general protection fault in ipt_do_table

[syzbot]

Hello,

syzbot hit the following crash on net-next commit
9a61df9e5f7471fe5be3e02bd0bed726b2761a54 (Sat Feb 10 03:32:41 2018 +0000)
Merge tag 'kbuild-v4.16-2' of
git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild

So far this crash happened 2 times on net-next, upstream.
C reproducer is attached.
syzkaller reproducer is attached.
Raw console output is attached.
compiler: gcc (GCC) 7.1.1 20170620
.config is attached.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c914fd...@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4162 Comm: syzkaller652256 Not tainted 4.15.0+ #222
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:ipt_do_table+0x12ee/0x1950 net/ipv4/netfilter/ip_tables.c:334
RSP: 0018:ffff8801db406bd0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8801db3ccf80 RCX: ffffffff84b7013d
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8801db3cce5a
RBP: ffff8801db406dd8 R08: ffff8801db406ed0 R09: 0000000000000002
R10: ffff8801db406d30 R11: 0000000000000020 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8801db3cce00 R15: ffff8801db406d50
FS: 0000000000be1880(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020015cf0 CR3: 00000001d715c004 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
iptable_filter_hook+0x65/0x80 net/ipv4/netfilter/iptable_filter.c:41
nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
nf_hook include/linux/netfilter.h:243 [inline]
NF_HOOK include/linux/netfilter.h:286 [inline]
ip_local_deliver+0x445/0x6e0 net/ipv4/ip_input.c:257
dst_input include/net/dst.h:449 [inline]
ip_rcv_finish+0xa36/0x2040 net/ipv4/ip_input.c:397
NF_HOOK include/linux/netfilter.h:288 [inline]
ip_rcv+0xc5a/0x1840 net/ipv4/ip_input.c:493
__netif_receive_skb_core+0x1a41/0x3460 net/core/dev.c:4547
__netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4612
process_backlog+0x203/0x740 net/core/dev.c:5292
napi_poll net/core/dev.c:5690 [inline]
net_rx_action+0x792/0x1910 net/core/dev.c:5756
__do_softirq+0x2d7/0xb85 kernel/softirq.c:285
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1042
</IRQ>
do_softirq.part.19+0x14d/0x190 kernel/softirq.c:329
do_softirq+0x19/0x20 kernel/softirq.c:332
netif_rx_ni+0xcd/0x3c0 net/core/dev.c:4177
dev_loopback_xmit+0x263/0x670 net/core/dev.c:3305
ip_mc_finish_output+0x36/0x180 net/ipv4/ip_output.c:331
NF_HOOK include/linux/netfilter.h:288 [inline]
ip_mc_output+0x69c/0x1350 net/ipv4/ip_output.c:369
dst_output include/net/dst.h:443 [inline]
ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1414
udp_send_skb+0x666/0xc30 net/ipv4/udp.c:809
udp_sendmsg+0xba0/0x2f70 net/ipv4/udp.c:1044
udpv6_sendmsg+0x757/0x3400 net/ipv6/udp.c:1156
inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:764
sock_sendmsg_nosec net/socket.c:630 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:640
___sys_sendmsg+0x767/0x8b0 net/socket.c:2046
__sys_sendmsg+0xe5/0x210 net/socket.c:2080
SYSC_sendmsg net/socket.c:2091 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2087
do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x445fa9
RSP: 002b:00007ffd470de438 EFLAGS: 00000217 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000445fa9
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005
RBP: 00000000004a7bcc R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000217 R12: 00000000004031a0
R13: 0000000000403230 R14: 0000000000000000 R15: 0000000000000000
Code: 46 52 02 75 41 e8 33 a9 b9 fc 8b 85 80 fe ff ff 8d 70 01 89 b5 00 ff
ff ff 48 8b b5 88 fe ff ff 4c 8d 24 c6 4c 89 e0 48 c1 e8 03 <42> 80 3c 28
00 0f 85 e8 01 00 00 8b 85 00 ff ff ff 4d 89 34 24
RIP: ipt_do_table+0x12ee/0x1950 net/ipv4/netfilter/ip_tables.c:334 RSP:
ffff8801db406bd0
---[ end trace 8c31a953ce551874 ]---


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.

[Florian Westphal]

syzbot <syzbot+c914fd...@syzkaller.appspotmail.com> wrote:
> Hello,
>
> syzbot hit the following crash on net-next commit
> 9a61df9e5f7471fe5be3e02bd0bed726b2761a54 (Sat Feb 10 03:32:41 2018 +0000)
> Merge tag 'kbuild-v4.16-2' of
> git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
>
> So far this crash happened 2 times on net-next, upstream.
> C reproducer is attached.
> syzkaller reproducer is attached.
> Raw console output is attached.
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached.

#sys-dup: general protection fault in ip6t_do_table

(well, its not strictly a duplicate but ip(6)tables is copypastry
sauce so its bug compatible, the fix I sent for ip6tables report
also fixes ip and arptables.)

[Dmitry Vyukov]

On Mon, Feb 12, 2018 at 5:20 PM, Florian Westphal <f...@strlen.de> wrote:
> syzbot <syzbot+c914fd...@syzkaller.appspotmail.com> wrote:
>> Hello,
>>
>> syzbot hit the following crash on net-next commit
>> 9a61df9e5f7471fe5be3e02bd0bed726b2761a54 (Sat Feb 10 03:32:41 2018 +0000)
>> Merge tag 'kbuild-v4.16-2' of
>> git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
>>
>> So far this crash happened 2 times on net-next, upstream.
>> C reproducer is attached.
>> syzkaller reproducer is attached.
>> Raw console output is attached.
>> compiler: gcc (GCC) 7.1.1 20170620
>> .config is attached.
>
> #sys-dup: general protection fault in ip6t_do_table

this should read as:

#syz dup: general protection fault in ip6t_do_table