general protection fault in netlink_unicast

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: d08574b6 ANDROID: cuttlefish_defconfig: Enable VIRTIO_INPUT
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=16b8f7bf400000
kernel config: https://syzkaller.appspot.com/x/.config?x=39bc4256ec37590
dashboard link: https://syzkaller.appspot.com/bug?extid=97e8c9fb55c1a6d0b72f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1351dd9b400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16fba9bb400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+97e8c9...@syzkaller.appspotmail.com

audit: type=1400 audit(1546751542.626:6): avc: denied { write } for
pid=2074 comm="syz-executor832"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_netfilter_socket permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral
protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 2074 Comm: syz-executor832 Not tainted 4.4.169+ #2
task: ffff8801d4dbc740 task.stack: ffff8800b68d8000
RIP: 0010:[<ffffffff822ebb0b>] [<ffffffff822ebb0b>]
netlink_getsockbyportid net/netlink/af_netlink.c:1112 [inline]
RIP: 0010:[<ffffffff822ebb0b>] [<ffffffff822ebb0b>]
netlink_unicast+0x1cb/0x700 net/netlink/af_netlink.c:1297
RSP: 0018:ffff8800b68df7b8 EFLAGS: 00010293
RAX: dffffc0000000048 RBX: 0000000000000000 RCX: 0000000000000030
RDX: 0000000000000000 RSI: ffffffff822ebb04 RDI: ffff8801d48fc218
RBP: ffff8800b68df870 R08: 1ffff1003ac78a32 R09: ffffed003ac78a37
R10: ffffed003ac78a36 R11: ffff8801d63c51b7 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff8801d48fc140 R15: 000000000000081a
FS: 0000000001065880(0063) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffebec34b20 CR3: 00000001d5fca000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffff8801d63c5240 0000000000000030 0000000000000240 1ffff10016d1befd
dffffc0000000006 dffffc0000000048 0000000041b58ab3 ffffffff82c9ea90
ffffffff822eb940 ffffffff821f4e2c 0000000000000000 ffff8801d63c5180
Call Trace:
[<ffffffff822ed066>] netlink_ack+0x236/0x4c0 net/netlink/af_netlink.c:2334
[<ffffffff822fc2ed>] nfnetlink_rcv_batch net/netfilter/nfnetlink.c:319
[inline]
[<ffffffff822fc2ed>] nfnetlink_rcv+0xbdd/0x12b0
net/netfilter/nfnetlink.c:477
[<ffffffff822ebe17>] netlink_unicast_kernel net/netlink/af_netlink.c:1277
[inline]
[<ffffffff822ebe17>] netlink_unicast+0x4d7/0x700
net/netlink/af_netlink.c:1303
[<ffffffff822ec866>] netlink_sendmsg+0x6b6/0xc80
net/netlink/af_netlink.c:1859
[<ffffffff821d50de>] sock_sendmsg_nosec net/socket.c:638 [inline]
[<ffffffff821d50de>] sock_sendmsg+0xbe/0x110 net/socket.c:648
[<ffffffff821d6fb9>] ___sys_sendmsg+0x769/0x890 net/socket.c:1975
[<ffffffff821d9e15>] __sys_sendmsg+0xc5/0x160 net/socket.c:2009
[<ffffffff821d9edd>] SYSC_sendmsg net/socket.c:2020 [inline]
[<ffffffff821d9edd>] SyS_sendmsg+0x2d/0x50 net/socket.c:2016
[<ffffffff827153a1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Code: 1c d9 01 ff 48 8d 55 98 48 89 d9 4c 89 f6 4c 89 e7 e8 fa f6 ff ff 83
f8 01 0f 85 e6 03 00 00 e8 fc d8 01 ff 48 8b 85 70 ff ff ff <0f> b6 00 84
c0 74 08 3c 03 0f 8e 16 04 00 00 48 8b 85 68 ff ff
RIP [<ffffffff822ebb0b>] netlink_getsockbyportid
net/netlink/af_netlink.c:1112 [inline]
RIP [<ffffffff822ebb0b>] netlink_unicast+0x1cb/0x700
net/netlink/af_netlink.c:1297
RSP <ffff8800b68df7b8>
---[ end trace 2921284bf1a142cd ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches