On Fri, Apr 12, 2019 at 10:55:02AM -0700, Zubin Mithra wrote:
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit 8866df9264a34e675b4ee8a151db819b87cce2d3 upstream
Otherwise, we hit a NULL pointer deference since handlers always assume
default timeout policy is passed.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor2'.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9575 Comm: syz-executor1 Not tainted 4.19.0+ #312
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 net/netfilter/nf_conntrack_proto_icmp.c:297
Fixes: c779e849608a ("netfilter: conntrack: remove get_timeout() indirection")
Reported-by: Eric Dumazet <eric.dumazet@xxxxxxxxx>
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Zubin Mithra <zsm@xxxxxxxxxxxx>
---
Notes:
* Syzkaller reported a general protection fault in icmp_timeout_obj_to_nlattri
when fuzzing a 4.19 kernel.
Call Trace:
cttimeout_default_fill_info net/netfilter/nfnetlink_cttimeout.c:424 [inline]
cttimeout_default_get+0x574/0x766 net/netfilter/nfnetlink_cttimeout.c:471
nfnetlink_rcv_msg+0x544/0x5bd net/netfilter/nfnetlink.c:228
netlink_rcv_skb+0x1cf/0x2a1 net/netlink/af_netlink.c:2454
nfnetlink_rcv+0x30f/0x34a net/netfilter/nfnetlink.c:560
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x3c5/0x4c3 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x829/0x88e net/netlink/af_netlink.c:1908
sock_sendmsg_nosec+0x8c/0xad net/socket.c:621
sock_sendmsg+0x4f/0x60 net/socket.c:631
___sys_sendmsg+0x4d6/0x63f net/socket.c:2116
__sys_sendmsg+0xee/0x17b net/socket.c:2154
do_syscall_64+0xf8/0x133 arch/x86/entry/common.c:291
entry_SYSCALL_64_after_hwframe+0x49/0xbe
* This patch resolves the following conflicts when applying to 4.19:
- l3num is not used as an argument for cttimeout_default_fill_info() in 4.19
- nf_icmp_pernet, nf_tcp_pernet, nf_udp_pernet, nf_dccp_pernet,
nf_icmpv6_pernet, nf_sctp_pernet, nf_generic_pernet do not exist in
4.19. Expand the usage of those functions into one-liners.
* Tests run: Chrome OS tryjobs, Syzkaller reproducer
I've queued these 2 patches up. It's very nice to see syzkaller running
on -stable kernels, thanks all!
--
Thanks,
Sasha
