* general protection fault in xt_rateest_put
@ 2020-01-11 18:04 syzbot
2020-01-11 20:05 ` Cong Wang
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: syzbot @ 2020-01-11 18:04 UTC (permalink / raw)
To: coreteam, davem, fw, kadlec, linux-kernel, netdev,
netfilter-devel, pablo, syzkaller-bugs
Hello,
syzbot found the following crash on:
HEAD commit: e69ec487 Merge branch 'for-linus' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1239f876e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=18698c0c240ba616
dashboard link: https://syzkaller.appspot.com/bug?extid=91bdd8eece0f6629ec8b
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13dbd58ee00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15eff9e1e00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 10213 Comm: syz-executor519 Not tainted 5.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:net_generic include/net/netns/generic.h:45 [inline]
RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
Code: 85 87 01 fb 45 84 f6 0f 84 68 02 00 00 e8 37 86 01 fb 49 8d bd 68 13
00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 6c 03 00 00 4d 8b b5 68 13 00 00 e8 29 bf ed fa
RSP: 0018:ffffc90001cd7940 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880a779f700 RCX: ffffffff8673a332
RDX: 000000000000026d RSI: ffffffff8673a0b9 RDI: 0000000000001368
RBP: ffffc90001cd7970 R08: ffff8880a96b2240 R09: ffffed1015d0703d
R10: ffffed1015d0703c R11: ffff8880ae8381e3 R12: 000000000000002d
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8673a470
FS: 00000000016ce880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cd48aff140 CR3: 0000000096982000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461
nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
nf_setsockopt+0x77/0xd0 net/netfilter/nf_sockopt.c:115
ip_setsockopt net/ipv4/ip_sockglue.c:1260 [inline]
ip_setsockopt+0xdf/0x100 net/ipv4/ip_sockglue.c:1240
udp_setsockopt+0x68/0xb0 net/ipv4/udp.c:2639
sock_common_setsockopt+0x94/0xd0 net/core/sock.c:3149
__sys_setsockopt+0x261/0x4c0 net/socket.c:2117
__do_sys_setsockopt net/socket.c:2133 [inline]
__se_sys_setsockopt net/socket.c:2130 [inline]
__x64_sys_setsockopt+0xbe/0x150 net/socket.c:2130
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441699
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc35157368 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000441699
RDX: 0000000000000060 RSI: 0a02000000000000 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 0000000000000430 R09: 00000000004002c8
R10: 00000000200008c0 R11: 0000000000000246 R12: 0000000000402f20
R13: 0000000000402fb0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace f2341320b9d5ba2d ]---
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:net_generic include/net/netns/generic.h:45 [inline]
RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
Code: 85 87 01 fb 45 84 f6 0f 84 68 02 00 00 e8 37 86 01 fb 49 8d bd 68 13
00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 6c 03 00 00 4d 8b b5 68 13 00 00 e8 29 bf ed fa
RSP: 0018:ffffc90001cd7940 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880a779f700 RCX: ffffffff8673a332
RDX: 000000000000026d RSI: ffffffff8673a0b9 RDI: 0000000000001368
RBP: ffffc90001cd7970 R08: ffff8880a96b2240 R09: ffffed1015d0703d
R10: ffffed1015d0703c R11: ffff8880ae8381e3 R12: 000000000000002d
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8673a470
FS: 00000000016ce880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cd48af04c0 CR3: 0000000096982000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: general protection fault in xt_rateest_put
2020-01-11 18:04 general protection fault in xt_rateest_put syzbot
@ 2020-01-11 20:05 ` Cong Wang
2020-01-11 21:13 ` Florian Westphal
2020-01-11 22:19 ` [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Florian Westphal
2020-01-12 20:13 ` general protection fault in xt_rateest_put syzbot
2 siblings, 1 reply; 7+ messages in thread
From: Cong Wang @ 2020-01-11 20:05 UTC (permalink / raw)
To: syzbot
Cc: coreteam, David Miller, Florian Westphal, Jozsef Kadlecsik, LKML,
Linux Kernel Network Developers, NetFilter, Pablo Neira Ayuso,
syzkaller-bugs
On Sat, Jan 11, 2020 at 10:05 AM syzbot
<syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: e69ec487 Merge branch 'for-linus' of git://git.kernel.org/..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1239f876e00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=18698c0c240ba616
