WARNING in xt_compat_add_offset

Status: fixed on 2019/08/27 17:15
Subsystems: netfilter
[Documentation on labels]
Reported-by: syzbot+276ddebab3382bbf72db@syzkaller.appspotmail.com
Fix commit: 3b48300d5cc7 netfilter: ebtables: also count base chain policies
First crash: 2712d, last: 2547d
Cause bisection: introduced by (bisect log) :
commit 2035f3ff8eaa29cfb5c8e2160b0f6e85eeb21a95
Author: Florian Westphal <fw@strlen.de>
Date: Mon Jan 21 20:54:36 2019 +0000

  netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present

Crash: WARNING in xt_compat_add_offset (log)
Repro: syz .config
  
▶ ▼ Discussions (11)
Title Replies (including bot) Last reply
[PATCH AUTOSEL 5.2 001/123] ASoC: simple_card_utils.h: care NULL dai at asoc_simple_debug_dai() 138 (138) 2019/09/09 09:35
[PATCH 5.2 000/135] 5.2.10-stable review 160 (160) 2019/08/27 10:51
[PATCH 4.14 00/71] 4.14.140-stable review 79 (79) 2019/08/24 17:55
[PATCH 4.19 00/85] 4.19.68-stable review 91 (91) 2019/08/24 17:51
[PATCH AUTOSEL 4.14 01/44] iio: adc: max9611: Fix misuse of GENMASK macro 45 (45) 2019/08/14 07:37
[PATCH AUTOSEL 4.19 01/68] iio: adc: max9611: Fix misuse of GENMASK macro 69 (69) 2019/08/14 07:36
[PATCH 0/8] netfilter fixes for net 10 (10) 2019/07/31 15:50
Reminder: 99 open syzbot bugs in net subsystem 14 (14) 2019/07/31 15:13
[PATCH nf] netfilter: ebtables: also count base chain policies 2 (2) 2019/07/30 11:38
WARNING in xt_compat_add_offset 0 (3) 2019/07/20 23:55
Reminder: 94 open syzbot bugs in net subsystem 1 (1) 2019/06/25 05:48

