BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del

Status: upstream: reported C repro on 2026/09/14 04:27
Reported-by: syzbot+5693d18d0aa1d0f50891@syzkaller.appspotmail.com
First crash: 8d21h, last: 5d02h

Sample crash report:
BUG: using __this_cpu_add() in preemptible [00000000] code: kworker/u4:4/1456
caller is flow_offload_queue_work net/netfilter/nf_flow_table_offload.c:-1 [inline]
caller is nf_flow_offload_del+0xba/0x190 net/netfilter/nf_flow_table_offload.c:1108
CPU: 1 PID: 1456 Comm: kworker/u4:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: act_ct_workqueue tcf_ct_flow_table_cleanup_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 check_preemption_disabled+0x104/0x110 lib/smp_processor_id.c:49
 flow_offload_queue_work net/netfilter/nf_flow_table_offload.c:-1 [inline]
 nf_flow_offload_del+0xba/0x190 net/netfilter/nf_flow_table_offload.c:1108
 nf_flow_table_iterate+0x132/0x1e0 net/netfilter/nf_flow_table_core.c:404
 nf_flow_table_gc_run net/netfilter/nf_flow_table_core.c:435 [inline]
 nf_flow_table_free+0x12f/0x150 net/netfilter/nf_flow_table_core.c:604
 tcf_ct_flow_table_cleanup_work+0x29/0x1d0 net/sched/act_ct.c:344
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/14 05:34 linux-5.15.y 0996e0926f6b 70a60e12 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 23:01 linux-5.15.y 0248c33e835e 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:41 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:40 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:40 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:39 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:38 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:38 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:37 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:35 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:35 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/17 12:35 linux-5.15.y 0248c33e835e 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/15 06:16 linux-5.15.y 0248c33e835e 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/15 04:29 linux-5.15.y 0248c33e835e 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/14 20:12 linux-5.15.y 0248c33e835e 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/14 04:29 linux-5.15.y 0996e0926f6b 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
2026/09/14 04:27 linux-5.15.y 0996e0926f6b 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: using __this_cpu_add() in preemptible code in nf_flow_offload_del
* Struck through repros no longer work on HEAD.