> dashboard link: https://syzkaller.appspot.com/bug?extid=91bdd8eece0f6629ec8b
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13dbd58ee00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15eff9e1e00000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
>
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> CPU: 0 PID: 10213 Comm: syz-executor519 Not tainted 5.5.0-rc5-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
> RIP: 0010:net_generic include/net/netns/generic.h:45 [inline]
> RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
> Code: 85 87 01 fb 45 84 f6 0f 84 68 02 00 00 e8 37 86 01 fb 49 8d bd 68 13
> 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 6c 03 00 00 4d 8b b5 68 13 00 00 e8 29 bf ed fa
> RSP: 0018:ffffc90001cd7940 EFLAGS: 00010202
> RAX: dffffc0000000000 RBX: ffff8880a779f700 RCX: ffffffff8673a332
> RDX: 000000000000026d RSI: ffffffff8673a0b9 RDI: 0000000000001368
> RBP: ffffc90001cd7970 R08: ffff8880a96b2240 R09: ffffed1015d0703d
> R10: ffffed1015d0703c R11: ffff8880ae8381e3 R12: 000000000000002d
> R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8673a470
> FS: 00000000016ce880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055cd48aff140 CR3: 0000000096982000 CR4: 00000000001406f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
> cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
> translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
> do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
> do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461
This looks odd, the head commit e69ec487 comes after commit
1b789577f655060d98d20ed0c6f9fbd469d6ba63 which is supposed
to fix this...
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: general protection fault in xt_rateest_put
2020-01-11 20:05 ` Cong Wang
@ 2020-01-11 21:13 ` Florian Westphal
2020-01-11 21:34 ` Cong Wang
0 siblings, 1 reply; 7+ messages in thread
From: Florian Westphal @ 2020-01-11 21:13 UTC (permalink / raw)
To: Cong Wang
Cc: syzbot, coreteam, David Miller, Florian Westphal,
Jozsef Kadlecsik, LKML, Linux Kernel Network Developers,
NetFilter, Pablo Neira Ayuso, syzkaller-bugs
Cong Wang <xiyou.wangcong@gmail.com> wrote:
> On Sat, Jan 11, 2020 at 10:05 AM syzbot
> <syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit: e69ec487 Merge branch 'for-linus' of git://git.kernel.org/..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1239f876e00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=18698c0c240ba616
> > dashboard link: https://syzkaller.appspot.com/bug?extid=91bdd8eece0f6629ec8b
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13dbd58ee00000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15eff9e1e00000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
> >
> > kasan: CONFIG_KASAN_INLINE enabled
> > kasan: GPF could be caused by NULL-ptr deref or user memory access
> > general protection fault: 0000 [#1] PREEMPT SMP KASAN
> > CPU: 0 PID: 10213 Comm: syz-executor519 Not tainted 5.5.0-rc5-syzkaller #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
> > RIP: 0010:net_generic include/net/netns/generic.h:45 [inline]
> > RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
> > Code: 85 87 01 fb 45 84 f6 0f 84 68 02 00 00 e8 37 86 01 fb 49 8d bd 68 13
> > 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> > 85 6c 03 00 00 4d 8b b5 68 13 00 00 e8 29 bf ed fa
> > RSP: 0018:ffffc90001cd7940 EFLAGS: 00010202
> > RAX: dffffc0000000000 RBX: ffff8880a779f700 RCX: ffffffff8673a332
> > RDX: 000000000000026d RSI: ffffffff8673a0b9 RDI: 0000000000001368
> > RBP: ffffc90001cd7970 R08: ffff8880a96b2240 R09: ffffed1015d0703d
> > R10: ffffed1015d0703c R11: ffff8880ae8381e3 R12: 000000000000002d
> > R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8673a470
> > FS: 00000000016ce880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 000055cd48aff140 CR3: 0000000096982000 CR4: 00000000001406f0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> > xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
> > cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
> > translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
> > do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
> > do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461
>
> This looks odd, the head commit e69ec487 comes after commit
> 1b789577f655060d98d20ed0c6f9fbd469d6ba63 which is supposed
> to fix this...
