Hi,
We would like to report the following bug which has been found by our modified version of syzkaller.
======================================================
description: KASAN: use-after-free Read in __nf_hook_entries_try_shrink
affected file: net/netfilter/core.c
kernel version: 5.8.0-rc4
kernel commit: 0aea6d5c5be33ce94c16f9ab2f64de1f481f424b
git tree: upstream
kernel config: attached
crash reproducer: attached
======================================================
Crash log:
We would like to report the following bug which has been found by our modified version of syzkaller.
======================================================
description: KASAN: use-after-free Read in __nf_hook_entries_try_shrink
affected file: net/netfilter/core.c
kernel version: 5.8.0-rc4
kernel commit: 0aea6d5c5be33ce94c16f9ab2f64de1f481f424b
git tree: upstream
kernel config: attached
crash reproducer: attached
======================================================
Crash log:
BUG: KASAN: use-after-free in hooks_validate net/netfilter/core.c:177 [inline]
BUG: KASAN: use-after-free in __nf_hook_entries_try_shrink+0x3c0/0x470 net/netfilter/core.c:260
Read of size 4 at addr ffff888067fe4220 by task kworker/u4:2/126
CPU: 1 PID: 126 Comm: kworker/u4:2 Tainted: G W 5.8.0-rc4+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x18d/0x278 lib/dump_stack.c:118
print_address_description+0x6c/0x5b0 mm/kasan/report.c:383
__kasan_report mm/kasan/report.c:513 [inline]
kasan_report+0x129/0x1b0 mm/kasan/report.c:530
check_memory_region_inline mm/kasan/generic.c:183 [inline]
__asan_load4+0x80/0x90 mm/kasan/generic.c:251
hooks_validate net/netfilter/core.c:177 [inline]
__nf_hook_entries_try_shrink+0x3c0/0x470 net/netfilter/core.c:260
nf_hook_entries_delete_raw+0xd0/0x140 net/netfilter/core.c:443
nf_nat_unregister_fn+0x15d/0x260 net/netfilter/nf_nat_core.c:1121
nf_nat_ipv4_unregister_fn+0x2f/0x40 net/netfilter/nf_nat_proto.c:776
ipt_nat_unregister_lookups net/ipv4/netfilter/iptable_nat.c:85 [inline]
iptable_nat_net_pre_exit+0x37/0x70 net/ipv4/netfilter/iptable_nat.c:119
ops_pre_exit_list net/core/net_namespace.c:176 [inline]
cleanup_net+0x405/0x810 net/core/net_namespace.c:591
process_one_work+0x4d4/0x9d0 kernel/workqueue.c:2269
worker_thread+0x687/0xc00 kernel/workqueue.c:2415
kthread+0x24c/0x270 kernel/kthread.c:291
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
Allocated by task 6282:
save_stack mm/kasan/common.c:48 [inline]
set_track mm/kasan/common.c:56 [inline]
__kasan_kmalloc+0x111/0x140 mm/kasan/common.c:494
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:508
kmem_cache_alloc_trace+0x201/0x320 mm/slab.c:3551
kmalloc include/linux/slab.h:555 [inline]
kzalloc include/linux/slab.h:669 [inline]
nf_tables_addchain net/netfilter/nf_tables_api.c:1933 [inline]
nf_tables_newchain+0x94f/0x21c0 net/netfilter/nf_tables_api.c:2237
nfnetlink_rcv_batch net/netfilter/nfnetlink.c:434 [inline]
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:544 [inline]
nfnetlink_rcv+0xaad/0x1350 net/netfilter/nfnetlink.c:562
netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
netlink_unicast+0x506/0x5e0 net/netlink/af_netlink.c:1329
netlink_sendmsg+0x73e/0x810 net/netlink/af_netlink.c:1918
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg net/socket.c:672 [inline]
____sys_sendmsg+0x343/0x4c0 net/socket.c:2352
___sys_sendmsg net/socket.c:2406 [inline]
__sys_sendmsg+0x205/0x290 net/socket.c:2439
__do_sys_sendmsg net/socket.c:2448 [inline]
__se_sys_sendmsg net/socket.c:2446 [inline]
__x64_sys_sendmsg+0x47/0x50 net/socket.c:2446
do_syscall_64+0x77/0xe0 arch/x86/entry/common.c:384
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 2604:
save_stack mm/kasan/common.c:48 [inline]
set_track mm/kasan/common.c:56 [inline]
kasan_set_free_info mm/kasan/common.c:316 [inline]
__kasan_slab_free+0x11f/0x170 mm/kasan/common.c:455
kasan_slab_free+0xe/0x10 mm/kasan/common.c:464
__cache_free mm/slab.c:3426 [inline]
kfree+0x11e/0x230 mm/slab.c:3757
nf_tables_chain_destroy+0x286/0x2b0 net/netfilter/nf_tables_api.c:1643
nft_commit_release net/netfilter/nf_tables_api.c:7256 [inline]
nf_tables_trans_destroy_work+0x4d0/0x910 net/netfilter/nf_tables_api.c:7302
process_one_work+0x4d4/0x9d0 kernel/workqueue.c:2269
worker_thread+0x687/0xc00 kernel/workqueue.c:2415
kthread+0x24c/0x270 kernel/kthread.c:291
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
The buggy address belongs to the object at ffff888067fe4200
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 32 bytes inside of
256-byte region [ffff888067fe4200, ffff888067fe4300)
The buggy address belongs to the page:
page:ffffea00019ff900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea00015dcdc8 ffff88806c001650 ffff88806c0008c0
