KASAN: use-after-free Read in nla_parse

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11c8d22e480000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=7171a7691345323537a5
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7171a7...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in nla_ok include/net/netlink.h:717 [inline]
BUG: KASAN: use-after-free in nla_parse+0x1f8/0x290 lib/nlattr.c:249
Read of size 2 at addr ffff88809d262d8c by task syz-executor.2/21808

CPU: 0 PID: 21808 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load2_noabort+0x88/0x90 mm/kasan/report.c:431
nla_ok include/net/netlink.h:717 [inline]
nla_parse+0x1f8/0x290 lib/nlattr.c:249
dump_init net/netfilter/ipset/ip_set_core.c:1294 [inline]
ip_set_dump_start+0xeef/0x1ee0 net/netfilter/ipset/ip_set_core.c:1335
netlink_dump+0x3cf/0xc10 net/netlink/af_netlink.c:2242
netlink_recvmsg+0xa56/0xea0 net/netlink/af_netlink.c:2000
sock_recvmsg_nosec net/socket.c:859 [inline]
sock_recvmsg net/socket.c:866 [inline]
sock_recvmsg net/socket.c:862 [inline]
__sys_recvfrom+0x249/0x3a0 net/socket.c:1956
__do_sys_recvfrom net/socket.c:1974 [inline]
__se_sys_recvfrom net/socket.c:1970 [inline]
__x64_sys_recvfrom+0xdd/0x1b0 net/socket.c:1970
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5f52187034
Code: 89 4c 24 1c e8 bd fb ff ff 44 8b 54 24 1c 8b 3c 24 45 31 c9 89 c5 48 8b 54 24 10 48 8b 74 24 08 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 04 24 e8 e9 fb ff ff 48 8b 04
RSP: 002b:00007f5f50725010 EFLAGS: 00000246 ORIG_RAX: 000000000000002d
RAX: ffffffffffffffda RBX: 00007f5f507250f0 RCX: 00007f5f52187034
RDX: 0000000000001000 RSI: 00007f5f50725140 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5f507250a8
R13: 00007f5f50725140 R14: 0000000000000004 R15: 0000000000000000

The buggy address belongs to the page:
page:ffffea0002749880 count:0 mapcount:0 mapping:0000000000000000 index:0xffff88809d2622c0
flags: 0xfff00000000000()
raw: 00fff00000000000 dead000000000100 dead000000000200 0000000000000000
raw: ffff88809d2622c0 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff88809d262c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88809d262d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88809d262d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88809d262e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88809d262e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.