From: Zubin Mithra <zsm@chromium.org>
To: stable@vger.kernel.org
Cc: groeck@chromium.org, gregkh@linuxfoundation.org,
chamaken@gmail.com, pablo@netfilter.org,
kadlec@blackhole.kfki.hu, fw@strlen.de, davem@davemloft.net
Subject: eb075954e9fd ("netfilter: nfnetlink_log: just returns error for unknown command")
Date: Tue, 12 Mar 2019 13:28:40 -0700 [thread overview]
Message-ID: <20190312202838.GA107600@google.com> (raw)
Hello,
Syzkaller has triggered a GPF when fuzzing a 4.4 kernel with the following stacktrace.
Call Trace:
[<ffffffff811f5b95>] lock_acquire+0x155/0x450 kernel/locking/lockdep.c:3592
[<ffffffff82a15eaf>] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:137 [inline]
[<ffffffff82a15eaf>] _raw_spin_lock_bh+0x3f/0x50 kernel/locking/spinlock.c:175
[<ffffffff823acc92>] spin_lock_bh include/linux/spinlock.h:307 [inline]
[<ffffffff823acc92>] nfulnl_set_mode net/netfilter/nfnetlink_log.c:250 [inline]
[<ffffffff823acc92>] nfulnl_recv_config+0x612/0x1440 net/netfilter/nfnetlink_log.c:909
[<ffffffff8239ce39>] nfnetlink_rcv_msg+0xa59/0xbc0 net/netfilter/nfnetlink.c:215
[<ffffffff8238c249>] netlink_rcv_skb+0x149/0x380 net/netlink/af_netlink.c:2349
[<ffffffff8239b2ac>] nfnetlink_rcv+0x2ac/0x1190 net/netfilter/nfnetlink.c:479
[<ffffffff8238adee>] netlink_unicast_kernel net/netlink/af_netlink.c:1267 [inline]
[<ffffffff8238adee>] netlink_unicast+0x51e/0x760 net/netlink/af_netlink.c:1293
[<ffffffff8238b8f5>] netlink_sendmsg+0x8c5/0xc20 net/netlink/af_netlink.c:1847
[<ffffffff821fcb2f>] sock_sendmsg_nosec net/socket.c:625 [inline]
[<ffffffff821fcb2f>] sock_sendmsg+0xcf/0x110 net/socket.c:635
[<ffffffff821fe7a3>] ___sys_sendmsg+0x733/0x840 net/socket.c:1962
[<ffffffff822007f0>] __sys_sendmsg+0xd0/0x180 net/socket.c:1996
[<ffffffff822008d2>] SYSC_sendmsg net/socket.c:2007 [inline]
[<ffffffff822008d2>] SyS_sendmsg+0x32/0x50 net/socket.c:2003
[<ffffffff82a16b1b>] entry_SYSCALL_64_fastpath+0x18/0x94
Code: c7 44 18 10 00 00 00 00 48 8d 65 d8 44 89 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 c6 36 00 00 49 81 3e 20 ea 88 83 41 ba 00 00
RIP [<ffffffff811ef8ed>] __lock_acquire+0x5bd/0x4eb0 kernel/locking/lockdep.c:3092
Could the following patch be applied to v4.4.y? This patch is present in v4.9.y.
* eb075954e9fd ("netfilter: nfnetlink_log: just returns error for unknown command")
Tests run:
* Chrome OS tryjobs
* Syzkaller reproducer
Thanks,
- Zubin
next reply other threads:[~2019-03-12 20:28 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-12 20:28 Zubin Mithra [this message]
2019-03-12 21:01 ` eb075954e9fd ("netfilter: nfnetlink_log: just returns error for unknown command") Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190312202838.GA107600@google.com \
--to=zsm@chromium.org \
--cc=chamaken@gmail.com \
--cc=davem@davemloft.net \
--cc=fw@strlen.de \
--cc=gregkh@linuxfoundation.org \
--cc=groeck@chromium.org \
--cc=kadlec@blackhole.kfki.hu \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox