* Re: [syzbot] [netfilter?] WARNING in nf_flow_table_extend_ct_timeout
2026-10-22 16:44 ` [syzbot] [netfilter?] WARNING in nf_flow_table_extend_ct_timeout syzbot
@ 2026-10-22 17:02 ` mixalhs
2026-10-22 17:20 ` syzbot
0 siblings, 1 reply; 3+ messages in thread
From: mixalhs @ 2026-10-22 17:02 UTC (permalink / raw)
To: syzbot
Cc: coreteam, davem, edumazet, edumazet, fw, horms, kuba,
linux-kernel, netdev, netfilter-devel, pabeni, pablo, phil,
stable, syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 3531 bytes --]
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main
On Thu, Oct 22, 2026 at 6:44 PM syzbot
<syzbot+521f7e7e2b974abde99a@syzkaller.appspotmail.com> wrote:
>
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: abeacca61eea Merge branch 'net-mlx5-hws-fix-modify-header-..
> git tree: net
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=111f4d0d580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c4b098695335c89f
> dashboard link: https://syzkaller.appspot.com/bug?extid=521f7e7e2b974abde99a
> compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1491e029580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=157d410d580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/22930d0e9391/disk-abeacca6.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/d2e18d51f288/vmlinux-abeacca6.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/69879bb16225/bzImage-abeacca6.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+521f7e7e2b974abde99a@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> 1
> WARNING: net/netfilter/nf_flow_table_core.c:553 at nf_flow_table_extend_ct_timeout+0x1ee/0x2f0 net/netfilter/nf_flow_table_core.c:553, CPU#1: kworker/1:2/123
> Modules linked in:
> CPU: 1 UID: 0 PID: 123 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
> Workqueue: events_power_efficient nf_flow_offload_work_gc
> RIP: 0010:nf_flow_table_extend_ct_timeout+0x1ee/0x2f0 net/netfilter/nf_flow_table_core.c:553
> Code: 00 00 00 41 83 ff 06 0f 84 9a 00 00 00 41 83 ff 05 0f 85 b0 00 00 00 e8 e0 10 a9 f7 41 bf 30 75 00 00 eb 0f e8 d3 10 a9 f7 90 <0f> 0b 90 41 bf 01 00 00 00 48 c7 c0 80 f2 a0 8f 48 c1 e8 03 42 80
> RSP: 0018:ffffc90002dcf930 EFLAGS: 00010293
> RAX: ffffffff8a1effad RBX: ffff888027a52900 RCX: ffff88801ffa1f40
> RDX: 0000000000000000 RSI: ffffffff912fa640 RDI: 000000000000002f
> RBP: 0000000000000737 R08: ffff88801ffa1f40 R09: 0000000000000002
> R10: 0000000000000011 R11: 0000000000000000 R12: dffffc0000000000
> R13: 1ffff11004f4a538 R14: ffff888027a52948 R15: 000000000000002f
> FS: 0000000000000000(0000) GS:ffff888123bbd000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f926bd5bd3c CR3: 000000000fb48000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> nf_flow_offload_gc_step+0x5aa/0x840 net/netfilter/nf_flow_table_core.c:593
> nf_flow_table_iterate+0x13c/0x1f0 net/netfilter/nf_flow_table_core.c:459
> nf_flow_table_gc_run net/netfilter/nf_flow_table_core.c:616 [inline]
> nf_flow_offload_work_gc+0x22/0x70 net/netfilter/nf_flow_table_core.c:624
> process_one_work kernel/workqueue.c:3396 [inline]
> process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
> worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
> kthread+0x38b/0x480 kernel/kthread.c:436
> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
[-- Attachment #2: 0001-netfilter-flowtable-extend-ct-timeout-of-offloaded-G.patch --]
[-- Type: application/octet-stream, Size: 3049 bytes --]
From: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Subject: [PATCH nf] netfilter: flowtable: extend ct timeout of offloaded GRE flows
Since commit 03428ca5cee9 ("netfilter: conntrack: rework offload nf_conn
timeout extension logic"), the flowtable gc worker extends the timeout
of an offloaded conntrack entry from nf_flow_table_extend_ct_timeout()
once it falls below 5 minutes. That function only knows about TCP and
UDP and hits WARN_ON_ONCE() for any other layer 4 protocol. However,
GRE flows can be offloaded too, both via nft_flow_offload and act_ct,
since commit 4e8d9584d154 ("netfilter: flowtable: Support GRE").
The timeout of an offloaded GRE entry drops below that threshold as soon
as a packet of the flow still goes through conntrack. With ip6gre
tunnels using the default encapsulation limit this is ordinary traffic:
the flowtable does not parse the Destination Options header in front of
GRE, so every packet of the flow takes the classic forwarding path. It
also happens for a packet with ttl <= 1, which the flowtable fast path
passes up to the classic forwarding path. nf_conntrack_gre_packet() then
refreshes ct->timeout to the GRE stream timeout (180 seconds by default),
and the next gc run triggers, as reported by syzbot:
WARNING: net/netfilter/nf_flow_table_core.c:553 at nf_flow_table_extend_ct_timeout+0x1ee/0x2f0
Workqueue: events_power_efficient nf_flow_offload_work_gc
Call Trace:
nf_flow_offload_gc_step+0x545/0x7b0
nf_flow_table_iterate+0x13c/0x1f0
nf_flow_offload_work_gc+0x22/0x70
process_scheduled_works+0xc3d/0x1630
worker_thread+0xa47/0xfb0
kthread+0x38b/0x480
Besides the splat, which panics the machine with panic_on_warn, the
default branch sets the new timeout to 1 jiffy, so the conntrack entry
expires right away and the offloaded flow is torn down.
Handle GRE like UDP and extend the timeout to NF_CT_DAY. GRE conntrack
has no protocol state to take into account, and NF_CT_DAY is also what
flow_offload_add() already sets for every offloaded entry, GRE included.
This also restores the behaviour from before commit 03428ca5cee9, when
the conntrack gc worker extended offloaded entries of any protocol to
NF_CT_DAY.
Fixes: 03428ca5cee9 ("netfilter: conntrack: rework offload nf_conn timeout extension logic")
Reported-by: syzbot+521f7e7e2b974abde99a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=521f7e7e2b974abde99a
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
---
net/netfilter/nf_flow_table_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 36bbc7be2f..94502c97ba 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -544,6 +544,7 @@ static void nf_flow_table_extend_ct_timeout(struct nf_conn *ct)
switch (l4proto) {
case IPPROTO_UDP:
+ case IPPROTO_GRE:
new_timeout = NF_CT_DAY;
break;
case IPPROTO_TCP:
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread