general protection fault in nfulnl_recv_config

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 810bdaf1 UPSTREAM: ANDROID: binder: remove waitqueue when ..
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=15535215800000
kernel config: https://syzkaller.appspot.com/x/.config?x=15c551fd51555f48
dashboard link: https://syzkaller.appspot.com/bug?extid=2cd228603e3c98b6fd91
compiler: gcc (GCC) 7.1.1 20170620
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1404e0c5800000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=128c9f25800000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2cd228...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral
protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3701 Comm: syzkaller654406 Not tainted 4.4.115-g810bdaf #9
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8801cf480000 task.stack: ffff8801cba90000
RIP: 0010:[<ffffffff81246c95>] [<ffffffff81246c95>] debug_spin_lock_before
kernel/locking/spinlock_debug.c:83 [inline]
RIP: 0010:[<ffffffff81246c95>] [<ffffffff81246c95>]
do_raw_spin_lock+0x25/0x2c0 kernel/locking/spinlock_debug.c:135
RSP: 0018:ffff8801cba97660 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000010 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000014
RBP: ffff8801cba97688 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff838443e0 R11: 1ffff10039752e9e R12: 0000000000000000
R13: 00000000fffffdf4 R14: 000000000000007d R15: ffff8801cba97728
FS: 000000000228b880(0063) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002023df9c CR3: 00000001cf6ca000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
0000000000000010 0000000000000000 00000000fffffdf4 000000000000007d
ffff8801cba97728 ffff8801cba976a8 ffffffff83773762 ffffffff82fa5269
0000000000000010 ffff8801cba97710 ffffffff82fa5269 ffffffff82fa4cdf
Call Trace:
[<ffffffff83773762>] __raw_spin_lock_bh
include/linux/spinlock_api_smp.h:138 [inline]
[<ffffffff83773762>] _raw_spin_lock_bh+0x42/0x50
kernel/locking/spinlock.c:175
[<ffffffff82fa5269>] spin_lock_bh include/linux/spinlock.h:307 [inline]
[<ffffffff82fa5269>] nfulnl_set_mode net/netfilter/nfnetlink_log.c:250
[inline]
[<ffffffff82fa5269>] nfulnl_recv_config+0x609/0x1430
net/netfilter/nfnetlink_log.c:909
[<ffffffff82f99153>] nfnetlink_rcv_msg+0xa63/0xbc0
net/netfilter/nfnetlink.c:215
[<ffffffff82f8a50e>] netlink_rcv_skb+0x13e/0x370
net/netlink/af_netlink.c:2349
[<ffffffff82f976ce>] nfnetlink_rcv+0x29e/0x1070
net/netfilter/nfnetlink.c:479
[<ffffffff82f89092>] netlink_unicast_kernel net/netlink/af_netlink.c:1267
[inline]
[<ffffffff82f89092>] netlink_unicast+0x522/0x760
net/netlink/af_netlink.c:1293
[<ffffffff82f89bb8>] netlink_sendmsg+0x8e8/0xc50
net/netlink/af_netlink.c:1847
[<ffffffff82deb94a>] sock_sendmsg_nosec net/socket.c:625 [inline]
[<ffffffff82deb94a>] sock_sendmsg+0xca/0x110 net/socket.c:635
[<ffffffff82ded521>] ___sys_sendmsg+0x6c1/0x7c0 net/socket.c:1962
[<ffffffff82def573>] __sys_sendmsg+0xd3/0x190 net/socket.c:1996
[<ffffffff82def65d>] SYSC_sendmsg net/socket.c:2007 [inline]
[<ffffffff82def65d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2003
[<ffffffff8377449f>] entry_SYSCALL_64_fastpath+0x1c/0x98
Code: 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 57 41
56 41 55 41 54 53 48 89 fb 48 83 c7 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02
48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP [<ffffffff81246c95>] debug_spin_lock_before
kernel/locking/spinlock_debug.c:83 [inline]
RIP [<ffffffff81246c95>] do_raw_spin_lock+0x25/0x2c0
kernel/locking/spinlock_debug.c:135
RSP <ffff8801cba97660>
---[ end trace 42fa85ae219459ba ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches