KASAN: global-out-of-bounds Read in nfnetlink_parse_nat_setup

Status: upstream: reported C repro on 2020/02/03 22:42
Reported-by: syzbot+a51591fd9e2ace6423f0@syzkaller.appspotmail.com
First crash: 2391d, last: 2166d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: global-out-of-bounds Read in nfnetlink_parse_nat_setup 17 syz, C inconclusive 45 2149d 2398d 0/1 upstream: reported C repro on 2020/01/28 03:04
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2020/10/15 12:15 2m bisect fix linux-4.19.y error job log
2020/09/15 11:52 23m bisect fix linux-4.19.y OK (0) job log log
2020/06/21 15:39 23m bisect fix linux-4.19.y OK (0) job log log

Sample crash report:
audit: type=1400 audit(1597533515.324:8): avc:  denied  { execmem } for  pid=6477 comm="syz-executor048" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
==================================================================
BUG: KASAN: global-out-of-bounds in nfnetlink_parse_nat net/netfilter/nf_nat_core.c:847 [inline]
BUG: KASAN: global-out-of-bounds in nfnetlink_parse_nat_setup+0x5ed/0x640 net/netfilter/nf_nat_core.c:884
Read of size 8 at addr ffffffff8830e5d8 by task syz-executor048/6477

CPU: 1 PID: 6477 Comm: syz-executor048 Not tainted 4.19.139-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
 print_address_description.cold+0x5/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
 kasan_report mm/kasan/report.c:412 [inline]
 __asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
 nfnetlink_parse_nat net/netfilter/nf_nat_core.c:847 [inline]
 nfnetlink_parse_nat_setup+0x5ed/0x640 net/netfilter/nf_nat_core.c:884
 ctnetlink_parse_nat_setup+0xb6/0x640 net/netfilter/nf_conntrack_netlink.c:1521
 ctnetlink_setup_nat net/netfilter/nf_conntrack_netlink.c:1591 [inline]
 ctnetlink_create_conntrack+0x4bb/0x12c0 net/netfilter/nf_conntrack_netlink.c:1984
 ctnetlink_new_conntrack+0x4f3/0xde0 net/netfilter/nf_conntrack_netlink.c:2114
 nfnetlink_rcv_msg+0xc4f/0xf60 net/netfilter/nfnetlink.c:228
 netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2455
 nfnetlink_rcv+0x1b2/0x41b net/netfilter/nfnetlink.c:560
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6bb/0xc40 net/netlink/af_netlink.c:1909
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xc3/0x120 net/socket.c:632
 ___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2115
 __sys_sendmsg net/socket.c:2153 [inline]
 __do_sys_sendmsg net/socket.c:2162 [inline]
 __se_sys_sendmsg net/socket.c:2160 [inline]
 __x64_sys_sendmsg+0x132/0x220 net/socket.c:2160
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440359
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffe4e1557d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440359
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401b60
R13: 0000000000401bf0 R14: 0000000000000000 R15: 0000000000000000

The buggy address belongs to the variable:
 nft_flow_offload_policy+0x38/0x100

Memory state around the buggy address:
 ffffffff8830e480: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
 ffffffff8830e500: 00 00 00 00 00 fa fa fa fa fa fa fa 00 05 fa fa
>ffffffff8830e580: fa fa fa fa 00 00 00 00 fa fa fa fa 00 00 07 fa
                                                    ^
 ffffffff8830e600: fa fa fa fa 00 00 00 00 fa fa fa fa 00 00 00 00
 ffffffff8830e680: fa fa fa fa 00 00 00 00 00 00 fa fa fa fa fa fa
==================================================================

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/15 23:20 linux-4.19.y c14d30dc9987 5ce13532 .config console log report syz C ci2-linux-4-19
2020/02/03 22:58 linux-4.19.y 32ee7492f104 93e5e335 .config console log report syz C ci2-linux-4-19
2020/07/19 14:42 linux-4.19.y 17a87580a885 9c812472 .config console log report ci2-linux-4-19
2020/07/08 15:17 linux-4.19.y 399849e4654e 5962a2dc .config console log report ci2-linux-4-19
2020/07/08 15:17 linux-4.19.y 399849e4654e 5962a2dc .config console log report ci2-linux-4-19
2020/05/22 15:16 linux-4.19.y 1bab61d3e8cd 4afdfa20 .config console log report ci2-linux-4-19
2020/05/07 20:05 linux-4.19.y 84920cc7fbe1 98cbd87b .config console log report ci2-linux-4-19
2020/05/03 17:28 linux-4.19.y fdc072324f3c 58ae5e18 .config console log report ci2-linux-4-19
2020/04/17 14:20 linux-4.19.y 8488c3f3bc86 18397578 .config console log report ci2-linux-4-19
2020/04/15 15:08 linux-4.19.y 6dd0e32665e5 3f3c5574 .config console log report ci2-linux-4-19
2020/03/16 23:55 linux-4.19.y 339485c9a80f 749688d2 .config console log report ci2-linux-4-19
2020/03/01 16:25 linux-4.19.y a083db76118d c88c7b75 .config console log report ci2-linux-4-19
2020/02/28 14:47 linux-4.19.y f25804f38984 c88c7b75 .config console log report ci2-linux-4-19
2020/02/27 20:05 linux-4.19.y f25804f38984 40bcfdd5 .config console log report ci2-linux-4-19
2020/02/03 22:41 linux-4.19.y 32ee7492f104 93e5e335 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.