When running the nftables autopkgtest from sid on a trixie machine in an
incus-lxc container, I get this:
------------[ cut here ]------------
memcpy: detected field-spanning write (size 28) of single field "_Generic(info, const struct ip_tunnel_info * : ((const void *)((info) + 1)), struct ip_tunnel_info * : ((void *)((info) + 1)) )" at include/net/ip_tunnels.h:700 (size 0)
WARNING: CPU: 2 PID: 5917 at include/net/ip_tunnels.h:700 nft_tunnel_obj_init+0x5ac/0x6a8 [nft_tunnel]
Modules linked in: nft_tunnel nft_synproxy nf_synproxy_core nft_quota nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_osf nfnetlink_osf nft_nat nft_meta_bridge nfnetlink_hook nft_xfrm nf_flow_table_inet nf_flow_table dummy nft_socket nf_socket_ipv4 nf_socket_ipv6 nft_ct veth nft_masq nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 bridge stp llc nf_tables libcrc32c binfmt_misc nls_ascii nls_cp437 vfat fat aes_ce_blk aes_ce_cipher crct10dif_ce polyval_ce polyval_generic ghash_ce gf128mul sha2_ce virtio_balloon sha256_arm64 sha1_ce arm_smccc_trng evdev nvme_fabrics loop dm_mod efi_pstore configfs nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vsock efivarfs qemu_fw_cfg virtio_rng ip_tables x_tables autofs4 virtio_net net_failover virtio_blk failover virtio_mmio
CPU: 2 UID: 1000000 PID: 5917 Comm: nft Not tainted 6.12.107+deb13-cloud-arm64 #1  Debian 6.12.107-1
Hardware name: QEMU KVM Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : nft_tunnel_obj_init+0x5ac/0x6a8 [nft_tunnel]
lr : nft_tunnel_obj_init+0x5ac/0x6a8 [nft_tunnel]
sp : ffff800080ceb3d0
x29: ffff800080ceb470 x28: 000000008d7250d8 x27: ffff800080ceb628
x26: 0000000000000005 x25: 0000000000000006 x24: ffff0002775b5e88
x23: ffff0002775b4490 x22: ffff0002775b4400 x21: ffff0002775b5e00
x20: ffff800080ceb408 x19: ffff0002775b44f0 x18: ffffffffffffffff
x17: 0000000000000000 x16: ffffa39bc4947008 x15: 2b20296f666e6928
x14: 28292a2064696f76 x13: 74656e2f6564756c x12: ffffa39bc63f1d18
x11: ffffa39bc6399d70 x10: ffffa39bc63f1d70 x9 : ffffa39bc49e1608
x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : c0000000ffffefff
x5 : ffff0003fd8183c8 x4 : 0000000000000000 x3 : ffff5c6837569000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c583b780
Call trace:
 nft_tunnel_obj_init+0x5ac/0x6a8 [nft_tunnel]
 nft_obj_init+0xcc/0x170 [nf_tables]
 nf_tables_newobj+0x2c4/0x4a0 [nf_tables]
 nfnetlink_rcv_batch+0x698/0x960 [nfnetlink]
 nfnetlink_rcv+0x16c/0x1b0 [nfnetlink]
 netlink_unicast+0x304/0x380
 netlink_sendmsg+0x1ac/0x410
 __sock_sendmsg+0x64/0xc0
 ____sys_sendmsg+0x270/0x308
 ___sys_sendmsg+0xb8/0x118
 __sys_sendmsg+0xa4/0x110
 __arm64_sys_sendmsg+0x2c/0x40
 invoke_syscall+0x60/0xe0
 el0_svc_common.constprop.0+0xc8/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x38/0x148
 el0t_64_sync_handler+0xc8/0xe0
 el0t_64_sync+0x190/0x198
---[ end trace 0000000000000000 ]---

Shortly thereafter, the machine becomes unresponsive.

Helmut

Control: tags -1 moreinfo

This should be fixed with bb5e62f2d547c4de6d1b144cbce2373a76c33f18
(in 6.15).  Could you please verify that?

Bastian

Hi Bastian,

I cannot easily verify that and I didn't manage to reproduce it outside
our production environment yet.

