netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* general protection fault in xt_rateest_put
@ 2020-01-11 18:04 syzbot
  2020-01-11 20:05 ` Cong Wang
                   ` (2 more replies)
  0 siblings, 3 replies; 7+ messages in thread
From: syzbot @ 2020-01-11 18:04 UTC (permalink / raw)
  To: coreteam, davem, fw, kadlec, linux-kernel, netdev,
	netfilter-devel, pablo, syzkaller-bugs

Hello,

syzbot found the following crash on:

HEAD commit:    e69ec487 Merge branch 'for-linus' of git://git.kernel.org/..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1239f876e00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=18698c0c240ba616
dashboard link: https://syzkaller.appspot.com/bug?extid=91bdd8eece0f6629ec8b
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13dbd58ee00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15eff9e1e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 10213 Comm: syz-executor519 Not tainted 5.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:net_generic include/net/netns/generic.h:45 [inline]
RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
Code: 85 87 01 fb 45 84 f6 0f 84 68 02 00 00 e8 37 86 01 fb 49 8d bd 68 13  
00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f  
85 6c 03 00 00 4d 8b b5 68 13 00 00 e8 29 bf ed fa
RSP: 0018:ffffc90001cd7940 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880a779f700 RCX: ffffffff8673a332
RDX: 000000000000026d RSI: ffffffff8673a0b9 RDI: 0000000000001368
RBP: ffffc90001cd7970 R08: ffff8880a96b2240 R09: ffffed1015d0703d
R10: ffffed1015d0703c R11: ffff8880ae8381e3 R12: 000000000000002d
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8673a470
FS:  00000000016ce880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cd48aff140 CR3: 0000000096982000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
  cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
  translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
  do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
  do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461
  nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
  nf_setsockopt+0x77/0xd0 net/netfilter/nf_sockopt.c:115
  ip_setsockopt net/ipv4/ip_sockglue.c:1260 [inline]
  ip_setsockopt+0xdf/0x100 net/ipv4/ip_sockglue.c:1240
  udp_setsockopt+0x68/0xb0 net/ipv4/udp.c:2639
  sock_common_setsockopt+0x94/0xd0 net/core/sock.c:3149
  __sys_setsockopt+0x261/0x4c0 net/socket.c:2117
  __do_sys_setsockopt net/socket.c:2133 [inline]
  __se_sys_setsockopt net/socket.c:2130 [inline]
  __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2130
  do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441699
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7  
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc35157368 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000441699
RDX: 0000000000000060 RSI: 0a02000000000000 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 0000000000000430 R09: 00000000004002c8
R10: 00000000200008c0 R11: 0000000000000246 R12: 0000000000402f20
R13: 0000000000402fb0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace f2341320b9d5ba2d ]---
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:net_generic include/net/netns/generic.h:45 [inline]
RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
Code: 85 87 01 fb 45 84 f6 0f 84 68 02 00 00 e8 37 86 01 fb 49 8d bd 68 13  
00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f  
85 6c 03 00 00 4d 8b b5 68 13 00 00 e8 29 bf ed fa
RSP: 0018:ffffc90001cd7940 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880a779f700 RCX: ffffffff8673a332
RDX: 000000000000026d RSI: ffffffff8673a0b9 RDI: 0000000000001368
RBP: ffffc90001cd7970 R08: ffff8880a96b2240 R09: ffffed1015d0703d
R10: ffffed1015d0703c R11: ffff8880ae8381e3 R12: 000000000000002d
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8673a470
FS:  00000000016ce880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cd48af04c0 CR3: 0000000096982000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: general protection fault in xt_rateest_put
  2020-01-11 18:04 general protection fault in xt_rateest_put syzbot
@ 2020-01-11 20:05 ` Cong Wang
  2020-01-11 21:13   ` Florian Westphal
  2020-01-11 22:19 ` [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Florian Westphal
  2020-01-12 20:13 ` general protection fault in xt_rateest_put syzbot
  2 siblings, 1 reply; 7+ messages in thread
From: Cong Wang @ 2020-01-11 20:05 UTC (permalink / raw)
  To: syzbot
  Cc: coreteam, David Miller, Florian Westphal, Jozsef Kadlecsik, LKML,
	Linux Kernel Network Developers, NetFilter, Pablo Neira Ayuso,
	syzkaller-bugs

