linux-kernel - NULL pointer dereference in nft_set_elem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190308131746.5899877a@fire.localdomain>
Date:   Fri, 8 Mar 2019 13:17:46 +0300
From:   Dmitrii Tcvetkov <demfloro@...floro.ru>
To:     netfilter-devel@...r.kernel.org
Cc:     coreteam@...filter.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: NULL pointer dereference in nft_set_elem_destroy()

After upgrade to 5.0 on XPS 13 9360 I get NULL pointer dereference in
dmesg (attached). Distro is Arch Linux, kernel is built with custom
config (attached), but distro kernel[1] reproduces the issue on the
laptop as well.

Bisect led me to commit f6ac858589768 (netfilter: nf_tables: unbind set
in rule from commit path), bisect log attached. The commit doesn't
revert cleanly on top of v5.0, and conflicts aren't trivial for me to
resolve.

The issue reproduces only on the laptop, probably it has something to
do with it's ruleset, it's attached too.

[1] https://git.archlinux.org/svntogit/packages.git/plain/trunk/config?h=packages/linux

View attachment "dmesg.txt" of type "text/plain" (74864 bytes)

View attachment "kernel-config.txt" of type "text/plain" (112412 bytes)

View attachment "bisect-log.txt" of type "text/plain" (2774 bytes)

View attachment "nftables.conf" of type "text/plain" (1185 bytes)