In any case, that commit looks very plausible. It also tells me that the
kernel output likely is a red herring. The warning should not be causing
a kernel hang - especially when the kernel manages to persist that
output to the system journal on disk. The nftables autopkgtest likely
does more things and might be crashing the kernel via other means.

Given that we also run the tests on amd64, this likely requires an arm64
kvm environment for reproducing.

Unless there is more information at a later point, I suggest that you
close this report whenever the mentioned commit is included.

Helmut

Control: tags -1 - moreinfo

I tried reproducing the problem on a sid kernel and ran all nftables
autopkgtests there via qemu-tcg. The system was fine afterwards.
Unfortunately, I did not collect dmesg.

I tried reproducing the problem on the reported kernel with a sid
userland and ran all nftables tests there via qemu-tcg. During
internaltest-shell.sh, a very similar blurb is emitted from the kernel
quit soon after starting the tests. At some point during the test, the
kernel halts:

[ 1401.511740] Insufficient stack space to handle exception!
[ 1401.511899] ESR: 0x0000000096000047 -- DABT (current EL)
[ 1401.511952] FAR: 0xffff800080037fd3
[ 1401.511975] Task stack:     [0xffff800084710000..0xffff800084714000]
[ 1401.511992] IRQ stack:      [0xffff800080038000..0xffff80008003c000]
[ 1401.512009] Overflow stack: [0xfff000003f8ff320..0xfff000003f900320]
[ 1401.512289] CPU: 7 UID: 0 PID: 62267 Comm: ping Tainted: G        W          6.12.107+deb13-arm64 #1  Debian 6.12.107-1
[ 1401.512385] Tainted: [W]=WARN
[ 1401.512401] Hardware name: QEMU QEMU Virtual Machine, BIOS 2026.05-2 08/06/2026
[ 1401.512419] pstate: 61402005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 1401.512452] pc : __dev_queue_xmit+0x40/0xe68
[ 1401.512507] lr : neigh_resolve_output+0xfc/0x218
[ 1401.512530] sp : ffff800080037fc0
[ 1401.512542] x29: ffff800080038080 x28: ffffadc10faad758 x27: ffff8000800381c8
[ 1401.512600] x26: fff000003552fbc0 x25: ffffadc10faad6d8 x24: 0000000000000000
[ 1401.512643] x23: ffffadc1281ecc50 x22: 0000000000000000 x21: fff000000402c700
[ 1401.512693] x20: fff00000259fb800 x19: fff000000402c700 x18: fff00000345cad90
[ 1401.512733] x17: fff0523f17b2e000 x16: ffffadc126b20c28 x15: 0000000000000014
[ 1401.512773] x14: 0000000000000000 x13: 0000000000000000 x12: 00000000000005c8
[ 1401.512820] x11: 0000000000000000 x10: ffffadc1270c7000 x9 : ffffadc126b1eacc
[ 1401.513084] x8 : 000000000103000a x7 : 0000000000000005 x6 : fff00000356d9340
[ 1401.513136] x5 : 0000000000000062 x4 : 0000000000000000 x3 : 0000000000000000
[ 1401.513249] x2 : 00000000fffffff4 x1 : 0000000000000000 x0 : fff000000402c700
[ 1401.513933] Kernel panic - not syncing: kernel stack overflow
[ 1401.514144] CPU: 7 UID: 0 PID: 62267 Comm: ping Tainted: G        W          6.12.107+deb13-arm64 #1  Debian 6.12.107-1
[ 1401.514301] Tainted: [W]=WARN
[ 1401.514317] Hardware name: QEMU QEMU Virtual Machine, BIOS 2026.05-2 08/06/2026
[ 1401.514449] Call trace:
[ 1401.514582]  dump_backtrace+0xd8/0x130
[ 1401.514685]  show_stack+0x20/0x38
[ 1401.514711]  dump_stack_lvl+0x60/0x80
[ 1401.514743]  dump_stack+0x18/0x28
[ 1401.514791]  panic+0x164/0x378
[ 1401.514873]  nmi_panic+0x90/0x98
[ 1401.514941]  panic_bad_stack+0xec/0x100
[ 1401.515196]  handle_bad_stack+0x34/0x40
[ 1401.515281]  __bad_stack+0x78/0x80
[ 1401.515377]  __dev_queue_xmit+0x40/0xe68
[ 1401.515477]  neigh_resolve_output+0xfc/0x218