The fix is incomplete, net/ipv4/netfilter/arp_tables.c:cleanup_entry()
doesn't init *net either.
Are you working on a fix already?
Otherwise I can handle this.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: general protection fault in xt_rateest_put
2020-01-11 21:13 ` Florian Westphal
@ 2020-01-11 21:34 ` Cong Wang
0 siblings, 0 replies; 7+ messages in thread
From: Cong Wang @ 2020-01-11 21:34 UTC (permalink / raw)
To: Florian Westphal
Cc: syzbot, coreteam, David Miller, Jozsef Kadlecsik, LKML,
Linux Kernel Network Developers, NetFilter, Pablo Neira Ayuso,
syzkaller-bugs
On Sat, Jan 11, 2020 at 1:13 PM Florian Westphal <fw@strlen.de> wrote:
> The fix is incomplete, net/ipv4/netfilter/arp_tables.c:cleanup_entry()
> doesn't init *net either.
>
> Are you working on a fix already?
>
> Otherwise I can handle this.
I am not. Please go ahead.
Thanks!
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
2020-01-11 18:04 general protection fault in xt_rateest_put syzbot
2020-01-11 20:05 ` Cong Wang
@ 2020-01-11 22:19 ` Florian Westphal
2020-01-13 17:51 ` Pablo Neira Ayuso
2020-01-12 20:13 ` general protection fault in xt_rateest_put syzbot
2 siblings, 1 reply; 7+ messages in thread
From: Florian Westphal @ 2020-01-11 22:19 UTC (permalink / raw)
To: netfilter-devel
Cc: netdev, syzkaller-bugs, Florian Westphal, syzbot+91bdd8eece0f6629ec8b
An earlier commit (1b789577f655060d98d20e,
"netfilter: arp_tables: init netns pointer in xt_tgchk_param struct"
fixed missing net initialization for arptables, but turns out it was
incomplete. We can get a very similar struct net NULL deref during
error unwinding:
general protection fault: 0000 [#1] PREEMPT SMP KASAN
RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461
Also init the netns pointer in xt_tgdtor_param struct.
Fixes: add67461240c1d ("netfilter: add struct net * to target parameters")
Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/ipv4/netfilter/arp_tables.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 069f72edb264..f1f78a742b36 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -496,12 +496,13 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
return 0;
}
-static inline void cleanup_entry(struct arpt_entry *e)
+static void cleanup_entry(struct arpt_entry *e, struct net *net)
{
struct xt_tgdtor_param par;
struct xt_entry_target *t;
t = arpt_get_target(e);
+ par.net = net;
par.target = t->u.kernel.target;
par.targinfo = t->data;
par.family = NFPROTO_ARP;
@@ -584,7 +585,7 @@ static int translate_table(struct net *net,
xt_entry_foreach(iter, entry0, newinfo->size) {
if (i-- == 0)
break;
- cleanup_entry(iter);
+ cleanup_entry(iter, net);
}
return ret;
}
@@ -927,7 +928,7 @@ static int __do_replace(struct net *net, const char *name,
/* Decrease module usage counts and free resource */
loc_cpu_old_entry = oldinfo->entries;
xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
- cleanup_entry(iter);
+ cleanup_entry(iter, net);
xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters,
@@ -990,7 +991,7 @@ static int do_replace(struct net *net, const void __user *user,
free_newinfo_untrans:
xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
- cleanup_entry(iter);
+ cleanup_entry(iter, net);
free_newinfo:
xt_free_table_info(newinfo);
return ret;
@@ -1287,7 +1288,7 @@ static int compat_do_replace(struct net *net, void __user *user,
free_newinfo_untrans:
xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
- cleanup_entry(iter);
+ cleanup_entry(iter, net);
free_newinfo:
xt_free_table_info(newinfo);
return ret;
@@ -1514,7 +1515,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
return ret;
}
-static void __arpt_unregister_table(struct xt_table *table)
+static void __arpt_unregister_table(struct net *net, struct xt_table *table)
{
struct xt_table_info *private;
void *loc_cpu_entry;
@@ -1526,7 +1527,7 @@ static void __arpt_unregister_table(struct xt_table *table)