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 9012 at net/netfilter/x_tables.c:649 xt_compat_add_offset.cold+0x11/0x36 /net/netfilter/x_tables.c:649
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 9012 Comm: syz-executor131 Not tainted 5.2.0+ #64
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack /lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 /lib/dump_stack.c:113
 panic+0x2dc/0x755 /kernel/panic.c:219
 __warn.cold+0x20/0x4c /kernel/panic.c:576
 report_bug+0x263/0x2b0 /lib/bug.c:186
 fixup_bug /arch/x86/kernel/traps.c:179 [inline]
 fixup_bug /arch/x86/kernel/traps.c:174 [inline]
 do_error_trap+0x11b/0x200 /arch/x86/kernel/traps.c:272
 do_invalid_op+0x37/0x50 /arch/x86/kernel/traps.c:291
 invalid_op+0x14/0x20 /arch/x86/entry/entry_64.S:1008
RIP: 0010:xt_compat_add_offset.cold+0x11/0x36 /net/netfilter/x_tables.c:649
Code: 89 ee 48 c7 c7 c0 29 2d 88 e8 0c 76 7b fb 41 bc ea ff ff ff e9 87 88 ff ff e8 08 d3 91 fb 48 c7 c7 00 2a 2d 88 e8 f0 75 7b fb <0f> 0b 41 bc f4 ff ff ff e9 01 8b ff ff e8 ea d2 91 fb 48 c7 c7 00
RSP: 0018:ffff8880a382f8d8 EFLAGS: 00010286
RAX: 0000000000000024 RBX: ffff888216b74ad0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815c3a26 RDI: ffffed1014705f0d
RBP: ffff8880a382f908 R08: 0000000000000024 R09: ffffed1015d260b1
R10: ffffed1015d260b0 R11: ffff8880ae930587 R12: 0000000000000014
R13: 0000000000000060 R14: ffff88808b7b6180 R15: 0000000000000000
 size_entry_mwt /net/bridge/netfilter/ebtables.c:2122 [inline]
 compat_copy_entries+0x10e9/0x1340 /net/bridge/netfilter/ebtables.c:2147
 compat_do_replace+0x3b3/0x680 /net/bridge/netfilter/ebtables.c:2243
 compat_do_ebt_set_ctl+0x22f/0x27e /net/bridge/netfilter/ebtables.c:2325
 compat_nf_sockopt /net/netfilter/nf_sockopt.c:144 [inline]
 compat_nf_setsockopt+0x98/0x140 /net/netfilter/nf_sockopt.c:156
 compat_ip_setsockopt /net/ipv4/ip_sockglue.c:1286 [inline]
 compat_ip_setsockopt+0x106/0x140 /net/ipv4/ip_sockglue.c:1267
 compat_raw_setsockopt+0xe0/0x100 /net/ipv4/raw.c:865
 compat_sock_common_setsockopt+0xb2/0x140 /net/core/sock.c:3141
 __compat_sys_setsockopt+0x185/0x380 /net/compat.c:384
 __do_compat_sys_setsockopt /net/compat.c:397 [inline]
 __se_compat_sys_setsockopt /net/compat.c:394 [inline]
 __ia32_compat_sys_setsockopt+0xbd/0x150 /net/compat.c:394
 do_syscall_32_irqs_on /arch/x86/entry/common.c:332 [inline]
 do_fast_syscall_32+0x27b/0xdb3 /arch/x86/entry/common.c:403
 entry_SYSENTER_compat+0x70/0x7f /arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f489c9
Code: d3 83 c4 10 5b 5e 5d c3 ba 80 96 98 00 eb a9 8b 04 24 c3 8b 34 24 c3 8b 3c 24 c3 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000ffaa6d8c EFLAGS: 00000292 ORIG_RAX: 000000000000016e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000
RDX: 0000000000000080 RSI: 0000000020000000 RDI: 00000000000001fc
RBP: 0000000000000012 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (18):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/07/20 23:54 upstream abdfd52a295f 1656845f .config console log report syz C ci-upstream-kasan-gce-386
2019/05/31 19:43 upstream 036e34310931 142ce681 .config console log report syz ci-upstream-kasan-gce-386
2019/05/07 15:12 upstream 71ae5fc87c34 d28f4ce5 .config console log report syz ci-upstream-kasan-gce-386
2019/03/22 08:55 upstream 0939221e6468 dce6e62f .config console log report syz ci-upstream-kasan-gce-386
2019/02/22 08:40 upstream 8a61716ff2ab 7ff74a98 .config console log report syz ci-upstream-kasan-gce-386
2019/08/05 12:51 upstream e21a712a9685 6affd8e8 .config console log report ci-upstream-kasan-gce-386
2019/08/05 05:13 upstream 4b6f23161b4e 6affd8e8 .config console log report ci-upstream-kasan-gce-386
2019/08/02 17:51 upstream 1e78030e5e5b 835dffe7 .config console log report ci-upstream-kasan-gce-386
2019/08/02 06:06 upstream 1e78030e5e5b 835dffe7 .config console log report ci-upstream-kasan-gce-386
2019/08/01 22:25 upstream 1e78030e5e5b 835dffe7 .config console log report ci-upstream-kasan-gce-386
2019/07/31 21:11 upstream 4010b622f1d2 c692b5bd .config console log report ci-upstream-kasan-gce-386
2019/07/26 19:37 upstream 6789f873ed37 3e5d1beb .config console log report ci-upstream-kasan-gce-386
2019/07/26 07:52 upstream 6789f873ed37 732bc5a0 .config console log report ci-upstream-kasan-gce-386
2019/07/25 07:57 upstream bed38c3e2dca 32329ceb .config console log report ci-upstream-kasan-gce-386
2019/07/23 00:24 upstream abdfd52a295f 55e0c077 .config console log report ci-upstream-kasan-gce-386
2019/07/20 23:35 upstream abdfd52a295f 1656845f .config console log report ci-upstream-kasan-gce-386
2019/05/31 18:37 upstream 036e34310931 142ce681 .config console log report ci-upstream-kasan-gce-386
2019/02/22 08:17 upstream 8a61716ff2ab 7ff74a98 .config console log report ci-upstream-kasan-gce-386
* Struck through repros no longer work on HEAD.