Date:   Mon, 12 Feb 2018 08:16:23 -0800
From:   syzbot <syzbot+c914fd8c6a751c4fddbd@...kaller.appspotmail.com>
To:     coreteam@...filter.org, davem@...emloft.net, fw@...len.de,
        kadlec@...ckhole.kfki.hu, kuznet@....inr.ac.ru,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        netfilter-devel@...r.kernel.org, pablo@...filter.org,
        syzkaller-bugs@...glegroups.com, yoshfuji@...ux-ipv6.org
Subject: general protection fault in ipt_do_table

Hello,

syzbot hit the following crash on net-next commit
9a61df9e5f7471fe5be3e02bd0bed726b2761a54 (Sat Feb 10 03:32:41 2018 +0000)
Merge tag 'kbuild-v4.16-2' of  
git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

So far this crash happened 2 times on net-next, upstream.
C reproducer is attached.
syzkaller reproducer is attached.
Raw console output is attached.
compiler: gcc (GCC) 7.1.1 20170620
.config is attached.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c914fd8c6a751c4fddbd@...kaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for  
details.
If you forward the report, please keep this part and the footer.

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
    (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4162 Comm: syzkaller652256 Not tainted 4.15.0+ #222
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:ipt_do_table+0x12ee/0x1950 net/ipv4/netfilter/ip_tables.c:334
RSP: 0018:ffff8801db406bd0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8801db3ccf80 RCX: ffffffff84b7013d
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8801db3cce5a
RBP: ffff8801db406dd8 R08: ffff8801db406ed0 R09: 0000000000000002
R10: ffff8801db406d30 R11: 0000000000000020 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8801db3cce00 R15: ffff8801db406d50
FS:  0000000000be1880(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020015cf0 CR3: 00000001d715c004 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  <IRQ>
  iptable_filter_hook+0x65/0x80 net/ipv4/netfilter/iptable_filter.c:41
  nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
  nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
  nf_hook include/linux/netfilter.h:243 [inline]
  NF_HOOK include/linux/netfilter.h:286 [inline]
  ip_local_deliver+0x445/0x6e0 net/ipv4/ip_input.c:257
  dst_input include/net/dst.h:449 [inline]
  ip_rcv_finish+0xa36/0x2040 net/ipv4/ip_input.c:397
  NF_HOOK include/linux/netfilter.h:288 [inline]
  ip_rcv+0xc5a/0x1840 net/ipv4/ip_input.c:493
  __netif_receive_skb_core+0x1a41/0x3460 net/core/dev.c:4547
  __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4612
  process_backlog+0x203/0x740 net/core/dev.c:5292
  napi_poll net/core/dev.c:5690 [inline]
  net_rx_action+0x792/0x1910 net/core/dev.c:5756
  __do_softirq+0x2d7/0xb85 kernel/softirq.c:285
  do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1042
  </IRQ>
  do_softirq.part.19+0x14d/0x190 kernel/softirq.c:329
  do_softirq+0x19/0x20 kernel/softirq.c:332
  netif_rx_ni+0xcd/0x3c0 net/core/dev.c:4177
  dev_loopback_xmit+0x263/0x670 net/core/dev.c:3305
  ip_mc_finish_output+0x36/0x180 net/ipv4/ip_output.c:331
  NF_HOOK include/linux/netfilter.h:288 [inline]
  ip_mc_output+0x69c/0x1350 net/ipv4/ip_output.c:369
  dst_output include/net/dst.h:443 [inline]
  ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
  ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1414
  udp_send_skb+0x666/0xc30 net/ipv4/udp.c:809
  udp_sendmsg+0xba0/0x2f70 net/ipv4/udp.c:1044
  udpv6_sendmsg+0x757/0x3400 net/ipv6/udp.c:1156
  inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:764
  sock_sendmsg_nosec net/socket.c:630 [inline]
  sock_sendmsg+0xca/0x110 net/socket.c:640
  ___sys_sendmsg+0x767/0x8b0 net/socket.c:2046
  __sys_sendmsg+0xe5/0x210 net/socket.c:2080
  SYSC_sendmsg net/socket.c:2091 [inline]
  SyS_sendmsg+0x2d/0x50 net/socket.c:2087
  do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x445fa9
RSP: 002b:00007ffd470de438 EFLAGS: 00000217 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000445fa9
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005
RBP: 00000000004a7bcc R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004031a0
R13: 0000000000403230 R14: 0000000000000000 R15: 0000000000000000
Code: 46 52 02 75 41 e8 33 a9 b9 fc 8b 85 80 fe ff ff 8d 70 01 89 b5 00 ff  
ff ff 48 8b b5 88 fe ff ff 4c 8d 24 c6 4c 89 e0 48 c1 e8 03 <42> 80 3c 28  
00 0f 85 e8 01 00 00 8b 85 00 ff ff ff 4d 89 34 24
RIP: ipt_do_table+0x12ee/0x1950 net/ipv4/netfilter/ip_tables.c:334 RSP:  
ffff8801db406bd0
---[ end trace 8c31a953ce551874 ]---


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@...glegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is  
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug  
report.
Note: all commands must start from beginning of the line in the email body.

View attachment "raw.log.txt" of type "text/plain" (12803 bytes)

View attachment "repro.syz.txt" of type "text/plain" (1710 bytes)

View attachment "repro.c.txt" of type "text/plain" (22791 bytes)

View attachment "config.txt" of type "text/plain" (136385 bytes)

Powered by blists - more mailing lists