syzbot


KASAN: use-after-free Read in __nf_tables_abort
Status: upstream: reported C repro on 2020/01/20 11:37
Reported-by: syzbot+29125d208b3dae9a7019@syzkaller.appspotmail.com
Fix commit: eb014de4 netfilter: nf_tables: autoload modules from the abort path
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-upstream-kmsan-gce]
First crash: 27d, last: 26d

Cause bisection: introduced by (bisect log):

commit ec7470b834fe7b5d7eff11b6677f5d7fdf5e9a91
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon Jan 13 17:09:58 2020 +0000

  netfilter: nf_tables: store transaction list locally while requesting module

Crash: BUG: corrupted list in __nf_tables_abort (log)
Repro: C syz .config
similar bugs (1):
Kernel Title Repro Bisected Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in __nf_tables_abort C 2 12d 21d 0/1 upstream: reported C repro on 2020/01/27 08:32

Sample crash report:

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro Maintainers
ci-upstream-kasan-gce-root 2020/01/22 10:47 upstream d96d875e 8eda0b95 .config log report syz C coreteam@netfilter.org, davem@davemloft.net, fw@strlen.de, kadlec@netfilter.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, pablo@netfilter.org
ci-upstream-kasan-gce-smack-root 2020/01/21 12:36 upstream d96d875e 8eda0b95 .config log report syz C coreteam@netfilter.org, davem@davemloft.net, fw@strlen.de, kadlec@netfilter.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, pablo@netfilter.org
ci-upstream-kasan-gce 2020/01/20 11:23 upstream def9d278 0342f8c7 .config log report syz coreteam@netfilter.org, davem@davemloft.net, fw@strlen.de, kadlec@netfilter.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, pablo@netfilter.org