Hi, I've got the following error report while fuzzing the kernel with syzkaller. On commit 926af6273fc683cd98cd0ce7bf0d04a02eed6742. A reproducer and .config are attached. WARNING: CPU: 2 PID: 26582 at net/ipv4/netfilter/nf_nat_l3proto_ipv4.c:261 nf_nat_ipv4_fn+0x7f2/0xa50 net/ipv4/netfilter/nf_nat_l3proto_ipv4.c:261 Kernel panic - not syncing: panic_on_warn set ... CPU: 2 PID: 26582 Comm: syz-executor2 Not tainted 4.10.0-rc7+ #126 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:15 [inline] dump_stack+0x292/0x398 lib/dump_stack.c:51 panic+0x1cb/0x3a9 kernel/panic.c:179 __warn+0x1c4/0x1e0 kernel/panic.c:539 warn_slowpath_null+0x2c/0x40 kernel/panic.c:582 nf_nat_ipv4_fn+0x7f2/0xa50 net/ipv4/netfilter/nf_nat_l3proto_ipv4.c:261 nf_nat_ipv4_local_fn+0x1be/0x6d0 net/ipv4/netfilter/nf_nat_l3proto_ipv4.c:414 iptable_nat_ipv4_local_fn+0x2c/0x40 net/ipv4/netfilter/iptable_nat.c:67 nf_hook_entry_hookfn include/linux/netfilter.h:102 [inline] nf_hook_slow+0xc3/0x290 net/netfilter/core.c:310 nf_hook include/linux/netfilter.h:212 [inline] NF_HOOK include/linux/netfilter.h:255 [inline] raw_send_hdrinc net/ipv4/raw.c:420 [inline] raw_sendmsg+0x2bab/0x38e0 net/ipv4/raw.c:637 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744 sock_sendmsg_nosec net/socket.c:635 [inline] sock_sendmsg+0xca/0x110 net/socket.c:645 sock_write_iter+0x326/0x620 net/socket.c:848 new_sync_write fs/read_write.c:499 [inline] __vfs_write+0x483/0x760 fs/read_write.c:512 vfs_write+0x187/0x530 fs/read_write.c:560 SYSC_write fs/read_write.c:607 [inline] SyS_write+0xfb/0x230 fs/read_write.c:599 entry_SYSCALL_64_fastpath+0x1f/0xc2 RIP: 0033:0x4458b9 RSP: 002b:00007f0e76be1b58 EFLAGS: 00000292 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000004458b9 RDX: 000000000000004f RSI: 0000000020009000 RDI: 0000000000000005 RBP: 00000000006e2fd0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 00000000007080a8 R13: 0000000000000000 R14: 00007f0e76be29c0 R15: 00007f0e76be2700 Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Rebooting in 86400 seconds..
// autogenerated by syzkaller (http://github.com/google/syzkaller) #ifndef __NR_connect #define __NR_connect 42 #endif #ifndef __NR_setsockopt #define __NR_setsockopt 54 #endif #ifndef __NR_write #define __NR_write 1 #endif #ifndef __NR_mmap #define __NR_mmap 9 #endif #ifndef __NR_socket #define __NR_socket 41 #endif #define _GNU_SOURCE #include <sys/ioctl.h> #include <sys/mman.h> #include <sys/mount.h> #include <sys/prctl.h> #include <sys/resource.h> #include <sys/socket.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/time.h> #include <sys/types.h> #include <sys/wait.h> #include <linux/capability.h> #include <linux/if.h> #include <linux/if_tun.h> #include <linux/kvm.h> #include <linux/sched.h> #include <net/if_arp.h> #include <assert.h> #include <dirent.h> #include <errno.h> #include <fcntl.h> #include <grp.h> #include <pthread.h> #include <setjmp.h> #include <signal.h> #include <stdarg.h> #include <stdbool.h> #include <stddef.