On Tue, Mar 12, 2019 at 01:28:40PM -0700, Zubin Mithra wrote:

Hello,

Syzkaller has triggered a GPF when fuzzing a 4.4 kernel with the following stacktrace. Call Trace: [<ffffffff811f5b95>] lock_acquire+0x155/0x450 kernel/locking/lockdep.c:3592 [<ffffffff82a15eaf>] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:137 [inline] [<ffffffff82a15eaf>] _raw_spin_lock_bh+0x3f/0x50 kernel/locking/spinlock.c:175 [<ffffffff823acc92>] spin_lock_bh include/linux/spinlock.h:307 [inline] [<ffffffff823acc92>] nfulnl_set_mode net/netfilter/nfnetlink_log.c:250 [inline] [<ffffffff823acc92>] nfulnl_recv_config+0x612/0x1440 net/netfilter/nfnetlink_log.c:909 [<ffffffff8239ce39>] nfnetlink_rcv_msg+0xa59/0xbc0 net/netfilter/nfnetlink.c:215 [<ffffffff8238c249>] netlink_rcv_skb+0x149/0x380 net/netlink/af_netlink.c:2349 [<ffffffff8239b2ac>] nfnetlink_rcv+0x2ac/0x1190 net/netfilter/nfnetlink.c:479 [<ffffffff8238adee>] netlink_unicast_kernel net/netlink/af_netlink.c:1267 [inline] [<ffffffff8238adee>] netlink_unicast+0x51e/0x760 net/netlink/af_netlink.c:1293 [<ffffffff8238b8f5>] netlink_sendmsg+0x8c5/0xc20 net/netlink/af_netlink.c:1847 [<ffffffff821fcb2f>] sock_sendmsg_nosec net/socket.c:625 [inline] [<ffffffff821fcb2f>] sock_sendmsg+0xcf/0x110 net/socket.c:635 [<ffffffff821fe7a3>] ___sys_sendmsg+0x733/0x840 net/socket.c:1962 [<ffffffff822007f0>] __sys_sendmsg+0xd0/0x180 net/socket.c:1996 [<ffffffff822008d2>] SYSC_sendmsg net/socket.c:2007 [inline] [<ffffffff822008d2>] SyS_sendmsg+0x32/0x50 net/socket.c:2003 [<ffffffff82a16b1b>] entry_SYSCALL_64_fastpath+0x18/0x94 Code: c7 44 18 10 00 00 00 00 48 8d 65 d8 44 89 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 c6 36 00 00 49 81 3e 20 ea 88 83 41 ba 00 00 RIP [<ffffffff811ef8ed>] __lock_acquire+0x5bd/0x4eb0 kernel/locking/lockdep.c:3092

Could the following patch be applied to v4.4.y? This patch is present in v4.9.y.

• eb075954e9fd ("netfilter: nfnetlink_log: just returns error for unknown command")

Tests run:

• Chrome OS tryjobs
• Syzkaller reproducer

Now applied, thanks.

greg k-h