From: Zubin Mithra <zsm@chromium.org>
To: stable@vger.kernel.org
Cc: gregkh@google.com, groeck@chromium.org, phil.turnbull@oracle.com,
pablo@netfilter.org, davem@davemloft.net
Subject: eda3fc50daa9 ("netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter")
Date: Tue, 6 Aug 2019 09:32:55 -0700 [thread overview]
Message-ID: <20190806163254.GA176933@google.com> (raw)
Hello,
Syzkaller has triggered a GPF when fuzzing a 4.4 kernel with the following stacktrace.
Call Trace:
[<ffffffff823d9bfe>] nla_get_be64 include/net/netlink.h:1130 [inline]
[<ffffffff823d9bfe>] nfnl_acct_new+0x3ae/0x720 net/netfilter/nfnetlink_acct.c:111
[<ffffffff823d81c7>] nfnetlink_rcv_msg+0xa27/0xc30 net/netfilter/nfnetlink.c:215
[<ffffffff823c7ebf>] netlink_rcv_skb+0xdf/0x2f0 net/netlink/af_netlink.c:2361
[<ffffffff823d6e89>] nfnetlink_rcv+0x939/0x1000 net/netfilter/nfnetlink.c:479
[<ffffffff823c6974>] netlink_unicast_kernel net/netlink/af_netlink.c:1277 [inline]
[<ffffffff823c6974>] netlink_unicast+0x474/0x7c0 net/netlink/af_netlink.c:1303
[<ffffffff823c7461>] netlink_sendmsg+0x7a1/0xc50 net/netlink/af_netlink.c:1859
[<ffffffff82239fe5>] sock_sendmsg_nosec net/socket.c:627 [inline]
[<ffffffff82239fe5>] sock_sendmsg+0xd5/0x110 net/socket.c:637
[<ffffffff8223da67>] ___sys_sendmsg+0x767/0x890 net/socket.c:1964
[<ffffffff822405db>] __sys_sendmsg+0xbb/0x150 net/socket.c:1998
[<ffffffff822406a2>] SYSC_sendmsg net/socket.c:2009 [inline]
[<ffffffff822406a2>] SyS_sendmsg+0x32/0x50 net/socket.c:2005
[<ffffffff82a44e67>] entry_SYSCALL_64_fastpath+0x1e/0xa0
RIP [<ffffffff81d4931c>] nla_memcpy+0x2c/0xa0 lib/nlattr.c:279
Could the following patch be applied in order to v4.4.y? It is present in v4.9.y.
* eda3fc50daa9 ("netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter")
Tests run:
* Syzkaller reproducer
* Chrome OS tryjobs
Thanks,
- Zubin
next reply other threads:[~2019-08-06 16:33 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-06 16:32 Zubin Mithra [this message]
2019-08-06 21:55 ` eda3fc50daa9 ("netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter") Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190806163254.GA176933@google.com \
--to=zsm@chromium.org \
--cc=davem@davemloft.net \
--cc=gregkh@google.com \
--cc=groeck@chromium.org \
--cc=pablo@netfilter.org \
--cc=phil.turnbull@oracle.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).