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> const int kFailStatus = 67; const int kErrorStatus = 68; const int kRetryStatus = 69; __attribute__((noreturn)) void doexit(int status) { volatile unsigned i; syscall(__NR_exit_group, status); for (i = 0;; i++) { } } __attribute__((noreturn)) void fail(const char* msg, ...) { int e = errno; fflush(stdout); va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit(e == ENOMEM ? kRetryStatus : kFailStatus); } __attribute__((noreturn)) void exitf(const char* msg, ...) { int e = errno; fflush(stdout); va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit(kRetryStatus); } static int flag_debug; void debug(const char* msg, ...) { if (!flag_debug) return; va_list args; va_start(args, msg); vfprintf(stdout, msg, args); va_end(args); fflush(stdout); } __thread int skip_segv; __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* uctx) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { debug("SIGSEGV on %p, skipping\n", addr); _longjmp(segv_env, 1); } debug("SIGSEGV on %p, exiting\n", addr); doexit(sig); for (;;) { } } static void install_segv_handler() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7, uintptr_t a8) { switch (nr) { default: return syscall(nr, a0, a1, a2, a3, a4, a5); } } static void setup_main_process() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); install_segv_handler(); char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) fail("failed to mkdtemp"); if (chmod(tmpdir, 0777)) fail("failed to chmod"); if (chdir(tmpdir)) fail("failed to chdir"); } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); setsid(); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); unshare(CLONE_NEWNS); unshare(CLONE_NEWIPC); unshare(CLONE_IO); } static int do_sandbox_none(int executor_pid, bool enable_tun) { int pid = fork(); if (pid) return pid; sandbox_common(); loop(); doexit(1); } long r[20]; void loop() { memset(r, -1, sizeof(r)); r[0] = execute_syscall(__NR_mmap, 0x20000000ul, 0xa000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0); r[1] = execute_syscall(__NR_socket, 0x2ul, 0x3ul, 0x1ul, 0, 0, 0, 0, 0, 0); NONFAILING(*(uint16_t*)0x20003000 = (uint16_t)0x2); NONFAILING(*(uint16_t*)0x20003002 = (uint16_t)0x204e); NONFAILING(*(uint32_t*)0x20003004 = (uint32_t)0x100007f); NONFAILING(*(uint8_t*)0x20003008 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x20003009 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000300a = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000300b = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000300c = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000300d = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000300e = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000300f = (uint8_t)0x0); r[13] = execute_syscall(__NR_connect, r[1], 0x20003000ul, 0x10ul, 0, 0, 0, 0, 0, 0); NONFAILING(*(uint32_t*)0x20002ffc = (uint32_t)0xf28); r[15] = execute_syscall(__NR_setsockopt, r[1], 0x0ul, 0x3ul, 0x20002ffcul, 0x4ul, 0, 0, 0, 0); NONFAILING(*(uint32_t*)0x20007000 = (uint32_t)0x7fffffff); r[17] = execute_syscall(__NR_setsockopt, r[1], 0x0ul, 0x16ul, 0x20007000ul, 0x4ul, 0, 0, 0, 0); NONFAILING(memcpy( (void*)0x20009000, "\x7e\x50\x9c\x60\x97\x35\x23\x9e\xff\xe5\x55\xac\x59\xde\x74\x9e" "\x9b\xae\xbd\x30\xdb\xc5\x81\x8f\x02\x7b\xb4\xee\x1e\xc8\x4e\xee" "\xe6\x1b\x9b\x12\x77\x5f\x19\xf5\xb4\xf6\x0d\x46\x70\x86\xaf\x08" "\x88\x89\x9f\x52\x17\x64\x60\x98\x2b\x4d\x52\x5a\x44\x17\x92\xcd" "\xb1\x09\xa5\xf6\xb9\x4a\x06\x03\xf8\x73\xf4\x64\x31\x14\x8b", 79)); r[19] = execute_syscall(__NR_write, r[1], 0x20009000ul, 0x4ful, 0, 0, 0, 0, 0, 0); } int main() { setup_main_process(); int pid = do_sandbox_none(0, false); int status = 0; while (waitpid(pid, &status, __WALL) != pid) { } return 0; }
Attachment:
.config
Description: Binary data
