general protection fault in nf_tables_set_lookup

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 1b37d68f ANDROID: Fix massive cpufreq_times memory leaks
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=12b1b368400000
kernel config: https://syzkaller.appspot.com/x/.config?x=36e4962c7a9b82b1
dashboard link: https://syzkaller.appspot.com/bug?extid=7a97fc2d68bea69ccae9
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15961658400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=141931c2400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7a97fc...@syzkaller.appspotmail.com

random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy
available)
random: sshd: uninitialized urandom read (32 bytes read, 123 bits of
entropy available)
random: sshd: uninitialized urandom read (32 bytes read, 126 bits of
entropy available)
random: nonblocking pool is initialized
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral
protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3759 Comm: syz-executor692 Not tainted 4.4.141-g1b37d68 #71
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8801d06ce000 task.stack: ffff8801d9528000
RIP: 0010:[<ffffffff8314e7ac>] [<ffffffff8314e7ac>]
nf_tables_set_lookup+0x3c/0xc0 net/netfilter/nf_tables_api.c:2380
RSP: 0018:ffff8801d952f598 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffffffffffea RCX: 1ffff1003b2a5ecd
RDX: 0000000000000004 RSI: ffffffff8314e797 RDI: 0000000000000000
RBP: ffff8801d952f5b8 R08: ffff8801d952f6f8 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000020
R13: ffff8801cfae0794 R14: 0000000000000000 R15: ffff8801d952f6f8
FS: 00000000012d8880(0063) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000040 CR3: 00000001d2266000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
1ffff1003b2a5ebb ffff8801ccaa2780 ffff8801cfae0780 ffff8801d952f6b8
ffff8801d952f6e0 ffffffff8314fda9 ffff8801d952f658 ffff8800b6fce600
0000000041b58ab3 ffffffff8423ef33 ffffffff8314fc00 ffffffff838bb724
Call Trace:
[<ffffffff8314fda9>] nf_tables_getset+0x1a9/0x510
net/netfilter/nf_tables_api.c:2653
[<ffffffff830c95d9>] nfnetlink_rcv_msg+0xa19/0xc00
net/netfilter/nfnetlink.c:215
[<ffffffff830ba775>] netlink_rcv_skb+0x145/0x370
net/netlink/af_netlink.c:2354
[<ffffffff830c8253>] nfnetlink_rcv+0x983/0x10a0
net/netfilter/nfnetlink.c:479
[<ffffffff830b9329>] netlink_unicast_kernel net/netlink/af_netlink.c:1270
[inline]
[<ffffffff830b9329>] netlink_unicast+0x4e9/0x700
net/netlink/af_netlink.c:1296
[<ffffffff830b9cd5>] netlink_sendmsg+0x795/0xc30
net/netlink/af_netlink.c:1852
[<ffffffff82f1e2fc>] sock_sendmsg_nosec net/socket.c:625 [inline]
[<ffffffff82f1e2fc>] sock_sendmsg+0xcc/0x110 net/socket.c:635
[<ffffffff82f1fdc5>] ___sys_sendmsg+0x745/0x880 net/socket.c:1962
[<ffffffff82f21e66>] __sys_sendmsg+0xd6/0x190 net/socket.c:1996
[<ffffffff82f21f4d>] SYSC_sendmsg net/socket.c:2007 [inline]
[<ffffffff82f21f4d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2003
[<ffffffff838c2c25>] entry_SYSCALL_64_fastpath+0x22/0x9e
Code: 48 c7 c3 ea ff ff ff e8 93 2d 20 fe 4d 85 ed 74 65 e8 89 2d 20 fe 4d
8d 66 20 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00
75 69 49 8b 5e 20 49 be 00 00 00 00 00 fc ff df 4c
RIP [<ffffffff8314e7ac>] nf_tables_set_lookup+0x3c/0xc0
net/netfilter/nf_tables_api.c:2380
RSP <ffff8801d952f598>
---[ end trace 6f8bf978fb5f3cc1 ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches