KASAN: vmalloc-out-of-bounds Read in __ebt_unregister_table

Status: fixed on 2023/06/08 14:41
Subsystems: bridge netfilter
[Documentation on labels]
Reported-by: syzbot+f61594de72d6705aea03@syzkaller.appspotmail.com
Fix commit: e58a171d35e3 netfilter: ebtables: fix table blob use-after-free
First crash: 1267d, last: 1266d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH net 0/8] Netfilterf fixes for net 10 (10) 2023/02/23 05:40
[PATCH nf] ebtables: fix table blob use-after-free 2 (2) 2023/02/21 23:23
Re: [syzbot] [bridge?] [netfilter?] KASAN: vmalloc-out-of-bounds Read in __ebt_unregister_table 1 (1) 2023/02/20 07:51
[syzbot] [bridge?] [coreteam?] KASAN: vmalloc-out-of-bounds Read in __ebt_unregister_table 0 (1) 2023/02/17 17:35
▶ ▼ Last patch testing requests (8)
Created Duration User Patch Repo Result
2023/02/20 07:25 12m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3ac88fa4605e error
2023/02/19 11:40 4m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3ac88fa4605e error
2023/02/19 07:15 13m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3ac88fa4605e report log
2023/02/19 02:42 13m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3ac88fa4605e report log
2023/02/18 13:51 13m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3ac88fa4605e report log
2023/02/18 09:14 13m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3ac88fa4605e report log
2023/02/18 01:52 13m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 3ac88fa4605e report log
2023/02/17 21:48 22m fw@strlen.de git://git.kernel.org/pub/scm/linux/kernel/git/fwestphal/nf.git ebt_uaf OK log

Sample crash report:
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168
Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74

CPU: 0 PID: 74 Comm: kworker/u4:4 Not tainted 6.2.0-rc8-syzkaller-00083-g3ac88fa4605e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:306 [inline]
 print_report+0x15e/0x45d mm/kasan/report.c:417
 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517
 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168
 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372
 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169
 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613
 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
 worker_thread+0x669/0x1090 kernel/workqueue.c:2436
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>

Memory state around the buggy address:
 ffffc90005424f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90005424f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90005425000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc90005425080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90005425100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/02/17 10:01 upstream 3ac88fa4605e 851bc19a .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: vmalloc-out-of-bounds Read in __ebt_unregister_table
2023/02/18 01:55 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 2d3827b3f393 3e7039f4 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in __ebt_unregister_table
2023/02/17 06:29 upstream 3ac88fa4605e 851bc19a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: vmalloc-out-of-bounds Read in __ebt_unregister_table
2023/02/17 06:12 net-old b20b8aec6ffc 851bc19a .config console log report info ci-upstream-net-this-kasan-gce KASAN: vmalloc-out-of-bounds Read in __ebt_unregister_table
* Struck through repros no longer work on HEAD.