I added a panic() in nf_ct_expect_insert(). After reproducing, the crash dump
(via crash) shows the nf_conntrack involved is a template (used as the master),
and the expectation insertion was triggered by a TFTP packet.
The detailed information is as follows:
---------------------------------------------------
crash> sys
KERNEL: vmlinux [TAINTED]
DUMPFILE: coredump-2025-08-15-00_40-8.0.0-B3 [PARTIAL DUMP]
CPUS: 64
DATE: Thu Aug 14 17:40:23 PDT 2025
UPTIME: 00:01:36
LOAD AVERAGE: 4.39, 1.37, 0.48
TASKS: 1115
NODENAME: MYNODE
RELEASE: 6.1
VERSION: #15 SMP Thu Aug 14 17:02:44 PDT 2025
MACHINE: x86_64 (2800 Mhz)
MEMORY: 382.7 GB
PANIC: "Kernel panic - not syncing: [nf_ct_expect_insert:417] exp:ffff88822ed78008 master:ffff888136fcd000 ext:ffff8881087bf500 jiffies:4294761886 timeout:300 expires:4295061886"
crash> bt
PID: 8605 TASK: ffff888139140040 CPU: 4 COMMAND: "cli"
#0 [ffffc9001762b7f8] machine_kexec at ffffffff80279d53
#1 [ffffc9001762b878] __crash_kexec at ffffffff8038b7b7
#2 [ffffc9001762b948] panic at ffffffff802973e0
#3 [ffffc9001762b9c8] nf_ct_expect_related_report at ffffffff80ee7b27
#4 [ffffc9001762ba40] tftp_help at ffffffff80f001ea
#5 [ffffc9001762ba98] nf_confirm at ffffffff80eeaa77
#6 [ffffc9001762bac8] ipv4_confirm at ffffffff80eeafa9
#7 [ffffc9001762baf8] nf_hook_slow at ffffffff80ed24db
#8 [ffffc9001762bb40] ip_output at ffffffff80fe85a5
#9 [ffffc9001762bbc8] udp_send_skb at ffffffff81033372
#10 [ffffc9001762bc18] udp_sendmsg at ffffffff81032cb2
#11 [ffffc9001762bd90] inet_sendmsg at ffffffff810488a1
#12 [ffffc9001762bdb8] __sys_sendto at ffffffff80dcdda7
#13 [ffffc9001762bf08] __x64_sys_sendto at ffffffff80dcde46
#14 [ffffc9001762bf18] do_syscall_64 at ffffffff811eab09
#15 [ffffc9001762bf50] entry_SYSCALL_64_after_hwframe at ffffffff812000dc
RIP: 00007fde06cdb8f3 RSP: 00007ffc80d56358 RFLAGS: 00000202
RAX: ffffffffffffffda RBX: 000055eb6f07fc03 RCX: 00007fde06cdb8f3
RDX: 000000000000001d RSI: 00007fde047666c0 RDI: 0000000000000007
RBP: 000055eb6fc941c3 R8: 00007fde047665a0 R9: 0000000000000010
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 000000000000000b R14: 00007fde030f4908 R15: 0000000000000006
ORIG_RAX: 000000000000002c CS: 0033 SS: 002b
crash> nf_conn.status -x ffff888136fcd000
status = 0x808,
----------------------------------------------------
