bisecting fixing commit since c14d30dc9987047b439b03d6e6db7d54d9f7f180
building syzkaller on 5ce135324a84d6de67c913f1b725e3fc5ec39535
testing commit c14d30dc9987047b439b03d6e6db7d54d9f7f180 with gcc (GCC) 8.1.0
kernel signature: ae21f094532c69365d1cec191f8d2747dcf6555c503a617fd9c2aaec75bc44c1
all runs: crashed: KASAN: global-out-of-bounds Read in nfnetlink_parse_nat_setup
testing current HEAD a87f96283793d58b042618c689630db264715274
testing commit a87f96283793d58b042618c689630db264715274 with gcc (GCC) 8.1.0
kernel signature: 3c25ed0ed766e4a6f78cde4eacc20621bd892ac7c541b84b09874e7100619383
all runs: crashed: KASAN: global-out-of-bounds Read in nfnetlink_parse_nat_setup
revisions tested: 2, total time: 23m5.68025803s (build: 16m39.181079173s, test: 6m1.55096662s)
the crash still happens on HEAD
commit msg: Linux 4.19.145
crash: KASAN: global-out-of-bounds Read in nfnetlink_parse_nat_setup
IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready
batman_adv: batadv0: Interface activated: batadv_slave_1
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: global-out-of-bounds in nfnetlink_parse_nat net/netfilter/nf_nat_core.c:847 [inline]
BUG: KASAN: global-out-of-bounds in nfnetlink_parse_nat_setup+0x342/0x350 net/netfilter/nf_nat_core.c:884
Read of size 8 at addr ffffffff87c5b298 by task syz-executor.2/7936

CPU: 0 PID: 7936 Comm: syz-executor.2 Not tainted 4.19.145-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x17c/0x22a lib/dump_stack.c:118
 print_address_description.cold.6+0x12f/0x211 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x307 mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 nfnetlink_parse_nat net/netfilter/nf_nat_core.c:847 [inline]
 nfnetlink_parse_nat_setup+0x342/0x350 net/netfilter/nf_nat_core.c:884
 ctnetlink_parse_nat_setup+0x7c/0x430 net/netfilter/nf_conntrack_netlink.c:1521
 ctnetlink_setup_nat net/netfilter/nf_conntrack_netlink.c:1591 [inline]
 ctnetlink_create_conntrack+0x389/0xfd0 net/netfilter/nf_conntrack_netlink.c:1984
 ctnetlink_new_conntrack+0x46c/0xe4e net/netfilter/nf_conntrack_netlink.c:2114
 nfnetlink_rcv_msg+0x930/0xc00 net/netfilter/nfnetlink.c:233
 netlink_rcv_skb+0x13e/0x3d0 net/netlink/af_netlink.c:2455
 nfnetlink_rcv+0x163/0x3b0 net/netfilter/nfnetlink.c:565
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x443/0x660 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x666/0xc50 net/netlink/af_netlink.c:1909
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xac/0xf0 net/socket.c:632
 ___sys_sendmsg+0x647/0x950 net/socket.c:2115
 __sys_sendmsg+0xd9/0x180 net/socket.c:2153
 __do_sys_sendmsg net/socket.c:2162 [inline]
 __se_sys_sendmsg net/socket.c:2160 [inline]
 __x64_sys_sendmsg+0x73/0xb0 net/socket.c:2160
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d239
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fa997d29c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000028580 RCX: 000000000045d239
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 000000000118cf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff37f5b80f R14: 00007fa997d2a9c0 R15: 000000000118cf4c

The buggy address belongs to the variable:
 nft_flow_offload_policy+0x38/0x80

Memory state around the buggy address:
 ffffffff87c5b180: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
 ffffffff87c5b200: fa fa fa fa 00 05 fa fa fa fa fa fa 00 00 00 00
>ffffffff87c5b280: fa fa fa fa 00 00 07 fa fa fa fa fa 00 00 00 00
                            ^
 ffffffff87c5b300: 00 00 fa fa fa fa fa fa 00 00 00 00 00 00 fa fa
 ffffffff87c5b380: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Bluetooth: hci0: command 0x0419 tx timeout
Bluetooth: hci2: command 0x0419 tx timeout