netdev - Re: [PATCH] netfilter: conntrack: drop expectations before freeing templates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250820183225.2707430-1-xqjcool@gmail.com>
Date: Wed, 20 Aug 2025 11:32:25 -0700
From: Qingjie Xing <xqjcool@...il.com>
To: fw@...len.de
Cc: linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org,
	netfilter-devel@...r.kernel.org,
	xqjcool@...il.com
Subject: Re: [PATCH] netfilter: conntrack: drop expectations before freeing templates

I added a panic() in nf_ct_expect_insert(). After reproducing, the crash dump 
(via crash) shows the nf_conntrack involved is a template (used as the master), 
and the expectation insertion was triggered by a TFTP packet.

The detailed information is as follows:
---------------------------------------------------
crash> sys
      KERNEL: vmlinux  [TAINTED]
    DUMPFILE: coredump-2025-08-15-00_40-8.0.0-B3  [PARTIAL DUMP]
        CPUS: 64
        DATE: Thu Aug 14 17:40:23 PDT 2025
      UPTIME: 00:01:36
LOAD AVERAGE: 4.39, 1.37, 0.48
       TASKS: 1115
    NODENAME: MYNODE
     RELEASE: 6.1
     VERSION: #15 SMP Thu Aug 14 17:02:44 PDT 2025
     MACHINE: x86_64  (2800 Mhz)
      MEMORY: 382.7 GB
       PANIC: "Kernel panic - not syncing: [nf_ct_expect_insert:417] exp:ffff88822ed78008 master:ffff888136fcd000 ext:ffff8881087bf500 jiffies:4294761886 timeout:300 expires:4295061886"
crash> bt
PID: 8605     TASK: ffff888139140040  CPU: 4    COMMAND: "cli"
 #0 [ffffc9001762b7f8] machine_kexec at ffffffff80279d53
 #1 [ffffc9001762b878] __crash_kexec at ffffffff8038b7b7
 #2 [ffffc9001762b948] panic at ffffffff802973e0
 #3 [ffffc9001762b9c8] nf_ct_expect_related_report at ffffffff80ee7b27
 #4 [ffffc9001762ba40] tftp_help at ffffffff80f001ea
 #5 [ffffc9001762ba98] nf_confirm at ffffffff80eeaa77
 #6 [ffffc9001762bac8] ipv4_confirm at ffffffff80eeafa9
 #7 [ffffc9001762baf8] nf_hook_slow at ffffffff80ed24db
 #8 [ffffc9001762bb40] ip_output at ffffffff80fe85a5
 #9 [ffffc9001762bbc8] udp_send_skb at ffffffff81033372
#10 [ffffc9001762bc18] udp_sendmsg at ffffffff81032cb2
#11 [ffffc9001762bd90] inet_sendmsg at ffffffff810488a1
#12 [ffffc9001762bdb8] __sys_sendto at ffffffff80dcdda7
#13 [ffffc9001762bf08] __x64_sys_sendto at ffffffff80dcde46
#14 [ffffc9001762bf18] do_syscall_64 at ffffffff811eab09
#15 [ffffc9001762bf50] entry_SYSCALL_64_after_hwframe at ffffffff812000dc
    RIP: 00007fde06cdb8f3  RSP: 00007ffc80d56358  RFLAGS: 00000202
    RAX: ffffffffffffffda  RBX: 000055eb6f07fc03  RCX: 00007fde06cdb8f3
    RDX: 000000000000001d  RSI: 00007fde047666c0  RDI: 0000000000000007
    RBP: 000055eb6fc941c3   R8: 00007fde047665a0   R9: 0000000000000010
    R10: 0000000000000000  R11: 0000000000000202  R12: 0000000000000000
    R13: 000000000000000b  R14: 00007fde030f4908  R15: 0000000000000006
    ORIG_RAX: 000000000000002c  CS: 0033  SS: 002b
crash> nf_conn.status -x ffff888136fcd000     
  status = 0x808,
----------------------------------------------------