syzbot


KASAN: use-after-free Read in nft_table_lookup (2)
Status: upstream: reported syz repro on 2021/09/13 07:35
Reported-by: syzbot+f31660cf279b0557160c@syzkaller.appspotmail.com
Fix commit: a499b03bf36b netfilter: nf_tables: unlink table before deleting it
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 83d, last: 83d

Cause bisection: introduced by (bisect log) :
commit 6001a930ce0378b62210d4f83583fc88a903d89d
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon Feb 15 11:28:07 2021 +0000

  netfilter: nftables: introduce table ownership

Crash: KASAN: use-after-free Read in nft_table_lookup (log)
Repro: syz .config
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in nft_table_lookup 1 115d 115d 0/22 closed as invalid on 2021/08/31 02:52
Patch testing requests:
Created Duration User Patch Repo Result
2021/09/13 11:57 10m fw@strlen.de git://git.kernel.org/pub/scm/linux/kernel/git/fwestphal/nf.git nft_fix_owner_uaf_02 OK
2021/09/13 11:46 5m fw@strlen.de git://git.kernel.org/pub/scm/linux/kernel/git/fwestphal/nf.git nft_fix_owner_uaf_01 error

Sample crash report:

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce 2021/09/09 07:28 upstream 0f4b9289bad3 e2776ee4 .config log report syz KASAN: use-after-free Read in nft_table_lookup