[ 1401.515537]  neigh_xmit+0xc0/0x230
[ 1401.515561]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.515613]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.515819]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.516059]  nf_hook_slow+0x50/0x140
[ 1401.516096]  __dev_queue_xmit+0x39c/0xe68
[ 1401.516125]  neigh_resolve_output+0xfc/0x218
[ 1401.516150]  neigh_xmit+0xc0/0x230
[ 1401.516177]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.516211]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.516307]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.516407]  nf_hook_slow+0x50/0x140
[ 1401.516432]  __dev_queue_xmit+0x39c/0xe68
[ 1401.516456]  neigh_resolve_output+0xfc/0x218
[ 1401.516483]  neigh_xmit+0xc0/0x230
[ 1401.516507]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.516573]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.516974]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.517130]  nf_hook_slow+0x50/0x140
[ 1401.517160]  __dev_queue_xmit+0x39c/0xe68
[ 1401.517185]  neigh_resolve_output+0xfc/0x218
[ 1401.517280]  neigh_xmit+0xc0/0x230
[ 1401.517307]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.517336]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.517435]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.517529]  nf_hook_slow+0x50/0x140
[ 1401.517555]  __dev_queue_xmit+0x39c/0xe68
[ 1401.517580]  neigh_resolve_output+0xfc/0x218
[ 1401.517798]  neigh_xmit+0xc0/0x230
[ 1401.517984]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.518046]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.518197]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.518347]  nf_hook_slow+0x50/0x140
[ 1401.518461]  __dev_queue_xmit+0x39c/0xe68
[ 1401.518509]  neigh_resolve_output+0xfc/0x218
[ 1401.518581]  neigh_xmit+0xc0/0x230
[ 1401.518629]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.518687]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.519055]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.519247]  nf_hook_slow+0x50/0x140
[ 1401.519336]  __dev_queue_xmit+0x39c/0xe68
[ 1401.519362]  neigh_resolve_output+0xfc/0x218
[ 1401.519429]  neigh_xmit+0xc0/0x230
[ 1401.519527]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.519606]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.520056]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.520295]  nf_hook_slow+0x50/0x140
[ 1401.520387]  __dev_queue_xmit+0x39c/0xe68
[ 1401.520422]  neigh_resolve_output+0xfc/0x218
[ 1401.520744]  neigh_xmit+0xc0/0x230
[ 1401.520775]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.520814]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.520916]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.521010]  nf_hook_slow+0x50/0x140
[ 1401.521038]  __dev_queue_xmit+0x39c/0xe68
[ 1401.521062]  neigh_resolve_output+0xfc/0x218
[ 1401.521092]  neigh_xmit+0xc0/0x230
[ 1401.521118]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.521345]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.521494]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.521584]  nf_hook_slow+0x50/0x140
[ 1401.521610]  __dev_queue_xmit+0x39c/0xe68
[ 1401.521634]  neigh_resolve_output+0xfc/0x218
[ 1401.521657]  neigh_xmit+0xc0/0x230
[ 1401.521681]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.521709]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.521871]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.522022]  nf_hook_slow+0x50/0x140
[ 1401.522050]  __dev_queue_xmit+0x39c/0xe68
[ 1401.522074]  neigh_resolve_output+0xfc/0x218
