bisecting fixing commit since 13d2ce42de8cb98ff952f8de6307f896203854c2 building syzkaller on 821e0b09046a2f972ace26fbdc02aef1116792d4 testing commit 13d2ce42de8cb98ff952f8de6307f896203854c2 with gcc (GCC) 8.4.1 20210217 kernel signature: 5ecca738977c249ab3124090a7e9fd6bceb31e214cabdadedb28f3430f79be2a all runs: crashed: possible deadlock in sk_clone_lock testing current HEAD 1e986fe9ad15b8406034c504afc5ae76f0a8e852 testing commit 1e986fe9ad15b8406034c504afc5ae76f0a8e852 with gcc (GCC) 8.4.1 20210217 kernel signature: 4ba48ddb8d3dd40a4537db5f7baea36bb2d6fcbf3b98a1f8807acfe1291a78a8 all runs: crashed: possible deadlock in sk_clone_lock revisions tested: 2, total time: 26m27.970877687s (build: 18m59.050295024s, test: 6m58.283792578s) the crash still happens on HEAD commit msg: Linux 4.19.191 crash: possible deadlock in sk_clone_lock Bluetooth: hci1: command 0x0419 tx timeout IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready Bluetooth: hci2: command 0x0419 tx timeout Bluetooth: hci5: command 0x0419 tx timeout ===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected 4.19.191-syzkaller #0 Not tainted ----------------------------------------------------- syz-executor.0/9908 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire: 00000000849c6009 (hugetlb_lock){+.+.}, at: spin_lock include/linux/spinlock.h:329 [inline] 00000000849c6009 (hugetlb_lock){+.+.}, at: free_huge_page mm/hugetlb.c:1301 [inline] 00000000849c6009 (hugetlb_lock){+.+.}, at: free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1263 and this task is already holding: 0000000022588968 (slock-AF_INET){+.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] 0000000022588968 (slock-AF_INET){+.-.}, at: tcp_close+0x521/0xf00 net/ipv4/tcp.c:2434 which would create a new lock dependency: (slock-AF_INET){+.-.} -> (hugetlb_lock){+.+.} but this new dependency connects a SOFTIRQ-irq-safe lock: (slock-AF_INET){+.-.} ... which became SOFTIRQ-irq-safe at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] sk_clone_lock+0x3b3/0x1280 net/core/sock.c:1671 inet_csk_clone_lock+0x15/0x3c0 net/ipv4/inet_connection_sock.c:824 tcp_create_openreq_child+0x24/0x1a20 net/ipv4/tcp_minisocks.c:452 tcp_v4_syn_recv_sock+0xa0/0xfa0 net/ipv4/tcp_ipv4.c:1429 tcp_check_req+0x3dd/0x15e0 net/ipv4/tcp_minisocks.c:789 tcp_v4_rcv+0x1f06/0x3bb0 net/ipv4/tcp_ipv4.c:1773 ip_local_deliver_finish+0x3be/0x9a0 net/ipv4/ip_input.c:215 NF_HOOK include/linux/netfilter.h:289 [inline] ip_local_deliver+0x164/0x4b0 net/ipv4/ip_input.c:256 dst_input include/net/dst.h:461 [inline] ip_rcv_finish+0x159/0x240 net/ipv4/ip_input.c:414 NF_HOOK include/linux/netfilter.h:289 [inline] ip_rcv+0xc1/0x2f0 net/ipv4/ip_input.c:524 __netif_receive_skb_one_core+0x112/0x1a0 net/core/dev.c:4954 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5066 netif_receive_skb_internal+0xca/0x300 net/core/dev.c:5156 napi_skb_finish net/core/dev.c:5600 [inline] napi_gro_receive+0x215/0x330 net/core/dev.c:5631 receive_buf+0xaa9/0x5ac0 drivers/net/virtio_net.c:1084 virtnet_receive drivers/net/virtio_net.c:1348 [inline] virtnet_poll+0x50b/0xe40 drivers/net/virtio_net.c:1453 napi_poll net/core/dev.c:6272 [inline] net_rx_action+0x454/0xe30 net/core/dev.c:6338 __do_softirq+0x25f/0x919 kernel/softirq.c:292 run_ksoftirqd+0x5e/0x100 kernel/softirq.c:653 smpboot_thread_fn+0x55f/0x8a0 kernel/smpboot.c:164 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 to a SOFTIRQ-irq-unsafe lock: (hugetlb_lock){+.+.} ... which became SOFTIRQ-irq-unsafe at: ... lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3048 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hugetlb_lock); local_irq_disable(); lock(slock-AF_INET); lock(hugetlb_lock); lock(slock-AF_INET); *** DEADLOCK *** 3 locks held by syz-executor.0/9908: #0: 000000009d23c980 (&sb->s_type->i_mutex_key#13){+.+.}, at: inode_lock include/linux/fs.h:748 [inline] #0: 000000009d23c980 (&sb->s_type->i_mutex_key#13){+.+.}, at: __sock_release+0x7d/0x290 net/socket.c:578 #1: 000000003fe39bc4 (sk_lock-AF_INET){+.