On Sat, Jan 11, 2020 at 10:05 AM syzbot
<syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit:    e69ec487 Merge branch 'for-linus' of git://git.kernel.org/..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1239f876e00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=18698c0c240ba616
> dashboard link: https://syzkaller.appspot.com/bug?extid=91bdd8eece0f6629ec8b
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13dbd58ee00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15eff9e1e00000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
>
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> CPU: 0 PID: 10213 Comm: syz-executor519 Not tainted 5.5.0-rc5-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
> RIP: 0010:net_generic include/net/netns/generic.h:45 [inline]
> RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
> Code: 85 87 01 fb 45 84 f6 0f 84 68 02 00 00 e8 37 86 01 fb 49 8d bd 68 13
> 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> 85 6c 03 00 00 4d 8b b5 68 13 00 00 e8 29 bf ed fa
> RSP: 0018:ffffc90001cd7940 EFLAGS: 00010202
> RAX: dffffc0000000000 RBX: ffff8880a779f700 RCX: ffffffff8673a332
> RDX: 000000000000026d RSI: ffffffff8673a0b9 RDI: 0000000000001368
> RBP: ffffc90001cd7970 R08: ffff8880a96b2240 R09: ffffed1015d0703d
> R10: ffffed1015d0703c R11: ffff8880ae8381e3 R12: 000000000000002d
> R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8673a470
> FS:  00000000016ce880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055cd48aff140 CR3: 0000000096982000 CR4: 00000000001406f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
>   xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
>   cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
>   translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
>   do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
>   do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461

This looks odd, the head commit e69ec487 comes after commit
1b789577f655060d98d20ed0c6f9fbd469d6ba63 which is supposed
to fix this...

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: general protection fault in xt_rateest_put
  2020-01-11 20:05 ` Cong Wang
@ 2020-01-11 21:13   ` Florian Westphal
  2020-01-11 21:34     ` Cong Wang
  0 siblings, 1 reply; 7+ messages in thread
From: Florian Westphal @ 2020-01-11 21:13 UTC (permalink / raw)
  To: Cong Wang
  Cc: syzbot, coreteam, David Miller, Florian Westphal,
	Jozsef Kadlecsik, LKML, Linux Kernel Network Developers,
	NetFilter, Pablo Neira Ayuso, syzkaller-bugs

Cong Wang <xiyou.wangcong@gmail.com> wrote:
> On Sat, Jan 11, 2020 at 10:05 AM syzbot
> <syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit:    e69ec487 Merge branch 'for-linus' of git://git.kernel.org/..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1239f876e00000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=18698c0c240ba616
> > dashboard link: https://syzkaller.appspot.com/bug?extid=91bdd8eece0f6629ec8b
> > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13dbd58ee00000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15eff9e1e00000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
> >
> > kasan: CONFIG_KASAN_INLINE enabled
> > kasan: GPF could be caused by NULL-ptr deref or user memory access
> > general protection fault: 0000 [#1] PREEMPT SMP KASAN
> > CPU: 0 PID: 10213 Comm: syz-executor519 Not tainted 5.5.0-rc5-syzkaller #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
> > RIP: 0010:net_generic include/net/netns/generic.h:45 [inline]
> > RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
> > Code: 85 87 01 fb 45 84 f6 0f 84 68 02 00 00 e8 37 86 01 fb 49 8d bd 68 13
> > 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
> > 85 6c 03 00 00 4d 8b b5 68 13 00 00 e8 29 bf ed fa
> > RSP: 0018:ffffc90001cd7940 EFLAGS: 00010202
> > RAX: dffffc0000000000 RBX: ffff8880a779f700 RCX: ffffffff8673a332
> > RDX: 000000000000026d RSI: ffffffff8673a0b9 RDI: 0000000000001368
> > RBP: ffffc90001cd7970 R08: ffff8880a96b2240 R09: ffffed1015d0703d
> > R10: ffffed1015d0703c R11: ffff8880ae8381e3 R12: 000000000000002d
> > R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8673a470
> > FS:  00000000016ce880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 000055cd48aff140 CR3: 0000000096982000 CR4: 00000000001406f0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> >   xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
> >   cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
> >   translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
> >   do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
> >   do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461
> 
> This looks odd, the head commit e69ec487 comes after commit
> 1b789577f655060d98d20ed0c6f9fbd469d6ba63 which is supposed
> to fix this...

The fix is incomplete,  net/ipv4/netfilter/arp_tables.c:cleanup_entry()
doesn't init *net either.

