net: GPF in netlink_getsockbyportid

[Dmitry Vyukov]

Hello,

The following program causes GPF in netlink_getsockbyportid:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <pthread.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

int main()
{
  syscall(SYS_mmap, 0x20000000ul, 0xe65000ul, 0x3ul, 0x32ul,
                 0xfffffffffffffffful, 0x0ul);
  int fd = syscall(SYS_socket, 0x10ul, 0x803ul, 0xcul, 0, 0, 0);
  *(uint32_t*)0x20e64000 = (uint32_t)0x28;
  *(uint32_t*)0x20e64004 = (uint32_t)0x10;
  *(uint64_t*)0x20e64008 = (uint64_t)0x0;
  *(uint64_t*)0x20e64010 = (uint64_t)0x3;
  *(uint64_t*)0x20e64018 = (uint64_t)0xfff;
  *(uint16_t*)0x20e64020 = (uint16_t)0x5;
  syscall(SYS_write, fd, 0x20e64000ul, 0x28ul, 0, 0, 0);
  return 0;
}


kasan: GPF could be caused by NULL-ptr deref or user memory
accessgeneral protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
Modules linked in:
CPU: 1 PID: 7519 Comm: syz-executor Not tainted 4.4.0+ #276
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff8800625e17c0 ti: ffff880062b50000 task.ti: ffff880062b50000
RIP: 0010:[<ffffffff8536b150>]  [<ffffffff8536b150>]
netlink_getsockbyportid+0x30/0x1b0
RSP: 0018:ffff880062b57818  EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000002 RCX: 0000000000000002
RDX: 0000000000000048 RSI: 0000000000000002 RDI: 0000000000000240
RBP: ffff880062b57838 R08: 00000000024000c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 00000000024000c0 R14: 0000000000000000 R15: 0000000000000002
FS:  00007fe4328d7700(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007fff7c3ecd80 CR3: 000000003b0b3000 CR4: 00000000000006e0
Stack:
 ffff880062b578d0 0000000000000000 000000000000003c 00000000024000c0
 ffff880062b578b8 ffffffff8536b300 00000000000000e0 ffffffff8175fe26
 ffff8800625e1fe0 7379736275732d6b 000000000000302d ffffffff8764d868
Call Trace:
 [<ffffffff8536b300>] __netlink_alloc_skb+0x30/0x790
net/netlink/af_netlink.c:1890
 [<     inline     >] netlink_alloc_skb include/linux/netlink.h:79
 [<ffffffff853761a3>] netlink_ack+0x153/0x520 net/netlink/af_netlink.c:2968
 [<     inline     >] nfnetlink_rcv_batch net/netfilter/nfnetlink.c:321
 [<ffffffff8538425d>] nfnetlink_rcv+0xbad/0x10a0 net/netfilter/nfnetlink.c:477
 [<     inline     >] netlink_unicast_kernel net/netlink/af_netlink.c:1834
 [<ffffffff8537466a>] netlink_unicast+0x47a/0x700 net/netlink/af_netlink.c:1860
 [<ffffffff85375976>] netlink_sendmsg+0x1086/0x1760
net/netlink/af_netlink.c:2511
 [<     inline     >] sock_sendmsg_nosec net/socket.c:611
 [<ffffffff851cc94a>] sock_sendmsg+0xca/0x110 net/socket.c:621
 [<ffffffff851ccba6>] sock_write_iter+0x216/0x3a0 net/socket.c:820
 [<     inline     >] new_sync_write fs/read_write.c:517
 [<ffffffff817b0512>] __vfs_write+0x302/0x480 fs/read_write.c:530
 [<ffffffff817b1db7>] vfs_write+0x167/0x4a0 fs/read_write.c:577
 [<     inline     >] SYSC_write fs/read_write.c:624
 [<ffffffff817b50a1>] SyS_write+0x111/0x220 fs/read_write.c:616
 [<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
Code: 55 41 54 53 49 89 fc 89 f3 48 83 ec 08 e8 39 b7 20 fc 49 8d bc
24 40 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f>
b6 04 02 84 c0 74 08 3c 03 0f 8e 30 01 00 00 49 8d 7c 24 30
RIP  [<ffffffff8536b150>] netlink_getsockbyportid+0x30/0x1b0
net/netlink/af_netlink.c:1658
 RSP <ffff880062b57818>
---[ end trace f4ac9332ef80a14f ]---

On commit 30f05309bde49295e02e45c7e615f73aa4e0ccc2.