raw: 0000000000000000 ffff888067fe4000 0000000100000008 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888067fe4100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888067fe4180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888067fe4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888067fe4280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888067fe4300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
BUG: KASAN: use-after-free in __nf_hook_entries_try_shrink+0x3c0/0x470 net/netfilter/core.c:260
Read of size 4 at addr ffff888067fe4220 by task kworker/u4:2/126
CPU: 1 PID: 126 Comm: kworker/u4:2 Tainted: G W 5.8.0-rc4+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x18d/0x278 lib/dump_stack.c:118
print_address_description+0x6c/0x5b0 mm/kasan/report.c:383
__kasan_report mm/kasan/report.c:513 [inline]
kasan_report+0x129/0x1b0 mm/kasan/report.c:530
check_memory_region_inline mm/kasan/generic.c:183 [inline]
__asan_load4+0x80/0x90 mm/kasan/generic.c:251
hooks_validate net/netfilter/core.c:177 [inline]
__nf_hook_entries_try_shrink+0x3c0/0x470 net/netfilter/core.c:260
nf_hook_entries_delete_raw+0xd0/0x140 net/netfilter/core.c:443
nf_nat_unregister_fn+0x15d/0x260 net/netfilter/nf_nat_core.c:1121
nf_nat_ipv4_unregister_fn+0x2f/0x40 net/netfilter/nf_nat_proto.c:776
ipt_nat_unregister_lookups net/ipv4/netfilter/iptable_nat.c:85 [inline]
iptable_nat_net_pre_exit+0x37/0x70 net/ipv4/netfilter/iptable_nat.c:119
ops_pre_exit_list net/core/net_namespace.c:176 [inline]
cleanup_net+0x405/0x810 net/core/net_namespace.c:591
process_one_work+0x4d4/0x9d0 kernel/workqueue.c:2269
worker_thread+0x687/0xc00 kernel/workqueue.c:2415
kthread+0x24c/0x270 kernel/kthread.c:291
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
Allocated by task 6282:
save_stack mm/kasan/common.c:48 [inline]
set_track mm/kasan/common.c:56 [inline]
__kasan_kmalloc+0x111/0x140 mm/kasan/common.c:494
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:508
kmem_cache_alloc_trace+0x201/0x320 mm/slab.c:3551
kmalloc include/linux/slab.h:555 [inline]
kzalloc include/linux/slab.h:669 [inline]
nf_tables_addchain net/netfilter/nf_tables_api.c:1933 [inline]
nf_tables_newchain+0x94f/0x21c0 net/netfilter/nf_tables_api.c:2237
nfnetlink_rcv_batch net/netfilter/nfnetlink.c:434 [inline]
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:544 [inline]
nfnetlink_rcv+0xaad/0x1350 net/netfilter/nfnetlink.c:562
netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
netlink_unicast+0x506/0x5e0 net/netlink/af_netlink.c:1329
netlink_sendmsg+0x73e/0x810 net/netlink/af_netlink.c:1918
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg net/socket.c:672 [inline]
____sys_sendmsg+0x343/0x4c0 net/socket.c:2352
___sys_sendmsg net/socket.c:2406 [inline]
__sys_sendmsg+0x205/0x290 net/socket.c:2439
__do_sys_sendmsg net/socket.c:2448 [inline]
__se_sys_sendmsg net/socket.c:2446 [inline]
__x64_sys_sendmsg+0x47/0x50 net/socket.c:2446
do_syscall_64+0x77/0xe0 arch/x86/entry/common.c:384
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 2604:
save_stack mm/kasan/common.c:48 [inline]
set_track mm/kasan/common.c:56 [inline]
kasan_set_free_info mm/kasan/common.c:316 [inline]
__kasan_slab_free+0x11f/0x170 mm/kasan/common.c:455
kasan_slab_free+0xe/0x10 mm/kasan/common.c:464
__cache_free mm/slab.c:3426 [inline]
kfree+0x11e/0x230 mm/slab.c:3757
nf_tables_chain_destroy+0x286/0x2b0 net/netfilter/nf_tables_api.c:1643
nft_commit_release net/netfilter/nf_tables_api.c:7256 [inline]
nf_tables_trans_destroy_work+0x4d0/0x910 net/netfilter/nf_tables_api.c:7302
process_one_work+0x4d4/0x9d0 kernel/workqueue.c:2269
worker_thread+0x687/0xc00 kernel/workqueue.c:2415
kthread+0x24c/0x270 kernel/kthread.c:291
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
The buggy address belongs to the object at ffff888067fe4200
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 32 bytes inside of
256-byte region [ffff888067fe4200, ffff888067fe4300)
The buggy address belongs to the page:
page:ffffea00019ff900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea00015dcdc8 ffff88806c001650 ffff88806c0008c0
raw: 0000000000000000 ffff888067fe4000 0000000100000008 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888067fe4100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888067fe4180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888067fe4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888067fe4280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888067fe4300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
======================================================
Wishing you a nice day!
Best regards,
Ditto
Best regards,
Ditto
Attachment:
fuzz_config
Description: Binary data
Attachment:
repro.prog
Description: Binary data