+.}, at: lock_sock include/net/sock.h:1510 [inline] #1: 000000003fe39bc4 (sk_lock-AF_INET){+.+.}, at: tcp_close+0x1f/0xf00 net/ipv4/tcp.c:2344 #2: 0000000022588968 (slock-AF_INET){+.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] #2: 0000000022588968 (slock-AF_INET){+.-.}, at: tcp_close+0x521/0xf00 net/ipv4/tcp.c:2434 the dependencies between SOFTIRQ-irq-safe lock and the holding lock: -> (slock-AF_INET){+.-.} ops: 13471 { HARDIRQ-ON-W at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:334 [inline] lock_sock_nested+0x3a/0x100 net/core/sock.c:2864 lock_sock include/net/sock.h:1510 [inline] inet_autobind+0x13/0x160 net/ipv4/af_inet.c:179 inet_dgram_connect+0x1db/0x270 net/ipv4/af_inet.c:569 __sys_connect+0x20d/0x2d0 net/socket.c:1663 __do_sys_connect net/socket.c:1674 [inline] __se_sys_connect net/socket.c:1671 [inline] __x64_sys_connect+0x6e/0xb0 net/socket.c:1671 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe IN-SOFTIRQ-W at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] sk_clone_lock+0x3b3/0x1280 net/core/sock.c:1671 inet_csk_clone_lock+0x15/0x3c0 net/ipv4/inet_connection_sock.c:824 tcp_create_openreq_child+0x24/0x1a20 net/ipv4/tcp_minisocks.c:452 tcp_v4_syn_recv_sock+0xa0/0xfa0 net/ipv4/tcp_ipv4.c:1429 tcp_check_req+0x3dd/0x15e0 net/ipv4/tcp_minisocks.c:789 tcp_v4_rcv+0x1f06/0x3bb0 net/ipv4/tcp_ipv4.c:1773 ip_local_deliver_finish+0x3be/0x9a0 net/ipv4/ip_input.c:215 NF_HOOK include/linux/netfilter.h:289 [inline] ip_local_deliver+0x164/0x4b0 net/ipv4/ip_input.c:256 dst_input include/net/dst.h:461 [inline] ip_rcv_finish+0x159/0x240 net/ipv4/ip_input.c:414 NF_HOOK include/linux/netfilter.h:289 [inline] ip_rcv+0xc1/0x2f0 net/ipv4/ip_input.c:524 __netif_receive_skb_one_core+0x112/0x1a0 net/core/dev.c:4954 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5066 netif_receive_skb_internal+0xca/0x300 net/core/dev.c:5156 napi_skb_finish net/core/dev.c:5600 [inline] napi_gro_receive+0x215/0x330 net/core/dev.c:5631 receive_buf+0xaa9/0x5ac0 drivers/net/virtio_net.c:1084 virtnet_receive drivers/net/virtio_net.c:1348 [inline] virtnet_poll+0x50b/0xe40 drivers/net/virtio_net.c:1453 napi_poll net/core/dev.c:6272 [inline] net_rx_action+0x454/0xe30 net/core/dev.c:6338 __do_softirq+0x25f/0x919 kernel/softirq.c:292 run_ksoftirqd+0x5e/0x100 kernel/softirq.c:653 smpboot_thread_fn+0x55f/0x8a0 kernel/smpboot.c:164 kthread+0x347/0x410 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 INITIAL USE at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline] _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168 spin_lock_bh include/linux/spinlock.h:334 [inline] lock_sock_nested+0x3a/0x100 net/core/sock.c:2864 lock_sock include/net/sock.h:1510 [inline] inet_autobind+0x13/0x160 net/ipv4/af_inet.c:179 inet_dgram_connect+0x1db/0x270 net/ipv4/af_inet.c:569 __sys_connect+0x20d/0x2d0 net/socket.c:1663 __do_sys_connect net/socket.c:1674 [inline] __se_sys_connect net/socket.c:1671 [inline] __x64_sys_connect+0x6e/0xb0 net/socket.c:1671 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe } ... key at: [] af_family_slock_keys+0x10/0x1a0 ... acquired at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] free_huge_page mm/hugetlb.c:1301 [inline] free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1263 __put_compound_page+0x65/0xa0 mm/swap.c:96 __put_page+0x5d/0x290 mm/swap.c:112 put_page include/linux/mm.h:963 [inline] __skb_frag_unref include/linux/skbuff.h:2833 [inline] skb_release_data+0x249/0x760 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1466 [inline] tcp_write_queue_purge+0x243/0x7b0 net/ipv4/tcp.c:2543 tcp_v4_destroy_sock+0xa1/0x630 net/ipv4/tcp_ipv4.c:1989 inet_csk_destroy_sock+0x11a/0x390 net/ipv4/inet_connection_sock.c:875 tcp_close+0x821/0xf00 net/ipv4/tcp.c:2498 inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 get_signal+0x1352/0x1970 kernel/signal.c:2400 do_signal+0x87/0x1870 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x159/0x1e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: -> (hugetlb_lock){+.