000055555e417500(0000) GS:ffff8882a9eb1000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000200000005000 CR3: 000000017531c000 CR4: 00000000000006f0
> Call Trace:
> <TASK>
> nft_validate_register_store+0xf6/0x1d0 net/netfilter/nf_tables_api.c:11750
> nft_parse_register_store+0x225/0x2c0 net/netfilter/nf_tables_api.c:11787
> nft_immediate_init+0x1cf/0x390 net/netfilter/nft_immediate.c:67
> nf_tables_newexpr net/netfilter/nf_tables_api.c:3550 [inline]
> nf_tables_newrule+0x1794/0x28a0 net/netfilter/nf_tables_api.c:4419
Righ, this patch depends on the already pending patch
"netfilter: nf_tables: remove redundant chain validation on register store",
which removes the only case where the function is called with ctx->chain
not set to a base chain.
prev parent reply other threads:[~2025-12-13 22:37 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-11 12:30 [PATCH nf v3] netfilter: nf_tables: avoid chain re-validation if possible Florian Westphal
2025-12-11 23:44 ` [syzbot ci] " syzbot ci
2025-12-13 22:37 ` Florian Westphal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aT3qqBIme8LO6VqB@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=syzbot+ci135094d4d47126eb@syzkaller.appspotmail.com \
--cc=syzbot@lists.linux.dev \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.