/* Decrease module usage counts and free resources */
loc_cpu_entry = private->entries;
xt_entry_foreach(iter, loc_cpu_entry, private->size)
- cleanup_entry(iter);
+ cleanup_entry(iter, net);
if (private->number > private->initial_entries)
module_put(table_owner);
xt_free_table_info(private);
@@ -1566,7 +1567,7 @@ int arpt_register_table(struct net *net,
ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
if (ret != 0) {
- __arpt_unregister_table(new_table);
+ __arpt_unregister_table(net, new_table);
*res = NULL;
}
@@ -1581,7 +1582,7 @@ void arpt_unregister_table(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops)
{
nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
- __arpt_unregister_table(table);
+ __arpt_unregister_table(net, table);
}
/* The built-in targets: standard (NULL) and error. */
--
2.24.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: general protection fault in xt_rateest_put
2020-01-11 18:04 general protection fault in xt_rateest_put syzbot
2020-01-11 20:05 ` Cong Wang
2020-01-11 22:19 ` [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Florian Westphal
@ 2020-01-12 20:13 ` syzbot
2 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2020-01-12 20:13 UTC (permalink / raw)
To: coreteam, davem, edumazet, fw, kadlec, kadlec, linux-kernel,
netdev, netfilter-devel, pablo, syzkaller-bugs, xiyou.wangcong
syzbot has bisected this bug to:
commit 3427b2ab63faccafe774ea997fc2da7faf690c5a
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date: Fri Mar 2 02:58:38 2018 +0000
netfilter: make xt_rateest hash table per net
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=129b9c35e00000
start commit: e69ec487 Merge branch 'for-linus' of git://git.kernel.org/..
git tree: upstream
final crash: https://syzkaller.appspot.com/x/report.txt?x=119b9c35e00000
console output: https://syzkaller.appspot.com/x/log.txt?x=169b9c35e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=18698c0c240ba616
dashboard link: https://syzkaller.appspot.com/bug?extid=91bdd8eece0f6629ec8b
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13dbd58ee00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15eff9e1e00000
Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
Fixes: 3427b2ab63fa ("netfilter: make xt_rateest hash table per net")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
2020-01-11 22:19 ` [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Florian Westphal
@ 2020-01-13 17:51 ` Pablo Neira Ayuso
0 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2020-01-13 17:51 UTC (permalink / raw)
To: Florian Westphal
Cc: netfilter-devel, netdev, syzkaller-bugs, syzbot+91bdd8eece0f6629ec8b
On Sat, Jan 11, 2020 at 11:19:53PM +0100, Florian Westphal wrote:
> An earlier commit (1b789577f655060d98d20e,
> "netfilter: arp_tables: init netns pointer in xt_tgchk_param struct"
> fixed missing net initialization for arptables, but turns out it was
> incomplete. We can get a very similar struct net NULL deref during
> error unwinding:
>
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
> xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
> cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
> translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
> do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
> do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461
>
> Also init the netns pointer in xt_tgdtor_param struct.
Applied.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2020-01-13 17:51 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-11 18:04 general protection fault in xt_rateest_put syzbot
2020-01-11 20:05 ` Cong Wang
2020-01-11 21:13 ` Florian Westphal
2020-01-11 21:34 ` Cong Wang
2020-01-11 22:19 ` [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Florian Westphal
2020-01-13 17:51 ` Pablo Neira Ayuso
2020-01-12 20:13 ` general protection fault in xt_rateest_put syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).