+.} ops: 140 { HARDIRQ-ON-W at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3048 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe SOFTIRQ-ON-W at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3048 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe INITIAL USE at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] hugetlb_overcommit_handler+0x27f/0x510 mm/hugetlb.c:3048 proc_sys_call_handler.isra.20+0x16a/0x200 fs/proc/proc_sysctl.c:597 proc_sys_write+0x37/0x60 fs/proc/proc_sysctl.c:615 __vfs_write+0xe3/0x890 fs/read_write.c:485 vfs_write+0x150/0x4d0 fs/read_write.c:549 ksys_write+0x103/0x260 fs/read_write.c:599 __do_sys_write fs/read_write.c:611 [inline] __se_sys_write fs/read_write.c:608 [inline] __x64_sys_write+0x6e/0xb0 fs/read_write.c:608 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe } ... key at: [] hugetlb_lock+0x18/0x1780 ... acquired at: lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] free_huge_page mm/hugetlb.c:1301 [inline] free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1263 __put_compound_page+0x65/0xa0 mm/swap.c:96 __put_page+0x5d/0x290 mm/swap.c:112 put_page include/linux/mm.h:963 [inline] __skb_frag_unref include/linux/skbuff.h:2833 [inline] skb_release_data+0x249/0x760 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1466 [inline] tcp_write_queue_purge+0x243/0x7b0 net/ipv4/tcp.c:2543 tcp_v4_destroy_sock+0xa1/0x630 net/ipv4/tcp_ipv4.c:1989 inet_csk_destroy_sock+0x11a/0x390 net/ipv4/inet_connection_sock.c:875 tcp_close+0x821/0xf00 net/ipv4/tcp.c:2498 inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 get_signal+0x1352/0x1970 kernel/signal.c:2400 do_signal+0x87/0x1870 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x159/0x1e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe stack backtrace: CPU: 0 PID: 9908 Comm: syz-executor.0 Not tainted 4.19.191-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 print_bad_irq_dependency kernel/locking/lockdep.c:1573 [inline] check_usage.cold.37+0x89b/0xccc kernel/locking/lockdep.c:1605 check_irq_usage kernel/locking/lockdep.c:1661 [inline] check_prev_add_irq kernel/locking/lockdep_states.h:8 [inline] check_prev_add kernel/locking/lockdep.c:1871 [inline] check_prevs_add kernel/locking/lockdep.c:1979 [inline] validate_chain kernel/locking/lockdep.c:2420 [inline] __lock_acquire+0x21de/0x47c0 kernel/locking/lockdep.c:3416 lock_acquire+0x180/0x3a0 kernel/locking/lockdep.c:3908 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] free_huge_page mm/hugetlb.c:1301 [inline] free_huge_page+0x6b6/0xb10 mm/hugetlb.c:1263 __put_compound_page+0x65/0xa0 mm/swap.c:96 __put_page+0x5d/0x290 mm/swap.c:112 put_page include/linux/mm.h:963 [inline] __skb_frag_unref include/linux/skbuff.h:2833 [inline] skb_release_data+0x249/0x760 net/core/skbuff.c:577 skb_release_all+0x3d/0x50 net/core/skbuff.c:640 __kfree_skb+0xd/0x20 net/core/skbuff.c:654 sk_wmem_free_skb include/net/sock.h:1466 [inline] tcp_write_queue_purge+0x243/0x7b0 net/ipv4/tcp.c:2543 tcp_v4_destroy_sock+0xa1/0x630 net/ipv4/tcp_ipv4.c:1989 inet_csk_destroy_sock+0x11a/0x390 net/ipv4/inet_connection_sock.c:875 tcp_close+0x821/0xf00 net/ipv4/tcp.c:2498 inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 get_signal+0x1352/0x1970 kernel/signal.c:2400 do_signal+0x87/0x1870 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x159/0x1e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x465af9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff171522188 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: 0000000000230000 RBX: 000000000056c008 RCX: 0000000000465af9 RDX: ffffffffffffffd0 RSI: 0000000020000140 RDI: 0000000000000004 RBP: 00000000004b0682 R08: 0000000000000000 R09: ffffffffffffff36 R10: 000000000401c005 R11: 0000000000000246 R12: 000000000056c008 R13: 00007fff9c28efef R14: 00007ff171522300 R15: 0000000000022000 nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.