syzbot


general protection fault in nf_tables_set_lookup

Status: public: reported C repro on 2019/04/13 00:00
Reported-by: syzbot+7a97fc2d68bea69ccae9@syzkaller.appspotmail.com
First crash: 2317d, last: 2317d

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available)
random: sshd: uninitialized urandom read (32 bytes read, 123 bits of entropy available)
random: sshd: uninitialized urandom read (32 bytes read, 126 bits of entropy available)
random: nonblocking pool is initialized
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3759 Comm: syz-executor692 Not tainted 4.4.141-g1b37d68 #71
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d06ce000 task.stack: ffff8801d9528000
RIP: 0010:[<ffffffff8314e7ac>]  [<ffffffff8314e7ac>] nf_tables_set_lookup+0x3c/0xc0 net/netfilter/nf_tables_api.c:2380
RSP: 0018:ffff8801d952f598  EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffffffffffea RCX: 1ffff1003b2a5ecd
RDX: 0000000000000004 RSI: ffffffff8314e797 RDI: 0000000000000000
RBP: ffff8801d952f5b8 R08: ffff8801d952f6f8 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000020
R13: ffff8801cfae0794 R14: 0000000000000000 R15: ffff8801d952f6f8
FS:  00000000012d8880(0063) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000040 CR3: 00000001d2266000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 1ffff1003b2a5ebb ffff8801ccaa2780 ffff8801cfae0780 ffff8801d952f6b8
 ffff8801d952f6e0 ffffffff8314fda9 ffff8801d952f658 ffff8800b6fce600
 0000000041b58ab3 ffffffff8423ef33 ffffffff8314fc00 ffffffff838bb724
Call Trace:
 [<ffffffff8314fda9>] nf_tables_getset+0x1a9/0x510 net/netfilter/nf_tables_api.c:2653
 [<ffffffff830c95d9>] nfnetlink_rcv_msg+0xa19/0xc00 net/netfilter/nfnetlink.c:215
 [<ffffffff830ba775>] netlink_rcv_skb+0x145/0x370 net/netlink/af_netlink.c:2354
 [<ffffffff830c8253>] nfnetlink_rcv+0x983/0x10a0 net/netfilter/nfnetlink.c:479
 [<ffffffff830b9329>] netlink_unicast_kernel net/netlink/af_netlink.c:1270 [inline]
 [<ffffffff830b9329>] netlink_unicast+0x4e9/0x700 net/netlink/af_netlink.c:1296
 [<ffffffff830b9cd5>] netlink_sendmsg+0x795/0xc30 net/netlink/af_netlink.c:1852
 [<ffffffff82f1e2fc>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82f1e2fc>] sock_sendmsg+0xcc/0x110 net/socket.c:635
 [<ffffffff82f1fdc5>] ___sys_sendmsg+0x745/0x880 net/socket.c:1962
 [<ffffffff82f21e66>] __sys_sendmsg+0xd6/0x190 net/socket.c:1996
 [<ffffffff82f21f4d>] SYSC_sendmsg net/socket.c:2007 [inline]
 [<ffffffff82f21f4d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2003
 [<ffffffff838c2c25>] entry_SYSCALL_64_fastpath+0x22/0x9e
Code: 48 c7 c3 ea ff ff ff e8 93 2d 20 fe 4d 85 ed 74 65 e8 89 2d 20 fe 4d 8d 66 20 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 69 49 8b 5e 20 49 be 00 00 00 00 00 fc ff df 4c 
RIP  [<ffffffff8314e7ac>] nf_tables_set_lookup+0x3c/0xc0 net/netfilter/nf_tables_api.c:2380
 RSP <ffff8801d952f598>
---[ end trace 6f8bf978fb5f3cc1 ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/21 05:51 https://android.googlesource.com/kernel/common android-4.4 1b37d68f4c82 af255b09 .config console log report syz C ci-android-44-kasan-gce
2018/07/21 04:03 https://android.googlesource.com/kernel/common android-4.4 1b37d68f4c82 af255b09 .config console log report syz ci-android-44-kasan-gce-386
2018/07/21 03:37 https://android.googlesource.com/kernel/common android-4.4 1b37d68f4c82 af255b09 .config console log report ci-android-44-kasan-gce-386
* Struck through repros no longer work on HEAD.