Re: [syzbot] [netfilter?] WARNING in nf_flow_offload_gc_step

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sat, Oct 31, 2026 at 09:51:20AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    d135ab453a74 Merge tag 'backlight-next-7.4' of git://git.k..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13a51259580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=6f2905533069b0f5
> dashboard link: https://syzkaller.appspot.com/bug?extid=e1a88d8b7e4cf6b51d85
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14020995580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=100c4f0d580000
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-d135ab45.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6c39e8158fba/vmlinux-d135ab45.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/7fb9f97c1f88/bzImage-d135ab45.xz
> 
> AI-generated root cause summary:
> In the Netfilter flowtable subsystem, nf_flow_table_extend_ct_timeout() only
> accounts for IPPROTO_UDP and IPPROTO_TCP when refreshing conntrack timeouts
> during garbage collection. However, both tc act_ct and nftables flow offload
> support offloading IPPROTO_GRE connections to the flowtable. When the garbage
> collector checks an offloaded GRE connection whose timeout has dropped below
> min_timeout, the missing case in nf_flow_table_extend_ct_timeout() triggers the
> default: WARN_ON_ONCE(1) branch. In a production kernel without panic_on_warn,
> the warning does not crash the system and no memory corruption occurs.
> 
> full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=e1a88d8b7e4cf6b51d85

There is a patch already for this, it will come in the next nf.git PR.

> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+e1a88d8b7e4cf6b51d85@syzkaller.appspotmail.com
> 
> ------------[ cut here ]------------
> 1
> WARNING: net/netfilter/nf_flow_table_core.c:553 at nf_flow_table_extend_ct_timeout net/netfilter/nf_flow_table_core.c:553 [inline], CPU#2: kworker/2:2/1358
> WARNING: net/netfilter/nf_flow_table_core.c:553 at nf_flow_offload_gc_step+0xd84/0xf60 net/netfilter/nf_flow_table_core.c:593, CPU#2: kworker/2:2/1358
> Modules linked in:
> CPU: 2 UID: 0 PID: 1358 Comm: kworker/2:2 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> Workqueue: events_power_efficient nf_flow_offload_work_gc
> RIP: 0010:nf_flow_table_extend_ct_timeout net/netfilter/nf_flow_table_core.c:553 [inline]
> RIP: 0010:nf_flow_offload_gc_step+0xd84/0xf60 net/netfilter/nf_flow_table_core.c:593
> Code: f8 e9 82 fd ff ff 4c 89 f7 e8 28 e1 6a f8 e9 12 fc ff ff 48 c7 c7 80 f2 c0 8f e8 17 e1 6a f8 e9 ae fc ff ff e8 1d cb f1 f7 90 <0f> 0b 90 41 be 01 00 00 00 e9 7d fc ff ff e8 09 cb f1 f7 48 8b 04
> RSP: 0018:ffffc9000618fa88 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: ffff88803e161380 RCX: 0000000000000000
> RDX: ffff88802c392580 RSI: ffffffff8a1c51f3 RDI: ffff88802c392580
> RBP: ffff88803e161488 R08: 0000000000000001 R09: 0000000000000011
> R10: 000000000000002f R11: 0000000000000000 R12: 1ffff92000c31f56
> R13: ffff88803818f868 R14: 000000000000002f R15: ffffffff8fc0f280
> FS:  0000000000000000(0000) GS:ffff8880d469c000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000200000012000 CR3: 000000002f277000 CR4: 0000000000352ef0
> Call Trace:
>  <TASK>
>  nf_flow_table_iterate net/netfilter/nf_flow_table_core.c:459 [inline]
>  nf_flow_table_gc_run net/netfilter/nf_flow_table_core.c:616 [inline]
>  nf_flow_offload_work_gc+0x11e/0x1e0 net/netfilter/nf_flow_table_core.c:624
>  process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
>  process_scheduled_works kernel/workqueue.c:3578 [inline]
>  worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
>  kthread+0x373/0x450 kernel/kthread.c:436
>  ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> 
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
> 
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
> 
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
> 
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
> 
> If you want to undo deduplication, reply with:
> #syz undup
>