[ 1401.522097]  neigh_xmit+0xc0/0x230
[ 1401.522122]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.522203]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.522349]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.522491]  nf_hook_slow+0x50/0x140
[ 1401.522681]  __dev_queue_xmit+0x39c/0xe68
[ 1401.522711]  neigh_resolve_output+0xfc/0x218
[ 1401.522777]  neigh_xmit+0xc0/0x230
[ 1401.522803]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.522841]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.523394]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.523612]  nf_hook_slow+0x50/0x140
[ 1401.523672]  __dev_queue_xmit+0x39c/0xe68
[ 1401.523773]  neigh_resolve_output+0xfc/0x218
[ 1401.523820]  neigh_xmit+0xc0/0x230
[ 1401.523873]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.523932]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.524026]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.524624]  nf_hook_slow+0x50/0x140
[ 1401.524888]  __dev_queue_xmit+0x39c/0xe68
[ 1401.524923]  neigh_resolve_output+0xfc/0x218
[ 1401.524948]  neigh_xmit+0xc0/0x230
[ 1401.524978]  nft_fwd_neigh_eval+0x134/0x220 [nft_fwd_netdev]
[ 1401.525094]  nft_do_chain+0x114/0x4a0 [nf_tables]
[ 1401.525197]  nft_do_chain_netdev+0x138/0x2f8 [nf_tables]
[ 1401.525315]  nf_hook_slow+0x50/0x140
[ 1401.525352]  __dev_queue_xmit+0x39c/0xe68
[ 1401.525397]  ip_finish_output2+0x3f8/0x590
[ 1401.525423]  __ip_finish_output+0xac/0x1b8
[ 1401.525551]  ip_finish_output+0x3c/0x148
[ 1401.525579]  ip_output+0x70/0x100
[ 1401.525603]  ip_forward_finish+0x50/0xa0
[ 1401.525679]  ip_forward+0x570/0x640
[ 1401.525702]  ip_rcv_finish+0x98/0xc0
[ 1401.525726]  ip_rcv+0xe4/0x100
[ 1401.525758]  __netif_receive_skb_one_core+0x64/0xa0
[ 1401.525795]  __netif_receive_skb+0x20/0x70
[ 1401.525819]  process_backlog+0x84/0x1a0
[ 1401.525891]  __napi_poll+0x40/0x1d8
[ 1401.526013]  net_rx_action+0x350/0x400
[ 1401.526047]  handle_softirqs+0x11c/0x2f0
[ 1401.526124]  __do_softirq+0x1c/0x28
[ 1401.526149]  ____do_softirq+0x18/0x30
[ 1401.526172]  call_on_irq_stack+0x30/0x48
[ 1401.526198]  do_softirq_own_stack+0x24/0x50
[ 1401.526221]  do_softirq+0x5c/0x80
[ 1401.526245]  __local_bh_enable_ip+0x98/0xa8
[ 1401.526269]  __dev_queue_xmit+0x3c8/0xe68
[ 1401.526295]  ip_finish_output2+0x3f8/0x590
[ 1401.526318]  __ip_finish_output+0xac/0x1b8
[ 1401.526454]  ip_finish_output+0x3c/0x148
[ 1401.526509]  ip_output+0x70/0x100
[ 1401.526532]  ip_send_skb+0x58/0xd0
[ 1401.526555]  ip_push_pending_frames+0x38/0x68
[ 1401.526818]  raw_sendmsg+0x6c4/0xbe0
[ 1401.526853]  inet_sendmsg+0x4c/0x80
[ 1401.526879]  __sock_sendmsg+0x64/0xc0
[ 1401.526907]  __sys_sendto+0x120/0x1a0
[ 1401.526931]  __arm64_sys_sendto+0x30/0x48
[ 1401.526958]  invoke_syscall+0x60/0xe0
[ 1401.526985]  el0_svc_common.constprop.0+0x48/0xf0
[ 1401.527010]  do_el0_svc+0x24/0x38
[ 1401.527037]  el0_svc+0xbc/0x148
[ 1401.527065]  el0t_64_sync_handler+0xc8/0xe0
[ 1401.527089]  el0t_64_sync+0x190/0x198
[ 1401.527559] SMP: stopping secondary CPUs
[ 1401.529378] Kernel Offset: 0x2dc0a5e70000 from 0xffff800080000000
[ 1401.529410] PHYS_OFFSET: 0x40000000
[ 1401.529431] CPU features: 0x00,0000000d,0037fb7c,67ffff3f
[ 1401.529470] Memory Limit: none
[ 1401.649694] pstore: backend (efi_pstore) writing error (-5)
[ 1401.666009] ---[ end Kernel panic - not syncing: kernel stack overflow ]---


The internaltest-shell.sh seems to have missing test dependencies:
iprout2, iputils-ping, procps. Could one of the nftables maintainers add
them?

Helmut