From: Qingjie Xing <xqjcool@gmail.com>
To: fw@strlen.de
Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
netfilter-devel@vger.kernel.org, xqjcool@gmail.com
Subject: Re: [PATCH] netfilter: conntrack: drop expectations before freeing templates
Date: Wed, 20 Aug 2025 11:32:25 -0700 [thread overview]
Message-ID: <20250820183225.2707430-1-xqjcool@gmail.com> (raw)
In-Reply-To: <aKUVqxJVrGgRJZA4@strlen.de>
I added a panic() in nf_ct_expect_insert(). After reproducing, the crash dump
(via crash) shows the nf_conntrack involved is a template (used as the master),
and the expectation insertion was triggered by a TFTP packet.
The detailed information is as follows:
---------------------------------------------------
crash> sys
KERNEL: vmlinux [TAINTED]
DUMPFILE: coredump-2025-08-15-00_40-8.0.0-B3 [PARTIAL DUMP]
CPUS: 64
DATE: Thu Aug 14 17:40:23 PDT 2025
UPTIME: 00:01:36
LOAD AVERAGE: 4.39, 1.37, 0.48
TASKS: 1115
NODENAME: MYNODE
RELEASE: 6.1
VERSION: #15 SMP Thu Aug 14 17:02:44 PDT 2025
MACHINE: x86_64 (2800 Mhz)
MEMORY: 382.7 GB
PANIC: "Kernel panic - not syncing: [nf_ct_expect_insert:417] exp:ffff88822ed78008 master:ffff888136fcd000 ext:ffff8881087bf500 jiffies:4294761886 timeout:300 expires:4295061886"
crash> bt
PID: 8605 TASK: ffff888139140040 CPU: 4 COMMAND: "cli"
#0 [ffffc9001762b7f8] machine_kexec at ffffffff80279d53
#1 [ffffc9001762b878] __crash_kexec at ffffffff8038b7b7
#2 [ffffc9001762b948] panic at ffffffff802973e0
#3 [ffffc9001762b9c8] nf_ct_expect_related_report at ffffffff80ee7b27
#4 [ffffc9001762ba40] tftp_help at ffffffff80f001ea
#5 [ffffc9001762ba98] nf_confirm at ffffffff80eeaa77
#6 [ffffc9001762bac8] ipv4_confirm at ffffffff80eeafa9
#7 [ffffc9001762baf8] nf_hook_slow at ffffffff80ed24db
#8 [ffffc9001762bb40] ip_output at ffffffff80fe85a5
#9 [ffffc9001762bbc8] udp_send_skb at ffffffff81033372
#10 [ffffc9001762bc18] udp_sendmsg at ffffffff81032cb2
#11 [ffffc9001762bd90] inet_sendmsg at ffffffff810488a1
#12 [ffffc9001762bdb8] __sys_sendto at ffffffff80dcdda7
#13 [ffffc9001762bf08] __x64_sys_sendto at ffffffff80dcde46
#14 [ffffc9001762bf18] do_syscall_64 at ffffffff811eab09
#15 [ffffc9001762bf50] entry_SYSCALL_64_after_hwframe at ffffffff812000dc
RIP: 00007fde06cdb8f3 RSP: 00007ffc80d56358 RFLAGS: 00000202
RAX: ffffffffffffffda RBX: 000055eb6f07fc03 RCX: 00007fde06cdb8f3
RDX: 000000000000001d RSI: 00007fde047666c0 RDI: 0000000000000007
RBP: 000055eb6fc941c3 R8: 00007fde047665a0 R9: 0000000000000010
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 000000000000000b R14: 00007fde030f4908 R15: 0000000000000006
ORIG_RAX: 000000000000002c CS: 0033 SS: 002b
crash> nf_conn.status -x ffff888136fcd000
status = 0x808,
----------------------------------------------------
next prev parent reply other threads:[~2025-08-20 18:32 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-19 18:17 [PATCH] netfilter: conntrack: drop expectations before freeing templates Qingjie Xing
2025-08-19 18:27 ` Florian Westphal
2025-08-19 23:24 ` Qingjie Xing
2025-08-20 0:17 ` Florian Westphal
2025-08-20 0:24 ` Florian Westphal
2025-08-20 18:32 ` Qingjie Xing [this message]
2025-08-21 7:18 ` Florian Westphal
2025-08-22 1:17 ` Qingjie Xing
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250820183225.2707430-1-xqjcool@gmail.com \
--to=xqjcool@gmail.com \
--cc=fw@strlen.de \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox