arp_tables: arptables: counters copy to user failed while replacing table ================================================================== BUG: KASAN: null-ptr-deref in memcpy include/linux/string.h:347 [inline] BUG: KASAN: null-ptr-deref in llcp_sock_getname+0x37b/0x490 net/nfc/llcp_sock.c:532 Read of size 16 at addr (null) by task syz-executor.1/9350 CPU: 0 PID: 9350 Comm: syz-executor.1 Not tainted 4.14.183-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x283 lib/dump_stack.c:58 kasan_report_error mm/kasan/report.c:349 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0x127/0x2b9 mm/kasan/report.c:393 memcpy+0x20/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:347 [inline] llcp_sock_getname+0x37b/0x490 net/nfc/llcp_sock.c:532 audit: type=1804 audit(1591184463.216:38): pid=9342 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir643848579/syzkaller.oMN7vA/37/file0/bus" dev="ramfs" ino=33303 res=1 SYSC_getsockname net/socket.c:1683 [inline] SyS_getsockname+0x100/0x1c0 net/socket.c:1668 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45ca69 RSP: 002b:00007f2bb1e23c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000033 RAX: ffffffffffffffda RBX: 00000000004dd200 RCX: 000000000045ca69 RDX: 0000000020000540 RSI: 00000000200004c0 RDI: 0000000000000004 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff audit: type=1804 audit(1591184463.256:39): pid=9342 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir643848579/syzkaller.oMN7vA/37/file0/bus" dev="ramfs" ino=33303 res=1 R13: 000000000000010e R14: 00000000004c3b1d R15: 00007f2bb1e246d4 ================================================================== arp_tables: arptables: counters copy to user failed while replacing table ip6_tables: ip6tables: counters copy to user failed while replacing table audit: type=1804 audit(1591184463.276:40): pid=9342 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir643848579/syzkaller.oMN7vA/37/file0/bus" dev="ramfs" ino=33303 res=1 audit: type=1804 audit(1591184463.516:41): pid=9379 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir643848579/syzkaller.oMN7vA/37/file0/bus" dev="ramfs" ino=33303 res=1 audit: type=1804 audit(1591184463.546:42): pid=9342 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir643848579/syzkaller.oMN7vA/37/file0/bus" dev="ramfs" ino=33303 res=1 audit: type=1804 audit(1591184463.546:43): pid=9356 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir643848579/syzkaller.oMN7vA/37/file0/bus" dev="ramfs" ino=33303 res=1