Are you working on a fix already?

Otherwise I can handle this.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: general protection fault in xt_rateest_put
  2020-01-11 21:13   ` Florian Westphal
@ 2020-01-11 21:34     ` Cong Wang
  0 siblings, 0 replies; 7+ messages in thread
From: Cong Wang @ 2020-01-11 21:34 UTC (permalink / raw)
  To: Florian Westphal
  Cc: syzbot, coreteam, David Miller, Jozsef Kadlecsik, LKML,
	Linux Kernel Network Developers, NetFilter, Pablo Neira Ayuso,
	syzkaller-bugs

On Sat, Jan 11, 2020 at 1:13 PM Florian Westphal <fw@strlen.de> wrote:
> The fix is incomplete,  net/ipv4/netfilter/arp_tables.c:cleanup_entry()
> doesn't init *net either.
>
> Are you working on a fix already?
>
> Otherwise I can handle this.

I am not. Please go ahead.

Thanks!

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
  2020-01-11 18:04 general protection fault in xt_rateest_put syzbot
  2020-01-11 20:05 ` Cong Wang
@ 2020-01-11 22:19 ` Florian Westphal
  2020-01-13 17:51   ` Pablo Neira Ayuso
  2020-01-12 20:13 ` general protection fault in xt_rateest_put syzbot
  2 siblings, 1 reply; 7+ messages in thread
From: Florian Westphal @ 2020-01-11 22:19 UTC (permalink / raw)
  To: netfilter-devel
  Cc: netdev, syzkaller-bugs, Florian Westphal, syzbot+91bdd8eece0f6629ec8b

An earlier commit (1b789577f655060d98d20e,
"netfilter: arp_tables: init netns pointer in xt_tgchk_param struct"
fixed missing net initialization for arptables, but turns out it was
incomplete.  We can get a very similar struct net NULL deref during
error unwinding:

general protection fault: 0000 [#1] PREEMPT SMP KASAN
RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
 xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
 cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
 translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
 do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
 do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461

Also init the netns pointer in xt_tgdtor_param struct.

Fixes: add67461240c1d ("netfilter: add struct net * to target parameters")
Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/ipv4/netfilter/arp_tables.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 069f72edb264..f1f78a742b36 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -496,12 +496,13 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
 	return 0;
 }
 
-static inline void cleanup_entry(struct arpt_entry *e)
+static void cleanup_entry(struct arpt_entry *e, struct net *net)
 {
 	struct xt_tgdtor_param par;
 	struct xt_entry_target *t;
 
 	t = arpt_get_target(e);
+	par.net      = net;
 	par.target   = t->u.kernel.target;
 	par.targinfo = t->data;
 	par.family   = NFPROTO_ARP;
@@ -584,7 +585,7 @@ static int translate_table(struct net *net,
 		xt_entry_foreach(iter, entry0, newinfo->size) {
 			if (i-- == 0)
 				break;
-			cleanup_entry(iter);
+			cleanup_entry(iter, net);
 		}
 		return ret;
 	}
@@ -927,7 +928,7 @@ static int __do_replace(struct net *net, const char *name,
 	/* Decrease module usage counts and free resource */
 	loc_cpu_old_entry = oldinfo->entries;
 	xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
-		cleanup_entry(iter);
+		cleanup_entry(iter, net);
 
 	xt_free_table_info(oldinfo);
 	if (copy_to_user(counters_ptr, counters,
@@ -990,7 +991,7 @@ static int do_replace(struct net *net, const void __user *user,
 
  free_newinfo_untrans:
 	xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
-		cleanup_entry(iter);
+		cleanup_entry(iter, net);
  free_newinfo:
 	xt_free_table_info(newinfo);
 	return ret;
@@ -1287,7 +1288,7 @@ static int compat_do_replace(struct net *net, void __user *user,
 
  free_newinfo_untrans:
 	xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
-		cleanup_entry(iter);
+		cleanup_entry(iter, net);
  free_newinfo:
 	xt_free_table_info(newinfo);
 	return ret;
@@ -1514,7 +1515,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
 	return ret;
 }
 
