linux-kernel - PROBLEM: syzkaller found / pool corruption-overwrite / page in user-area or NULL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 10 Jan 2019 19:12:16 +0000
From:   Esme <esploit@...tonmail.ch>
To:     "dgilbert@...erlog.com" <dgilbert@...erlog.com>,
        "jejb@...ux.ibm.com" <jejb@...ux.ibm.com>,
        "martin.petersen@...cle.com" <martin.petersen@...cle.com>,
        "linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc:     "security@...nel.org" <security@...nel.org>
Subject: PROBLEM: syzkaller found / pool corruption-overwrite / page in user-area or NULL

Sorry for the resend some mail servers rejected the mime type.

Hi, I've been getting more into Kernel stuff lately and forged ahead with some syzkaller bug finding.  I played with reducing it further as you can see from the attached c code but am moving on and hope to get better about this process moving forward as I'm still building out my test systems/debugging tools.

Attached is the report and C repro that still triggers on a fresh git pull as of a few minutes ago, if you need anything else please let me know.
Esme

Linux syzkaller 5.0.0-rc1+ #5 SMP Tue Jan 8 20:39:33 EST 2019 x86_64 GNU/Linux

GNU C                   6.3.0
Binutils                2.28
Util-linux              2.29.2
Mount                   2.29.2
Module-init-tools       23
E2fsprogs               1.43.4
Linux C Library         2.24
Dynamic linker (ldd)    2.24
Linux C++ Library       6.0.22
Procps                  3.3.12
Sh-utils                8.26
Udev                    232

View attachment "test3.c" of type "text/x-csrc" (11298 bytes)

Download attachment "repro.report" of type "application/octet-stream" (12561 bytes)