-static void __arpt_unregister_table(struct xt_table *table)
+static void __arpt_unregister_table(struct net *net, struct xt_table *table)
 {
 	struct xt_table_info *private;
 	void *loc_cpu_entry;
@@ -1526,7 +1527,7 @@ static void __arpt_unregister_table(struct xt_table *table)
 	/* Decrease module usage counts and free resources */
 	loc_cpu_entry = private->entries;
 	xt_entry_foreach(iter, loc_cpu_entry, private->size)
-		cleanup_entry(iter);
+		cleanup_entry(iter, net);
 	if (private->number > private->initial_entries)
 		module_put(table_owner);
 	xt_free_table_info(private);
@@ -1566,7 +1567,7 @@ int arpt_register_table(struct net *net,
 
 	ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
 	if (ret != 0) {
-		__arpt_unregister_table(new_table);
+		__arpt_unregister_table(net, new_table);
 		*res = NULL;
 	}
 
@@ -1581,7 +1582,7 @@ void arpt_unregister_table(struct net *net, struct xt_table *table,
 			   const struct nf_hook_ops *ops)
 {
 	nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
-	__arpt_unregister_table(table);
+	__arpt_unregister_table(net, table);
 }
 
 /* The built-in targets: standard (NULL) and error. */
-- 
2.24.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: general protection fault in xt_rateest_put
  2020-01-11 18:04 general protection fault in xt_rateest_put syzbot
  2020-01-11 20:05 ` Cong Wang
  2020-01-11 22:19 ` [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Florian Westphal
@ 2020-01-12 20:13 ` syzbot
  2 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2020-01-12 20:13 UTC (permalink / raw)
  To: coreteam, davem, edumazet, fw, kadlec, kadlec, linux-kernel,
	netdev, netfilter-devel, pablo, syzkaller-bugs, xiyou.wangcong

syzbot has bisected this bug to:

commit 3427b2ab63faccafe774ea997fc2da7faf690c5a
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date:   Fri Mar 2 02:58:38 2018 +0000

     netfilter: make xt_rateest hash table per net

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=129b9c35e00000
start commit:   e69ec487 Merge branch 'for-linus' of git://git.kernel.org/..
git tree:       upstream
final crash:    https://syzkaller.appspot.com/x/report.txt?x=119b9c35e00000
console output: https://syzkaller.appspot.com/x/log.txt?x=169b9c35e00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=18698c0c240ba616
dashboard link: https://syzkaller.appspot.com/bug?extid=91bdd8eece0f6629ec8b
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13dbd58ee00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15eff9e1e00000

Reported-by: syzbot+91bdd8eece0f6629ec8b@syzkaller.appspotmail.com
Fixes: 3427b2ab63fa ("netfilter: make xt_rateest hash table per net")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
  2020-01-11 22:19 ` [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Florian Westphal
@ 2020-01-13 17:51   ` Pablo Neira Ayuso
  0 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2020-01-13 17:51 UTC (permalink / raw)
  To: Florian Westphal
  Cc: netfilter-devel, netdev, syzkaller-bugs, syzbot+91bdd8eece0f6629ec8b

On Sat, Jan 11, 2020 at 11:19:53PM +0100, Florian Westphal wrote:
> An earlier commit (1b789577f655060d98d20e,
> "netfilter: arp_tables: init netns pointer in xt_tgchk_param struct"
> fixed missing net initialization for arptables, but turns out it was
> incomplete.  We can get a very similar struct net NULL deref during
> error unwinding:
> 
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> RIP: 0010:xt_rateest_put+0xa1/0x440 net/netfilter/xt_RATEEST.c:77
>  xt_rateest_tg_destroy+0x72/0xa0 net/netfilter/xt_RATEEST.c:175
>  cleanup_entry net/ipv4/netfilter/arp_tables.c:509 [inline]
>  translate_table+0x11f4/0x1d80 net/ipv4/netfilter/arp_tables.c:587
>  do_replace net/ipv4/netfilter/arp_tables.c:981 [inline]
>  do_arpt_set_ctl+0x317/0x650 net/ipv4/netfilter/arp_tables.c:1461
> 
> Also init the netns pointer in xt_tgdtor_param struct.

Applied.

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2020-01-13 17:51 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-11 18:04 general protection fault in xt_rateest_put syzbot
2020-01-11 20:05 ` Cong Wang
2020-01-11 21:13   ` Florian Westphal
2020-01-11 21:34     ` Cong Wang
2020-01-11 22:19 ` [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Florian Westphal
2020-01-13 17:51   ` Pablo Neira Ayuso
2020-01-12 20:13 ` general protection fault in xt_rateest_put syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).